Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
Objectives
After completing this section, students should be able to evaluate a server's compliance with the requirements specified by a policy from the SCAP Security Guide using OpenSCAP tools.
Introducing the oscap Command
You can use the oscap command-line tool to scan a system for compliance with a SCAP policy, generate remediation scripts, and create reports and guides.
The oscap command needs some security content to work.
The scap-security-guide package provides the SCAP Security Guide, which contains some standard security policies for Linux systems.
The package installs content files in the /usr/share/xml/scap/ssg/content/ directory.
The files with names ending with -ds.xml in that directory are XCCDF data stream files.
They define the compliance policies for different applications, such as Firefox, or operating systems, such as Red Hat Enterprise Linux.
[user@demo ~]$cd /usr/share/xml/scap/ssg/content[user@demo content]$ls *-ds.xmlssg-firefox-ds.xml ssg-jre-ds.xml ssg-rhel6-ds.xml ssg-rhel7-ds.xml
A data stream file can also define multiple profiles that you can choose when scanning a system for compliance. To list the available profiles, use the oscap info command.
[user@demo content]$oscap info ./ssg-rhel7-ds.xmlDocument type: Source Data Stream Imported: 2018-04-27T15:03:29 Stream: scap_org.open-scap_datastream_from_xccdf_ssg-rhel7-xccdf-1.2.xml Generated: (null) Version: 1.2 Checklists: Ref-Id: scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml Status: draft Generated: 2018-04-27 Resolved: true Profiles: Title: Standard System Security Profile Id: xccdf_org.ssgproject.content_profile_standard Title: PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7 Id: xccdf_org.ssgproject.content_profile_pci-dss Title: C2S for Red Hat Enterprise Linux 7 Id: xccdf_org.ssgproject.content_profile_C2S Title: Red Hat Corporate Profile for Certified Cloud Providers (RH CCP) Id: xccdf_org.ssgproject.content_profile_rht-ccp Title: Common Profile for General-Purpose Systems Id: xccdf_org.ssgproject.content_profile_common Title: DISA STIG for Red Hat Enterprise Linux 7 Id: xccdf_org.ssgproject.content_profile_stig-rhel7-disa Title: STIG for Red Hat Virtualization Hypervisor Id: xccdf_org.ssgproject.content_profile_stig-rhevh-upstream Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT Id: xccdf_org.ssgproject.content_profile_ospp-rhel7 Title: Criminal Justice Information Services (CJIS) Security Policy Id: xccdf_org.ssgproject.content_profile_cjis-rhel7-server Title: Standard Docker Host Security Profile Id: xccdf_org.ssgproject.content_profile_docker-host Title: Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) Id: xccdf_org.ssgproject.content_profile_nist-800-171-cui ...output omitted...
Scanning a System for Compliance
In order to scan a system, install the openscap-scanner and scap-security-guide packages on that system, and select the XCCDF data stream file and the profile you want to use.
Run the oscap xccdf eval command to scan the system.
Provide the data stream file as an argument, and the identifier of the profile to use with the --profile option.
The command displays the result of each test on the standard output, but you can save these results in an XML file with the --results option.
With that file, you can later generate reports and remediation scripts.
The following example shows how to use the oscap xccdf eval command to scan the local system.
It uses the data stream file for Red Hat Enterprise Linux 7, /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml.
The security profile being applied from the data stream is the PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7, xccdf_org.ssgproject.content_profile_pci-dss.
The results of the scan are saved to /root/results.xml.
[root@demo ~]#oscap xccdf eval \>--profile xccdf_org.ssgproject.content_profile_pci-dss \>--results /root/results.xml \>/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xmlWARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them. WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content Title Ensure Red Hat GPG Key Installed Rule xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed Ident CCE-26957-1 Result pass Title Ensure gpgcheck Enabled In Main Yum Configuration Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated Ident CCE-26989-4 Result pass Title Ensure gpgcheck Enabled For All Yum Package Repositories Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled Ident CCE-26876-3 Result pass TitleEnsure Software Patches InstalledRule xccdf_org.ssgproject.content_rule_security_patches_up_to_date Ident CCE-26895-3 Resultnotchecked...output omitted...
You need to run the command as root because the scan process may need to evaluate files only accessible to the root user.
Notice the warning messages in the command output, and the result of the Ensure Software Patches Installed test.
The scan skips that test because it needs an up-to-date list of patches to control.
If the system can access the internet, the oscap command can download that list from Red Hat.
Add the --fetch-remote-resources option in that case.
[root@demo ~]#oscap xccdf eval --fetch-remote-resources \>--profile xccdf_org.ssgproject.content_profile_pci-dss \>--results /root/results.xml \>/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xmlDownloading: https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... ok Title Ensure Red Hat GPG Key Installed Rule xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed Ident CCE-26957-1 Result pass Title Ensure gpgcheck Enabled In Main Yum Configuration Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated Ident CCE-26989-4 Result pass Title Ensure gpgcheck Enabled For All Yum Package Repositories Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled Ident CCE-26876-3 Result pass Title Ensure Software Patches Installed Rule xccdf_org.ssgproject.content_rule_security_patches_up_to_date Ident CCE-26895-3 Result fail ...output omitted...
Generating and Viewing the HTML Report
After the scan is complete, you can use the resulting XML file to generate a complete report in HTML format.
Run the oscap xccdf generate report command.
[root@demo ~]#oscap xccdf generate report results.xml > results.html
Use Firefox on demo to view a report generated locally on serverc and copied to demo for viewing.
[root@demo ~]#firefox results.html
In the Firefox web browser navigate to the Evaluation Characteristics section to view initial details related to the target system of the compliance scan. This section includes scan characteristics such as the name of the system targeted for evaluation, start and finish times, network addresses, and other scan results.
Navigate to the Compliance and Scoring section to view a chart of the total number of rules that either passed or failed compliance and totals of severity levels for failed rules.
Navigate to the Rule Overview section to view rule groups. Notice the selection for the Group rules by list is currently set to . You can choose or to change the grouping view to meet specific needs.
The default view groups rules by title. Rules can have several types of results but the most common ones are pass and fail, which indicate whether or not the particular security control has passed or failed the scan.
Click a rule title such as Ensure Red Hat GPG Key Installed to display a dialog box that allows you to examine why a particular OpenSCAP security rule failed or passed.
References
oscap(8) man page
For more information, refer to the Using oscap chapter in the Security Guide at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/security_guide/#sect-Using_oscap
Information is available from the community OpenSCAP project on the policies that are available in the SCAP Security Guide and on how to select them, at https://www.open-scap.org/security-policies/choosing-policy/
