Hi,

Which version of DISA STIG Viewer do you use? I have found that the man page says that with DISA STIG Viewer 2.6 or newer you can't use --stig-viewer option but you should use --results instead. So if you use newer version than 2.6 please check that you don't use --stig-viewer option with oscap but you use --results. I'm not able to reproduce your problem with DISA STIG Viewer 2.11. I haven't tried with older versions, though. Can you upgrade to DISA STIG Viewer 2.11? (It can be obtained from https://public.cyber.mil/stigs/srg-stig-tools/). Can you describe the steps you perform in the STIG viewer and paste the errors you see?

Dan, 

I'll try to explain the expected behaviour of --stig-viewer option from OpenSCAP.

This option is solely intended to be used when you import the "benchmark file from the DISA web site" into stig-viewer. When activated, it will search for STIG id references in the content and it will map according to rules present in the DISA's benchmark, so that the results file contains the correct mapping to rules within DISA's benchmark.

That's why it won't work with /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml since the rule IDs in the results data don't match. To work with this file you should just use the output file from --results option.

But what about RHEL8 and STIG?

So, there is no official content released by DISA so far. They've published a draft, but that content is not reflected in scap-security-guide yet and that's the reason you cannot "import" the file into STIG viewer, but that's expected. So, if you want to load results into stig-viewer you would have to use /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml and the output file from --results option. Although I don't think it brings much benefit because it's much easier, in this case, to just check the HTML report that would be generated by the --report option in oscap.

Created attachment 1734990 [details]
oscap command

Created attachment 1734991 [details]
oscap import error

Gabriel,

Yes I was able to get RHEL7 to work with the RHEL7 benchmark as stated above. For any accreditation effort I must provide a STIG Viewer checklist (.ckl) to be uploaded in the DoD security tracking system and I would rather not go through the draft STIG manually, therefore it sounds like I will wait for the DISA benchmark and the official RHEL8 STIG. I have the html output for oscap which shows we are in good shape, so we are in a holding pattern.  I was just trying to find out why it didn't work, when the documentation I had found thus far indicated that the openscap results should be compatible with STIG Viewer.

Thx,

Shawn Henson

Thanks everybody for clarification.

We have found that the expected workflow for STIG Viewer support is:
1) run oscap with data stream from scap-security-guide package and --stig-viewer option
2) open DISA STIG from DISA's website in DISA STIG Viewer
3) import file produced by oscap --stig-viewer to DISA STIG Viewer

This workflow works in RHEL 7.

However, this workflow doesn't work on RHEL 8, because the stig profile in ssg-rhel8-ds.xml provided by scap-security-guide package doesn't contain the references to DISA STIG. The reason is that scap-security-guide in RHEL 8 hasn't been updated to match DISA STIG for RHEL 8. After scap-security-guide is updated to align with DISA STIG for RHEL 8 these steps should start to work also on RHEL 8. Update of scap-security-guide to match DISA STIG for RHEL 8 is tracked in https://bugzilla.redhat.com/show_bug.cgi?id=1918742.

The root cause of this BZ are missing references to DISA STIG in scap-security-guide in RHEL 8. Because adding references is a part of update process tracked in https://bugzilla.redhat.com/show_bug.cgi?id=1918742 we are closing this bug as a duplicate.

The documenataion for --stig-viewer is unfortunate, I have requested the improvement in https://bugzilla.redhat.com/show_bug.cgi?id=1918759

*** This bug has been marked as a duplicate of bug 1918742 ***