Red Hat Security: Linux in Physical, Virtual, and Cloud

On serverc, retrieve the identifier of the OSPP profile and scan the system for compliance with that profile.

1. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

2. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

3. Use the oscap info command to retrieve the identifier of the OSPP profile.

   [root@serverc ~]# oscap info /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
   Document type: Source Data Stream
   Imported: 2018-01-08T08:03:07
   
   Stream: scap_org.open-scap_datastream_from_xccdf_ssg-rhel7-xccdf-1.2.xml
   Generated: (null)
   Version: 1.2
   Checklists:
   	Ref-Id: scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml
   		Status: draft
   		Generated: 2018-01-08
   		Resolved: true
   		Profiles:
   			Title: Standard System Security Profile
   				Id: xccdf_org.ssgproject.content_profile_standard
   			Title: PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7
   				Id: xccdf_org.ssgproject.content_profile_pci-dss
   			Title: C2S for Red Hat Enterprise Linux 7
   				Id: xccdf_org.ssgproject.content_profile_C2S
   			Title: Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)
   				Id: xccdf_org.ssgproject.content_profile_rht-ccp
   			Title: Common Profile for General-Purpose Systems
   				Id: xccdf_org.ssgproject.content_profile_common
   			Title: DISA STIG for Red Hat Enterprise Linux 7
   				Id: xccdf_org.ssgproject.content_profile_stig-rhel7-disa
   			Title: STIG for Red Hat Virtualization Hypervisor
   				Id: xccdf_org.ssgproject.content_profile_stig-rhevh-upstream
   			Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT
   				Id: xccdf_org.ssgproject.content_profile_ospp-rhel7
   			Title: Criminal Justice Information Services (CJIS) Security Policy
   				Id: xccdf_org.ssgproject.content_profile_cjis-rhel7-server
   			Title: Standard Docker Host Security Profile
   				Id: xccdf_org.ssgproject.content_profile_docker-host
   			Title: Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
   				Id: xccdf_org.ssgproject.content_profile_nist-800-171-cui
   ...output omitted...

4. Scan the system for compliance with the OSPP profile. Save the result in the /root/results.xml file.

   [root@serverc ~]# oscap xccdf eval \
   > --profile xccdf_org.ssgproject.content_profile_ospp-rhel7 \
   > --results /root/results.xml \
   > /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
   WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
   WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
   Title   Encrypt Partitions
   Rule    xccdf_org.ssgproject.content_rule_encrypt_partitions
   Ident   CCE-27128-8
   Result  notchecked
   
   Title   Ensure Red Hat GPG Key Installed
   Rule    xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed
   Ident   CCE-26957-1
   Result  pass
   ...output omitted...

When the scan is complete, generate an HTML report for your scan of serverc and copy it to workstation.

1. Convert the /root/results.xml file to HTML. Save the HTML report as /root/results.html.

   [root@serverc ~]# oscap xccdf generate report results.xml > results.html
   [root@serverc ~]# 

2. Use scp to copy the results.html file to workstation so you can use Firefox to display it. Use student as the password.

   [root@serverc ~]# scp results.html student@workstation:
   The authenticity of host 'workstation (172.25.250.254)' can't be established.
   ECDSA key fingerprint is SHA256:GCpIQxItJSWgZDzlmpnZINbwsjf9axrs+o6170OyOuk.
   ECDSA key fingerprint is MD5:2b:98:e1:85:8b:c7:ea:31:72:08:4d:39:15:ec:5d:da.
   Are you sure you want to continue connecting (yes/no)? yes
   Warning: Permanently added 'workstation,172.25.250.254' (ECDSA) to the list of known hosts.
   student@workstation's password: student
   results.html                                   100% 2999KB  30.8MB/s   00:00

3. Log off from serverc.

   [root@serverc ~]# logout
   [student@serverc ~]$ logout
   [student@workstation ~]$ 

On workstation use Firefox to review the scan report.

1. Use Firefox to display the results.html file.

   [student@workstation ~]$ firefox results.html

2. Browse through the page and notice the following:

   • The number of passed and failed rules.

   • The severity of the failed rules.

   • The status of the rule that checks if gpgcheck is enabled for all Yum package repositories. This is a high severity rule that passed.

   • The status of the rule that ensures Yum removes previous package versions, in the Updating Software section. That check failed. Notice that this is a low severity rule.

   Close Firefox when you are done exploring the scan results but keep the results.html file so you can refer to it later.