Red Hat Security: Linux in Physical, Virtual, and Cloud

On workstation, use the SCAP Workbench graphical utility to customize the United States Government Configuration Baseline (USGCB / STIG) profile.

1. Start SCAP Workbench by running the scap-workbench command.

   [student@workstation ~]$ scap-workbench

   SCAP Workbench detects that the SCAP Security Guide is already installed on the system and asks you to select the content to use.

   In the Select content to load field, select RHEL7 and click Load Content.

2. Locate the Profile field and select United States Government Configuration Baseline (USGCB / STIG) - DRAFT.

   Click Customize at the right of that field.

3. In the New Profile ID field, enter xccdf_com.example_profile_RH415-rhel7 and click OK.

   The new window displays all the available rules. The rules included in the United States Government Configuration Baseline profile are selected.

4. Click Deselect All and select the three following rules in the Updating Software section:

   • Ensure gpgcheck Enabled In Main Yum Configuration

   • Ensure gpgcheck Enabled For All Yum Package repositories

   • Ensure YUM Removes Previous Package Versions

   In the Set Password Quality Requirements with pam_pwquality section, select the following:

   • Select Set Password Minimum Length to enable the test.

   • Click minlen. In the right pane, under Modify Value, select 6. This sets the pam_pwquality minlen option to 6.

   Click OK.

5. Save the customization in a tailoring file. Select File → Save Customization Only and enter RH415-tailoring.xml for the file name.

   Close SCAP Workbench.

Scan serverc for compliance with your customization of the OSPP profile.

1. As student, use scp to copy the RH415-tailoring.xml tailoring file to serverc. No password is required.

   [student@workstation ~]$ scp RH415-tailoring.xml student@serverc:
   RH415-tailoring.xml                            100%   67KB  11.9MB/s   00:00

2. Log in to serverc as student. No password is required.

   [student@workstation ~]$ ssh student@serverc
   [student@serverc ~]$ 

3. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@serverc ~]$ sudo -i
   [sudo] password for student: student
   [root@serverc ~]# 

4. Use the oscap info command on the /home/student/RH415-tailoring.xml tailoring file to retrieve the associated profile.

   [root@serverc ~]# oscap info /home/student/RH415-tailoring.xml
   Document type: XCCDF Tailoring
   Imported: 2018-07-27T07:02:06
   Benchmark Hint: /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
   Profiles:
   	Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT [CUSTOMIZED]
   		Id: xccdf_com.example_profile_RH415-rhel7

5. Scan the system for compliance with your customization. Save the result in the /root/RH415-results.xml file.

   [root@serverc ~]# oscap xccdf eval \
   > --profile xccdf_com.example_profile_RH415-rhel7 \
   > --tailoring-file /home/student/RH415-tailoring.xml \
   > --results /root/RH415-results.xml \
   > /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
   WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
   WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
   Title   Ensure gpgcheck Enabled In Main Yum Configuration
   Rule    xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
   Ident   CCE-26989-4
   Result  pass
   
   Title   Ensure gpgcheck Enabled For All Yum Package Repositories
   Rule    xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
   Ident   CCE-26876-3
   Result  pass
   
   Title   Ensure YUM Removes Previous Package Versions
   Rule    xccdf_org.ssgproject.content_rule_clean_components_post_updating
   Ident   CCE-80346-0
   Result  fail
   
   Title   Set Password Minimum Length
   Rule    xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
   Ident   CCE-27293-0
   Result  fail

6. When the scan is complete, convert the /root/RH415-results.xml file in HTML. Save the HTML report in /root/RH415-results.html.

   [root@serverc ~]# oscap xccdf generate report \
   > RH415-results.xml > RH415-results.html
   [root@serverc ~]# 

7. Use scp to copy the RH415-results.html file to workstation so you can use Firefox to display it. Use student as the password.

   [root@serverc ~]# scp RH415-results.html student@workstation:
   student@workstation's password: student
   RH415-results.html                             100%  266KB  24.2MB/s   00:00

8. Log off from serverc.

   [root@serverc ~]# logout
   [student@serverc ~]$ logout
   [student@workstation ~]$ 

9. Use Firefox to display the RH415-results.html file.

   [student@workstation ~]$ firefox RH415-results.html

10. Notice that the page only displays the rules from your tailoring file. Close Firefox when you are done exploring the scan results.

    Figure 9.11: Tailored rules scan results