# Understanding the Components

## Content Location

On Red Hat Enterpise Linux 6, SCAP content is stored under `/usr/share/xml/scap/`, with each content provider responsible for creating their own subdirectories. The SSG project deploys content into `/usr/share/xml/scap/ssg/` with the following sub directories:

- `content/`

  Houses SCAP content utilizing the following naming conventions:

  - CPE Dictionaries

    `ssg-{profile}-cpe-dictionary.xml`

  - CPE OVAL Content

    `ssg-{profile}-cpe-oval.xml`

  - OVAL Content

    `ssg-{profile}-oval.xml`

  - XCCDF Content

    `ssg-{profile}-xccdf.xml`

- `guides/`

  HTML versions of SSG profiles, easily consumable by humans.

- `policytables/`

  HTML tables reflecting which institutionalized policy a particular SSG rule conforms to.

## OpenSCAP

The SCAP protocol suite contains multiple complex data exchange formats that are used to transmit important vulnerability, configuration, and other security data. Historically there have been few tools that provide a way to query this data in the needed format. This lack of tools makes the barrier to entry very high and discourages adoption of these protocols by the community. It's the goal of the OpenSCAP project to create a framework of libraries and tools to improve the accessibility of SCAP and enhance the usability of the information it presents.

SCAP is a protocol, akin to HTML, and consumers must use a protocol interpreter. OpenSCAP provides that functionality for Red Hat platforms.

The OpenSCAP homepage can be found at

## XCCDF

As documented by NIST on their XCCDF specification page at :

    XCCDF is a specification language for writing security checklists, benchmarks, and related kinds of documents. An XCCDF document represents a structured collection of security configuration rules for some set of target systems. The specification is designed to support information interchange, document generation, organizational and situational tailoring, automated compliance testing, and compliance scoring. The specification also defines a data model and format for storing results of benchmark compliance testing. The intent of XCCDF is to provide a uniform foundation for expression of security checklists, benchmarks, and other configuration guidance, and thereby foster more widespread application of good security practices.

    XCCDF documents are expressed in XML, and may be validated with an XML Schema-validating parser.

    Development of the XCCDF specification is being led by NSA, with contributions from other agencies and organizations. The current public draft of the specification document and related files can be downloaded below. A mailing list for XCCDF developers is available, please subscribe to participate in discussions. A publicly available archive of the XCCDF mailing list is also available.

Within the project, XCCDF content is retained in `/usr/share/xml/scap/ssg/content/`.

### Sample XCCDF Code

To understand XCCDF, let's review the `service_telnetd_disabled` rule within `ssg-rhel6-xccdf.xml`. `$ vim /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml`

Once loaded, locate the service_telnetd_disabled rule: `<Rule id=”service_telnetd_disabled`

XCCDF Rule Elements

XML Tag | Meaning
--- | ---
<Rule> | Indicates: Rule Name `...id="service_telnetd_disabled" ...` Severity `...severity="high"...` If the rule is enforced / selected `... selected="true"...`
<title> | The XCCDF Rule title.
<description> | Largely free form, contains implementation instructions and any policy references.
<rationale> | Identifies the logic behind applying this <rule> to the system. Answers "why is this important"?
<ident> | Identifies CCE mapping
<check system...> | Identifies which version of OVAL the check was written for
<check-content-ref...> | There are two elements for this tag: href=... Path to associated OVAL file name=... Identifies the corresponding OVAL rule name, such as oval:ssg:def:281. If one were to search for this rule within the href= identified file, they would be brought to the corresponding OVAL code.

### Profiles

XCCDF rules are logically organized into profiles. To query which profiles are contained within the SCAP Security Guide project, run the following command:

    $ grep -n "<Profile" /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
    40: <Profile id="test">
    67: <Profile id="CS2">
    398: <Profile id="common">
    613: <Profile id="server">
    832: <Profile id="stig-rhel6-server">
    1101: <Profile id="usgcb-rhel6-server">
    1360: <Profile id="rht-ccp">