Import compliance content

Having the Compliance Control Library is a prerequisite for importing any Compliance Regulatory Policy mentioned.

1. Log into the HPE ITOC server as root or non-root user.
2. Import the Control Library:

   $<itoc_install_directory>/importer/ControlImporter <controlBundleFile> <itocUser> <itocPassword> <tenant>

   For example:

   $/opt/hpe/itoc/importer/ControlImporter /tmp/hpitoc-WinControlLibrary.zip itocadmin hpitoc public

3. Run the controls importer once for each control package desired.
4. Import Policies:

   $<itoc_install_directory>/importer/PolicyImporter <policyZipFile> <itocUser> <itocUserPassword> <tenant>

   For example:

   $/opt/hpe/itoc/importer/PolicyImporter /tmp/hpitoc-cis-win2k12-3449-20141125.zip itocadmin hpitoc public

5. Run the Policy Importer once for each policy package desired.

Log files

The Control and Policy Import log files are located here:

$<itoc_install_directory>/importer/log

• ControlImporter.log - Control Import log file
• PolicyImporter.log – Policy Import log file

Software resources

Before you run scan and remediation against any of the following software resource types, perform the required configuration listed below for the specified software resource type:

• Apache HTTPD
• Apache Tomcat 6
• JBoss AS 7.1.1
• MySQL Community Server 5.6

Apache HTTPD

• Type of installation: Package provided by the OS vendor.

• Resource attributes needed at resource creation:

  • APACHE_PREFIX: The server root directory value where all of the Apache directories are located. This value can be obtained by running:

    $ httpd -V | grep <HTTPD_ROOT>

  • DOCROOT: Path to the Apache web document root from which HTTPD will serve files. Can we obtained from the HTTP configuration file.

  • HTTPD_ROOT: The same value as APACHE_PREFIX. However, this value might vary in other distributions.

    Note: APACHE_PREFIX may vary on Ubuntu 12.04 and can be obtained by running $ apache2 -V.

Apache Tomcat 6

• Source and type of installation: Download the package from the Apache Tomcat repository:

  http://tomcat.apache.org/download-60.cgi

• Resource attributes needed at resource creation:
  • CATALINA_HOME: This represents root of your Tomcat installation. This is can be obtained by running the ps command from command line, as shown in the following example:

    ps –ef | grep <tomcat>

  • CATALINA_BASE: The CATALINA_BASE value is the same as CATALINA_HOME. In case of multiple Tomat instances, you need to provide different resource attributes for the CATALINA_BASE value.
    Note: Rules that are applicable to protect Tomcat configurations in the Tomcat benchmark policy involve checking the file and group owners of Tomcat configuration files. We have updated the default file owner and group owner as “Tomcat” in the policy. Based on customer requirements, these values need to be updated in the policy.

JBoss AS 7.1.1

• Source and type of installation: Download the JBoss AS 7.1.1 Final package from the following link:

  http://jbossas.jboss.org/downloads/<JBoss AS 7.1.1 Final>

• Resource attribute needed at resource creation:
  • JBOSS_HOME: Specifies the path to the directory where JBoss is installed. The JBOSS_HOME value is displayed when the JBoss standalone service is started.
    Note: STANDALONE mode only is supported in ITOC Release 1.10.

MySQL Community Server 5.6

• Type of installation: Package provided by the OS vendor.
• Resource attributes needed at resource creation:
  • dbUser - Database user
  • dbPwd - Database password
  • dbName - Database name