[CentOS] OpenSCAP failures to to OS version?

Noam Bernstein

noam.bernstein at nrl.navy.mil
Thu Jan 5 20:43:09 UTC 2017


Hi - I’m running the OpenSCAP STIG profile on a new CentOS 7.1611 installation, and I get a few failures that look like this (output from openscap scan —verbosity INFO).  I suspect this is because the openscap module is not accepting CentOS 7 as RHEL 7 for rules purposes, despite an early check for "Community Enterprise Operating System 7” which succeeds.  

1. Am I correct in why it’s failing?
2. Is this a bug, or an accepted behavior given that CentOS isn’t actually RHEL?

							Noam


I: oscap: Evaluating XCCDF rule 'accounts_password_pam_retry'.
I: oscap: Evaluating definition 'oval:org.open-scap.cpe.rhel:def:7': Red Hat Enterprise Linux 7.
I: oscap: Definition 'oval:org.open-scap.cpe.rhel:def:7' evaluated as false.
I: oscap: Evaluating definition 'oval:org.open-scap.cpe.rhel:def:1007': Community Enterprise Operating System 7.
I: oscap: Definition 'oval:org.open-scap.cpe.rhel:def:1007' evaluated as true.
I: oscap: Adding external variable oval:ssg-var_password_pam_retry:var:1.
I: oscap: Evaluating definition 'oval:ssg-accounts_password_pam_retry:def:1': Set Password retry Requirements.
I: oscap:   Criteria are extended by definition 'oval:ssg-installed_OS_is_rhel6:def:1'.
I: oscap:   Evaluating definition 'oval:ssg-installed_OS_is_rhel6:def:1': Red Hat Enterprise Linux 6.
I: oscap:   Definition 'oval:ssg-installed_OS_is_rhel6:def:1' evaluated as false.
I: oscap:   Evaluating textfilecontent54 test 'oval:ssg-test_password_pam_cracklib_retry:tst:1': check the configuration of /etc/pam.d/system-auth.
I: oscap:     Querying textfilecontent54 object 'oval:ssg-obj_password_pam_cracklib_retry:obj:1', flags: 0.
I: oscap:     Creating new syschar for textfilecontent54_object 'oval:ssg-obj_password_pam_cracklib_retry:obj:1'.
I: probe_textfilecontent54: Opening file '/etc/pam.d/system-auth'.
I: oscap:     State 'oval:ssg-state_password_pam_retry:ste:1' references external_variable 'oval:ssg-var_password_pam_retry:var:1'.
I: oscap:     Test 'oval:ssg-test_password_pam_cracklib_retry:tst:1' requires that at least one object defined by 'oval:ssg-obj_password_pam_cracklib_retry:obj:1' exists on the system.
I: oscap:     0 objects defined by 'oval:ssg-obj_password_pam_cracklib_retry:obj:1' exist on the system.
I: oscap:     No item matching object 'oval:ssg-obj_password_pam_cracklib_retry:obj:1' was found on the system. (flag=does not exist)
I: oscap:   Test 'oval:ssg-test_password_pam_cracklib_retry:tst:1' evaluated as false.
I: oscap:   Criteria are extended by definition 'oval:ssg-installed_OS_is_rhel7:def:1'.
I: oscap:   Evaluating definition 'oval:ssg-installed_OS_is_rhel7:def:1': Red Hat Enterprise Linux 7.
I: oscap:   Definition 'oval:ssg-installed_OS_is_rhel7:def:1' evaluated as false.
I: oscap:   Evaluating textfilecontent54 test 'oval:ssg-test_password_pam_pwquality_retry:tst:1': check the configuration of /etc/pam.d/system-auth.
I: oscap:     Querying textfilecontent54 object 'oval:ssg-obj_password_pam_pwquality_retry:obj:1', flags: 0.
I: oscap:     Creating new syschar for textfilecontent54_object 'oval:ssg-obj_password_pam_pwquality_retry:obj:1'.
I: probe_textfilecontent54: Opening file '/etc/pam.d/system-auth'.
I: oscap:     State 'oval:ssg-state_password_pam_retry:ste:1' references external_variable 'oval:ssg-var_password_pam_retry:var:1'.
I: oscap:     Test 'oval:ssg-test_password_pam_pwquality_retry:tst:1' requires that at least one object defined by 'oval:ssg-obj_password_pam_pwquality_retry:obj:1' exists on the system.
I: oscap:     1 objects defined by 'oval:ssg-obj_password_pam_pwquality_retry:obj:1' exist on the system.
I: oscap:     All items matching object 'oval:ssg-obj_password_pam_pwquality_retry:obj:1' were collected. (flag=complete)
I: oscap:     In test 'oval:ssg-test_password_pam_pwquality_retry:tst:1' all of the collected items must satisfy these states: 'oval:ssg-state_password_pam_retry:ste:1'.
I: oscap:     Entity 'subexpression'='3' of item '106534257' matches corresponding entity in state 'oval:ssg-state_password_pam_retry:ste:1'.
I: oscap:     Item '106534257' compared to state 'oval:ssg-state_password_pam_retry:ste:1' with result true.
I: oscap:   Test 'oval:ssg-test_password_pam_pwquality_retry:tst:1' evaluated as true.
I: oscap:   Criteria are extended by definition 'oval:ssg-installed_OS_is_fedora:def:1'.
I: oscap:   Evaluating definition 'oval:ssg-installed_OS_is_fedora:def:1': Installed operating system is Fedora.
I: oscap:   Definition 'oval:ssg-installed_OS_is_fedora:def:1' evaluated as false.
I: oscap:   Evaluating textfilecontent54 test 'oval:ssg-test_password_pam_pwquality_retry:tst:1': check the configuration of /etc/pam.d/system-auth.
I: oscap:   Test 'oval:ssg-test_password_pam_pwquality_retry:tst:1' evaluated as true.
I: oscap: Definition 'oval:ssg-accounts_password_pam_retry:def:1' evaluated as false.




More information about the CentOS mailing list