From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-649144-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
by finch.gentoo.org (Postfix) with ESMTP id 2BFF9138819
for <garchives@archives.gentoo.org>; Wed, 11 Dec 2013 20:58:47 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 1D55BE099B;
Wed, 11 Dec 2013 20:58:43 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
(using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 9E75AE099B
for <gentoo-commits@lists.gentoo.org>; Wed, 11 Dec 2013 20:58:42 +0000 (UTC)
Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163])
(using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id C714333F152
for <gentoo-commits@lists.gentoo.org>; Wed, 11 Dec 2013 20:58:41 +0000 (UTC)
Received: from localhost.localdomain (localhost [127.0.0.1])
by hornbill.gentoo.org (Postfix) with ESMTP id 78D44D0045
for <gentoo-commits@lists.gentoo.org>; Wed, 11 Dec 2013 20:58:40 +0000 (UTC)
From: "Sven Vermeulen" <swift@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" <swift@gentoo.org>
Message-ID: <1386795424.e2889daaff3266ba8ce6e595ca6cd03a7a00a9a6.swift@gentoo>
Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/SCAP/
X-VCS-Repository: proj/hardened-docs
X-VCS-Files: xml/SCAP/openssh-xccdf.xml
X-VCS-Directories: xml/SCAP/
X-VCS-Committer: swift
X-VCS-Committer-Name: Sven Vermeulen
X-VCS-Revision: e2889daaff3266ba8ce6e595ca6cd03a7a00a9a6
X-VCS-Branch: master
Date: Wed, 11 Dec 2013 20:58:40 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Archives-Salt: 92aed6c9-2637-47b9-8d36-e3739d886cc9
X-Archives-Hash: 722dfce2e6e5976e65566d17f5f2d2bc
commit: e2889daaff3266ba8ce6e595ca6cd03a7a00a9a6
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Dec 11 20:57:04 2013 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Wed Dec 11 20:57:04 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=e2889daa
Use XCCDF 1.2 in explanation
---
xml/SCAP/openssh-xccdf.xml | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/xml/SCAP/openssh-xccdf.xml b/xml/SCAP/openssh-xccdf.xml
index 0230c63..7d031b1 100644
--- a/xml/SCAP/openssh-xccdf.xml
+++ b/xml/SCAP/openssh-xccdf.xml
@@ -50,7 +50,7 @@
the following command is used to generate the HTML output:
<h:br />
<h:pre>### Command to generate this guide ###
-# <h:b>oscap xccdf generate guide scap-openssh-xccdf.xml > output.html</h:b>
+# <h:b>oscap xccdf generate guide openssh-xccdf.xml > guide-openssh-xccdf.html</h:b>
</h:pre>
<h:br />
Secondly, together with this XCCDF XML, you will also find an OVAL XML file.
@@ -60,12 +60,19 @@
<h:br />
You can test the benchmark against your configuration.
<h:pre>### Testing the rules mentioned in the XCCDF document ###
-# <h:b>oscap xccdf eval --profile Default scap-openssh-xccdf.xml</h:b></h:pre>
+# <h:b>oscap xccdf eval --cpe gentoo-cpe.xml --profile xccdf_org.gentoo.dev.swift_profile_default openssh-xccdf.xml</h:b></h:pre>
<h:br />
To generate a full report in HTML as well, you can use the next command:
<h:pre>### Testing the rules and generating an HTML report ###
-# <h:b>oscap xccdf eval --profile Default --results xccdf-results.xml --report report.html scap-openssh-xccdf.xml</h:b></h:pre>
+# <h:b>oscap xccdf eval --cpe gentoo-cpe.xml --profile xccdf_org.gentoo.dev.swift_profile_default --results results-openssh-xccdf.xml --report report-openssh-xccdf.html openssh-xccdf.xml</h:b></h:pre>
<h:br />
+ <h:br />
+ The benchmark is also available as data stream. In this case, you do not
+ need to provide the various files - all you need is the benchmark file.
+ For instance:
+ <h:pre>### Testing the rules based on the data stream
+# <h:b>oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default openssh-ds.xml</h:b></h:pre>
+ <h:br />
Finally, this benchmark will suggest some settings which you do not want
to enable. That is perfectly fine - even more, some settings might even
raise eyebrows left and right. We'll try to document the reasoning behind