|
 |
2b7b16 |
%global redhatssgversion 19
|
|
|
2b7b16 |
|
|
|
2b7b16 |
Name: scap-security-guide
|
|
|
2b7b16 |
Version: 0.1.%{redhatssgversion}
|
|
|
2b7b16 |
Release: 2%{?dist}
|
|
|
2b7b16 |
Summary: Security guidance and baselines in SCAP formats
|
|
|
2b7b16 |
|
|
|
2b7b16 |
Group: System Environment/Base
|
|
|
2b7b16 |
License: Public Domain
|
|
|
2b7b16 |
URL: https://fedorahosted.org/scap-security-guide/
|
|
|
2b7b16 |
|
|
|
2b7b16 |
Source0: http://repos.ssgproject.org/sources/%{name}-%{version}.tar.gz
|
|
|
2b7b16 |
Patch1: scap-security-guide-0.1.19-rhel7-include-only-rht-ccp-profile.patch
|
|
|
2b7b16 |
Patch2: scap-security-guide-0.1.19-rhel7-drop-restorecond-since-in-optional.patch
|
|
|
2b7b16 |
Patch3: scap-security-guide-0.1.19-rhel7-drop-cpuspeed-rule-since-obsolete.patch
|
|
|
2b7b16 |
Patch4: scap-security-guide-0.1.19-update-man-page-for-rhel7-content.patch
|
|
|
2b7b16 |
Patch5: scap-security-guide-0.1.19-rhel7-update-pam-XCCDF-to-use-pam_pwquality.patch
|
|
|
2b7b16 |
Patch6: scap-security-guide-0.1.20-rhel7-shared-fix-limit-password-reuse-remediation.patch
|
|
|
2b7b16 |
Patch7: scap-security-guide-0.1.20-rhel6-rhel7-PR#280-set-deny-prerequisite-#1.patch
|
|
|
2b7b16 |
Patch8: scap-security-guide-0.1.20-rhel6-rhel7-set-deny-prerequisite-#2.patch
|
|
|
2b7b16 |
Patch9: scap-security-guide-0.1.20-shared-fix-set-deny-for-failed-password-attempts-remediation.patch
|
|
|
2b7b16 |
Patch10: scap-security-guide-0.1.20-rhel7-specify-exact-profile-name-when-generating-guide.patch
|
|
|
2b7b16 |
BuildArch: noarch
|
|
|
2b7b16 |
|
|
|
2b7b16 |
BuildRequires: libxslt, expat, python, openscap-scanner >= 1.1.1, python-lxml
|
|
|
2b7b16 |
Requires: xml-common, openscap-scanner >= 1.1.1
|
|
|
2b7b16 |
|
|
|
2b7b16 |
%description
|
|
|
2b7b16 |
The scap-security-guide project provides a guide for configuration of the
|
|
|
2b7b16 |
system from the final system's security point of view. The guidance is
|
|
|
2b7b16 |
specified in the Security Content Automation Protocol (SCAP) format and
|
|
|
2b7b16 |
constitutes a catalog of practical hardening advice, linked to government
|
|
|
2b7b16 |
requirements where applicable. The project bridges the gap between generalized
|
|
|
2b7b16 |
policy requirements and specific implementation guidelines. The Red Hat
|
|
|
2b7b16 |
Enterprise Linux 7 system administrator can use the oscap command-line tool
|
|
|
2b7b16 |
from the openscap-utils package to verify that the system conforms to provided
|
|
|
2b7b16 |
guideline. Refer to scap-security-guide(8) manual page for further information.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
%prep
|
|
|
2b7b16 |
%setup -q -n %{name}-%{version}
|
|
|
2b7b16 |
# For RHEL-7 include only RHT-CCP profile
|
|
|
2b7b16 |
%patch1 -p1 -b .rht-ccp-only
|
|
|
2b7b16 |
# Drop restorecond due to https://github.com/OpenSCAP/scap-security-guide/issues/258
|
|
|
2b7b16 |
%patch2 -p1 -E -b .drop-restorecond
|
|
|
2b7b16 |
# Drop cpuspeed rule since obsoleted in Fedora-16 by cpupower from kernel-tools RPM
|
|
|
2b7b16 |
# http://marc.info/?l=fedora-devel-list&m=131107769617369&w=2
|
|
|
2b7b16 |
%patch3 -p1 -b .drop-cpuspeed
|
|
|
2b7b16 |
# Update manual page to be more appropriate against RHEL-7
|
|
|
2b7b16 |
%patch4 -p1 -b .manual-page
|
|
|
2b7b16 |
# Update pam.xml to use pam_pwquality instead of pam_cracklib
|
|
|
2b7b16 |
%patch5 -p1 -b .replace-pam_cracklib
|
|
|
2b7b16 |
# Fix 'Limit Password Reuse' remediation error
|
|
|
2b7b16 |
%patch6 -p1 -b .reuse
|
|
|
2b7b16 |
# Fix 'Set Deny For Failed Password Attempts' remediation error
|
|
|
2b7b16 |
%patch7 -p1
|
|
|
2b7b16 |
%patch8 -p1
|
|
|
2b7b16 |
%patch9 -p1 -b .set-deny
|
|
|
2b7b16 |
# Specify exact profile name when generating RHEL-7 HTML guide
|
|
|
2b7b16 |
%patch10 -p1 -b .exact-profile
|
|
|
2b7b16 |
|
|
|
2b7b16 |
%build
|
|
|
2b7b16 |
(cd RHEL/6 && make dist)
|
|
|
2b7b16 |
(cd RHEL/7 && make dist)
|
|
|
2b7b16 |
|
|
|
2b7b16 |
%install
|
|
|
2b7b16 |
|
|
|
2b7b16 |
mkdir -p %{buildroot}%{_datadir}/xml/scap/ssg/content
|
|
|
2b7b16 |
mkdir -p %{buildroot}%{_mandir}/en/man8/
|
|
|
2b7b16 |
|
|
|
2b7b16 |
# Add in RHEL-7 core content (SCAP)
|
|
|
2b7b16 |
cp -a RHEL/7/dist/content/* %{buildroot}%{_datadir}/xml/scap/ssg/content/
|
|
|
2b7b16 |
|
|
|
2b7b16 |
# Add in RHEL-6 datastream (SCAP)
|
|
|
2b7b16 |
cp -a RHEL/6/dist/content/ssg-rhel6-ds.xml %{buildroot}%{_datadir}/xml/scap/ssg/content
|
|
|
2b7b16 |
|
|
|
2b7b16 |
# Add in manpage
|
|
|
2b7b16 |
cp -a RHEL/6/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man8/scap-security-guide.8
|
|
|
2b7b16 |
|
|
|
2b7b16 |
%files
|
|
|
2b7b16 |
%defattr(-,root,root,-)
|
|
|
2b7b16 |
%{_datadir}/xml/scap
|
|
|
2b7b16 |
%lang(en) %{_mandir}/en/man8/scap-security-guide.8.gz
|
|
|
2b7b16 |
%doc RHEL/6/LICENSE RHEL/6/output/rhel6-guide.html RHEL/7/output/rhel7-ccp-guide.html RHEL/6/output/table-rhel6-cces.html RHEL/7/output/table-rhel7-cces.html RHEL/6/output/table-rhel6-nistrefs-common.html RHEL/6/output/table-rhel6-nistrefs.html RHEL/6/output/table-rhel6-srgmap-flat.html RHEL/6/output/table-rhel6-srgmap-flat.xhtml RHEL/6/output/table-rhel6-srgmap.html RHEL/6/output/table-rhel6-stig.html RHEL/6/input/auxiliary/DISCLAIMER
|
|
|
2b7b16 |
|
|
|
2b7b16 |
%changelog
|
|
|
2b7b16 |
* Tue Oct 21 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.19-2
|
|
|
2b7b16 |
- Fix Limit Password Reuse remediation script error
|
|
|
2b7b16 |
- Fix Set Deny For Failed Password Attempts remediation script error
|
|
|
2b7b16 |
- Use RHT-CCP profile name when generating HTML guide
|
|
|
2b7b16 |
- Describe RHT-CCP profile in the manual page
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon Sep 29 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.19-1
|
|
|
2b7b16 |
- Include RHEL-7 content (RHT-CCP profile only)
|
|
|
2b7b16 |
- Drop RHEL-7 restorecond XCCDF rule since policycoreutils-restorecond in Optional channel
|
|
|
2b7b16 |
- Drop RHEL-7 cpuspeed XCCDF rule since obsoleted by cpupower from kernel-tools
|
|
|
2b7b16 |
- Update manual page to be more appropriate for RHEL-7
|
|
|
2b7b16 |
- Drop RHEL-6 C2S profile update patch since merged upstream
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Tue Sep 02 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-4
|
|
|
2b7b16 |
- Initial build for Red Hat Enterprise Linux 7
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Thu Aug 28 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-3
|
|
|
2b7b16 |
- Update C2S profile <description> per request from CIS
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Thu Jun 26 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-2
|
|
|
2b7b16 |
- Include the upstream STIG for RHEL 6 Server profile disclaimer file too
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Sun Jun 22 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.18-1
|
|
|
2b7b16 |
- Make new 0.1.18 release
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Wed May 14 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.17-2
|
|
|
2b7b16 |
- Drop vendor line from the spec file. Let the build system to provide it.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri May 09 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.17-1
|
|
|
2b7b16 |
- Upgrade to upstream 0.1.17 version
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon May 05 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.16-2
|
|
|
2b7b16 |
- Initial RPM for RHEL base channels
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon May 05 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.16-1
|
|
|
2b7b16 |
- Change naming scheme (0.1-16 => 0.1.16-1)
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Feb 21 2014 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-16
|
|
|
2b7b16 |
- Include datastream file into RHEL6 RPM package too
|
|
|
2b7b16 |
- Bump version
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Tue Dec 24 2013 Shawn Wells <shawn@redhat.com> 0.1-16.rc2
|
|
|
2b7b16 |
+ RHEL6 stig-rhel6-server XCCDF profile renamed to stig-rhel6-server-upstream
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon Dec 23 2013 Shawn Wells <shawn@redhat.com> 0.1-16.rc1
|
|
|
2b7b16 |
- [bugfix] RHEL6 no_empty_passwords remediation script overwrote
|
|
|
2b7b16 |
system-auth symlink. Added --follow-symlink to sed command.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Nov 01 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15
|
|
|
2b7b16 |
- Version bump
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Sat Oct 26 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc5
|
|
|
2b7b16 |
- Point the spec's source to proper remote tarball location
|
|
|
2b7b16 |
- Modify the main Makefile to use remote tarball when building RHEL/6's SRPM
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Sat Oct 26 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc4
|
|
|
2b7b16 |
- Don't include the table html files two times
|
|
|
2b7b16 |
- Remove makewhatis
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Oct 25 2013 Shawn Wells <shawn@redhat.com> 0.1-15.rc3
|
|
|
2b7b16 |
- [bugfix] Updated rsyslog_remote_loghost to scan /etc/rsyslog.conf and /etc/rsyslog.d/*
|
|
|
2b7b16 |
- Numberous XCCDF->OVAL naming schema updates
|
|
|
2b7b16 |
- All rules now have CCE
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Oct 25 2013 Shawn Wells <shawn@redhat.com> 0.1-15.rc2
|
|
|
2b7b16 |
- RHEL/6 HTML table naming bugfixes (table-rhel6-*, not table-*-rhel6)
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Oct 25 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-15.rc1
|
|
|
2b7b16 |
- Apply spec file changes required by review request (RH BZ#1018905)
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Thu Oct 24 2013 Shawn Wells <shawn@redhat.com> 0.1-14
|
|
|
2b7b16 |
- Formal RPM release
|
|
|
2b7b16 |
- Inclusion of rht-ccp profile
|
|
|
2b7b16 |
- OVAL unit testing patches
|
|
|
2b7b16 |
- Bash remediation patches
|
|
|
2b7b16 |
- Bugfixes
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon Oct 07 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-14.rc1
|
|
|
2b7b16 |
- Change RPM versioning scheme to include release into tarball
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Sat Sep 28 2013 Shawn Wells <shawn@redhat.com> 0.1-13
|
|
|
2b7b16 |
- Updated RPM spec file to fix rpmlint warnings
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Wed Jun 26 2013 Shawn Wells <shawn@redhat.com> 0.1-12
|
|
|
2b7b16 |
- Updated RPM version to 0.1-12
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Apr 26 2013 Shawn Wells <shawn@redhat.com> 0.1-11
|
|
|
2b7b16 |
- Significant amount of OVAL bugfixes
|
|
|
2b7b16 |
- Incorporation of Draft RHEL/6 STIG feedback
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Sat Feb 16 2013 Shawn Wells <shawn@redhat.com> 0.1-10
|
|
|
2b7b16 |
- `man scap-security-guide`
|
|
|
2b7b16 |
- OVAL bug fixes
|
|
|
2b7b16 |
- NIST 800-53 mappings update
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Wed Nov 28 2012 Shawn Wells <shawn@redhat.com> 0.1-9
|
|
|
2b7b16 |
- Updated BuildRequires to reflect python-lxml (thank you, Ray S.!)
|
|
|
2b7b16 |
- Reverting to noarch RPM
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Tue Nov 27 2012 Shawn Wells <shawn@redhat.com> 0.1-8
|
|
|
2b7b16 |
- Significant copy editing to XCCDF rules per community
|
|
|
2b7b16 |
feedback on the DISA RHEL/6 STIG Initial Draft
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Thu Nov 1 2012 Shawn Wells <shawn@redhat.com> 0.1-7
|
|
|
2b7b16 |
- Corrected XCCDF content errors
|
|
|
2b7b16 |
- OpenSCAP now supports CPE dictionaries, important to
|
|
|
2b7b16 |
utilize --cpe-dict when scanning machines with OpenSCAP,
|
|
|
2b7b16 |
e.g.:
|
|
|
2b7b16 |
$ oscap xccdf eval --profile stig-server \
|
|
|
2b7b16 |
--cpe-dict ssg-rhel6-cpe-dictionary.xml ssg-rhel6-xccdf.xml
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon Oct 22 2012 Shawn Wells <shawn@redhat.com> 0.1-6
|
|
|
2b7b16 |
- Corrected RPM versioning, we're on 0.1 release 6 (not version 1 release 6)
|
|
|
2b7b16 |
- Updated RPM includes feedback received from DoD Consensus meetings
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Fri Oct 5 2012 Jeffrey Blank <blank@eclipse.ncsc.mil> 1.0-5
|
|
|
2b7b16 |
- Adjusted installation directory to /usr/share/xml/scap.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Tue Aug 28 2012 Spencer Shimko <sshimko@tresys.com> 1.0-4
|
|
|
2b7b16 |
- Fix BuildRequires and Requires.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Tue Jul 3 2012 Jeffrey Blank <blank@eclipse.ncsc.mil> 1.0-3
|
|
|
2b7b16 |
- Modified install section, made description more concise.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Thu Apr 19 2012 Spencer Shimko <sshimko@tresys.com> 1.0-2
|
|
|
2b7b16 |
- Minor updates to pass some variables in from build system.
|
|
|
2b7b16 |
|
|
|
2b7b16 |
* Mon Apr 02 2012 Shawn Wells <shawn@redhat.com> 1.0-1
|
|
|
2b7b16 |
- First attempt at SSG RPM. May ${deity} help us...
|