Red Hat Security: Linux in Physical, Virtual, and Cloud

On serverc, install the oscap command-line tool and the SCAP Security Guide.

1. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

3. The openscap-scanner package provides the oscap command-line utility. Install that package.

   [root@serverc ~]# yum install openscap-scanner
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Complete!

4. Run the oscap -V command to confirm that the tool is now available.

   [root@serverc ~]# oscap -V
   OpenSCAP command line tool (oscap) 1.2.16
   Copyright 2009--2017 Red Hat Inc., Durham, North Carolina.
   ...output omitted...

5. The oscap command needs some security content to work. Install the scap-security-guide package, which provides the SCAP Security Guide. This SCAP Security Guide contains some standard security policies for Linux systems.

   [root@serverc ~]# yum install scap-security-guide
   ...output omitted...
   Is this ok [y/d/N]: y
   ...output omitted...
   Complete!

Review the available profiles in the SCAP Security Guide.

1. The scap-security-guide package installs the scap-security-guide(8) manual page. In this manual page, review the Red Hat Enterprise Linux 7 PROFILES section which lists and describes the available profiles.

   [root@serverc ~]# man scap-security-guide

2. Another way to list the available profiles is to directly review the XCCDF XML files. The scap-security-guide package deploys those files to the /usr/share/xml/scap/ssg/content/ directory. In that directory, extract the profile list from the ssg-rhel7-ds.xml file.

   [root@serverc ~]# grep '<Profile' \
   > /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
         <Profile id="xccdf_org.ssgproject.content_profile_standard">
         <Profile id="xccdf_org.ssgproject.content_profile_pci-dss">
         <Profile id="xccdf_org.ssgproject.content_profile_C2S">
         <Profile id="xccdf_org.ssgproject.content_profile_rht-ccp">
         <Profile id="xccdf_org.ssgproject.content_profile_common">
         <Profile id="xccdf_org.ssgproject.content_profile_stig-rhel7-disa">
         <Profile id="xccdf_org.ssgproject.content_profile_stig-rhevh-upstream">
         <Profile id="xccdf_org.ssgproject.content_profile_ospp-rhel7">
         <Profile id="xccdf_org.ssgproject.content_profile_cjis-rhel7-server">
         <Profile id="xccdf_org.ssgproject.content_profile_docker-host">
         <Profile id="xccdf_org.ssgproject.content_profile_nist-800-171-cui">

   The id attribute provides a unique identifier for each profile. You use this identifier with the oscap command to indicate the profile to use during a system scan.

3. The oscap info command can also parse this XML file and display the profiles.

   [root@serverc ~]# oscap info /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
   Document type: Source Data Stream
   Imported: 2018-01-08T08:03:07
   
   Stream: scap_org.open-scap_datastream_from_xccdf_ssg-rhel7-xccdf-1.2.xml
   Generated: (null)
   Version: 1.2
   Checklists:
   	Ref-Id: scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml
   		Status: draft
   		Generated: 2018-01-08
   		Resolved: true
   		Profiles:
   			Title: Standard System Security Profile
   				Id: xccdf_org.ssgproject.content_profile_standard
   			Title: PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7
   				Id: xccdf_org.ssgproject.content_profile_pci-dss
   			Title: C2S for Red Hat Enterprise Linux 7
   				Id: xccdf_org.ssgproject.content_profile_C2S
   			Title: Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)
   				Id: xccdf_org.ssgproject.content_profile_rht-ccp
   			Title: Common Profile for General-Purpose Systems
   				Id: xccdf_org.ssgproject.content_profile_common
   			Title: DISA STIG for Red Hat Enterprise Linux 7
   				Id: xccdf_org.ssgproject.content_profile_stig-rhel7-disa
   			Title: STIG for Red Hat Virtualization Hypervisor
   				Id: xccdf_org.ssgproject.content_profile_stig-rhevh-upstream
   			Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT
   				Id: xccdf_org.ssgproject.content_profile_ospp-rhel7
   			Title: Criminal Justice Information Services (CJIS) Security Policy
   				Id: xccdf_org.ssgproject.content_profile_cjis-rhel7-server
   			Title: Standard Docker Host Security Profile
   				Id: xccdf_org.ssgproject.content_profile_docker-host
   			Title: Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
   				Id: xccdf_org.ssgproject.content_profile_nist-800-171-cui
   ...output omitted...

Generate the HTML security guide for the Standard System Security profile (xccdf_org.ssgproject.content_profile_standard) and review the security rules included in that profile.

1. One way to retrieve the rules associated with a profile is to consult the XCCDF XML file, /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml. The oscap command can, however, generate a more palatable HTML version of the security guide for a specific profile.

   Use the oscap xccdf generate guide command to generate the HTML security guide for the Standard System Security profile.

   [root@serverc ~]# oscap xccdf generate guide \
   > --profile xccdf_org.ssgproject.content_profile_standard \
   > /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml > guide.html
   [root@serverc ~]# 

2. Use scp to copy the guide.html file to workstation so you can use Firefox to display it. Use student as the password.

   [root@serverc ~]# scp guide.html student@workstation:
   The authenticity of host 'workstation (172.25.250.254)' can't be established.
   ECDSA key fingerprint is SHA256:GCpIQxItJSWgZDzlmpnZINbwsjf9axrs+o6170OyOuk.
   ECDSA key fingerprint is MD5:2b:98:e1:85:8b:c7:ea:31:72:08:4d:39:15:ec:5d:da.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added 'workstation,172.25.250.254' (ECDSA) to the list of known hosts.
   student@workstation's password: student
   guide.html                                     100%  311KB  18.6MB/s   00:00

3. Log off from serverc.

   [root@serverc ~]# logout
   [student@serverc ~]$ logout
   [student@workstation ~]$ 

4. Use Firefox to display the guide.html file. Browse through the page and review some of the rules. Close Firefox when you are done.

   [student@workstation ~]$ firefox guide.html

   Navigate to Table of Contents → System Settings. Click the Installing and Maintaining Software link to review the Updating Software group information and Ensure Red Hat GPG Key Installed rule details.

On workstation, use the SCAP Workbench graphical utility to review the Standard System Security profile from the SCAP Security Guide.

1. The classroom setup has already installed the scap-workbench and the scap-security-guide packages on workstation. You can use the scap-workbench command to start the SCAP Workbench.

   [student@workstation ~]$ scap-workbench

   The SCAP Workbench detects that the SCAP Security Guide is already installed on the system and asks you to select the content to use.

   In the Select content to load field, select RHEL7 and click Load Content.

2. Locate the Profile field and select Standard System Security Profile. The lower part of the window displays the rules associated with that profile. Review the rules but do not initiate a scan at this time. Close the SCAP Workbench when you are done exploring.