Mailinglist Archive: opensuse-security (32 mails)

< Previous Next >
Re: [opensuse-security] OpenVAS likes to create security test environments for SUSE products
  • From: Marcus Meissner <meissner@xxxxxxx>
  • Date: Fri, 9 Jan 2009 23:30:37 +0100
  • Message-id: <20090109223037.GB18303@xxxxxxx>
On Fri, Jan 09, 2009 at 11:13:53PM +0100, Jan-Oliver Wagner wrote:
Hi,

the network security scanner OpenVAS [1] has progressed a lot since I
mentioned
it here on this list first time.
Seem like it even made it into SUSE [2].

Now we are working on a automatic generator for security checks for SUSE
based on the SUSE security announcements, like this one [3].
The generator creates so-called NVTs (Network Vulerability Tests) for the
language NASL and also for OVAL.

This works well for the openSUSE distributions because [3] contains
the RPM IDs to check for.

It is not so easy for products like SLES where you have to follow a couple
of links before you see the packages. This is not so simple to automize.

Do you see any chance to make life easier here?

Yes. I have "creating OVAL descriptions" for security updates on my short range
TODO list.

Also, we are lacking identifier strings for all of the different products.
We usually look into /etc/SuSE-release to find out. Is there a list
somewhere with _all_ identifiers?

Hmm. Not a conclusive list. :/

Ciao, Marcus
--
To unsubscribe, e-mail: opensuse-security+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-security+help@xxxxxxxxxxxx

< Previous Next >
List Navigation
Follow Ups
References