Hi - I?m running the OpenSCAP STIG profile on a new CentOS 7.1611 installation,
and I get a few failures that look like this (output from openscap scan
?verbosity INFO). I suspect this is because the openscap module is not
accepting CentOS 7 as RHEL 7 for rules purposes, despite an early check for
"Community Enterprise Operating System 7? which succeeds.
1. Am I correct in why it?s failing?
2. Is this a bug, or an accepted behavior given that CentOS isn?t actually RHEL?
Noam
I: oscap: Evaluating XCCDF rule 'accounts_password_pam_retry'.
I: oscap: Evaluating definition 'oval:org.open-scap.cpe.rhel:def:7': Red
Hat Enterprise Linux 7.
I: oscap: Definition 'oval:org.open-scap.cpe.rhel:def:7' evaluated as
false.
I: oscap: Evaluating definition 'oval:org.open-scap.cpe.rhel:def:1007':
Community Enterprise Operating System 7.
I: oscap: Definition 'oval:org.open-scap.cpe.rhel:def:1007' evaluated as
true.
I: oscap: Adding external variable oval:ssg-var_password_pam_retry:var:1.
I: oscap: Evaluating definition
'oval:ssg-accounts_password_pam_retry:def:1': Set Password retry
Requirements.
I: oscap: Criteria are extended by definition
'oval:ssg-installed_OS_is_rhel6:def:1'.
I: oscap: Evaluating definition
'oval:ssg-installed_OS_is_rhel6:def:1': Red Hat Enterprise Linux 6.
I: oscap: Definition 'oval:ssg-installed_OS_is_rhel6:def:1' evaluated
as false.
I: oscap: Evaluating textfilecontent54 test
'oval:ssg-test_password_pam_cracklib_retry:tst:1': check the
configuration of /etc/pam.d/system-auth.
I: oscap: Querying textfilecontent54 object
'oval:ssg-obj_password_pam_cracklib_retry:obj:1', flags: 0.
I: oscap: Creating new syschar for textfilecontent54_object
'oval:ssg-obj_password_pam_cracklib_retry:obj:1'.
I: probe_textfilecontent54: Opening file '/etc/pam.d/system-auth'.
I: oscap: State 'oval:ssg-state_password_pam_retry:ste:1' references
external_variable 'oval:ssg-var_password_pam_retry:var:1'.
I: oscap: Test 'oval:ssg-test_password_pam_cracklib_retry:tst:1'
requires that at least one object defined by
'oval:ssg-obj_password_pam_cracklib_retry:obj:1' exists on the system.
I: oscap: 0 objects defined by
'oval:ssg-obj_password_pam_cracklib_retry:obj:1' exist on the system.
I: oscap: No item matching object
'oval:ssg-obj_password_pam_cracklib_retry:obj:1' was found on the
system. (flag=does not exist)
I: oscap: Test 'oval:ssg-test_password_pam_cracklib_retry:tst:1'
evaluated as false.
I: oscap: Criteria are extended by definition
'oval:ssg-installed_OS_is_rhel7:def:1'.
I: oscap: Evaluating definition
'oval:ssg-installed_OS_is_rhel7:def:1': Red Hat Enterprise Linux 7.
I: oscap: Definition 'oval:ssg-installed_OS_is_rhel7:def:1' evaluated
as false.
I: oscap: Evaluating textfilecontent54 test
'oval:ssg-test_password_pam_pwquality_retry:tst:1': check the
configuration of /etc/pam.d/system-auth.
I: oscap: Querying textfilecontent54 object
'oval:ssg-obj_password_pam_pwquality_retry:obj:1', flags: 0.
I: oscap: Creating new syschar for textfilecontent54_object
'oval:ssg-obj_password_pam_pwquality_retry:obj:1'.
I: probe_textfilecontent54: Opening file '/etc/pam.d/system-auth'.
I: oscap: State 'oval:ssg-state_password_pam_retry:ste:1' references
external_variable 'oval:ssg-var_password_pam_retry:var:1'.
I: oscap: Test 'oval:ssg-test_password_pam_pwquality_retry:tst:1'
requires that at least one object defined by
'oval:ssg-obj_password_pam_pwquality_retry:obj:1' exists on the system.
I: oscap: 1 objects defined by
'oval:ssg-obj_password_pam_pwquality_retry:obj:1' exist on the system.
I: oscap: All items matching object
'oval:ssg-obj_password_pam_pwquality_retry:obj:1' were collected.
(flag=complete)
I: oscap: In test 'oval:ssg-test_password_pam_pwquality_retry:tst:1'
all of the collected items must satisfy these states:
'oval:ssg-state_password_pam_retry:ste:1'.
I: oscap: Entity 'subexpression'='3' of item
'106534257' matches corresponding entity in state
'oval:ssg-state_password_pam_retry:ste:1'.
I: oscap: Item '106534257' compared to state
'oval:ssg-state_password_pam_retry:ste:1' with result true.
I: oscap: Test 'oval:ssg-test_password_pam_pwquality_retry:tst:1'
evaluated as true.
I: oscap: Criteria are extended by definition
'oval:ssg-installed_OS_is_fedora:def:1'.
I: oscap: Evaluating definition
'oval:ssg-installed_OS_is_fedora:def:1': Installed operating system is
Fedora.
I: oscap: Definition 'oval:ssg-installed_OS_is_fedora:def:1' evaluated
as false.
I: oscap: Evaluating textfilecontent54 test
'oval:ssg-test_password_pam_pwquality_retry:tst:1': check the
configuration of /etc/pam.d/system-auth.
I: oscap: Test 'oval:ssg-test_password_pam_pwquality_retry:tst:1'
evaluated as true.
I: oscap: Definition 'oval:ssg-accounts_password_pam_retry:def:1'
evaluated as false.
