Red Hat Security: Linux in Physical, Virtual, and Cloud

Objectives

After completing this section, students should be able to run Ansible Playbooks, provided with the SCAP Security Guide's content, to remediate compliance checks that failed an OpenSCAP scan.

Generating a Remediation Ansible Playbook

The XCCDF files in the SCAP Security Guide include remediation scripts to fix the noncompliant checks. These scripts might take the form of shell scripts, Ansible snippets, Puppet snippets, or even Kickstart commands. Some rules provide multiple remediation scripts in different formats. For example, the rule that verifies if AIDE is installed provides a remediation shell script, but also an Ansible snippet, a Puppet snippet, and a Kickstart command. Some rules only provide one remediation method, and others do not provide remediation scripts at all.

With the oscap command, you can generate an Ansible Playbook from a SCAP Security Guide profile, or from a scan result XML file.

Creating an Ansible Playbook for a Profile

From a SCAP Security Guide profile, the oscap xccdf generate fix command can generate an Ansible Playbook that includes all the tasks for remediation that have Ansible snippets.

[user@demo ~]$ oscap xccdf generate fix \
> --profile xccdf_org.ssgproject.content_profile_pci-dss \
> --fix-type ansible \
> /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml > pci-dss.yml
 

You can include this Ansible Playbook in a more global Ansible infrastructure; for example, as a postinstallation step. Because Ansible Playbooks are idempotent, you can regularly run the playbook on your systems to keep them compliant; there is no impact on the already compliant items.

Remember that some SCAP rules do not have Ansible remediation snippets. For those rules, you may have to develop your own playbook tasks for remediation.

You should also remember that many profiles are meant as catalogs, not checklists, and not every remediation item may make sense in your environment. If you are going to generate a playbook from a profile, consider using one that has been tailored for your environment.

Creating an Ansible Playbook from a Result XML File

After scanning a system for compliance, the oscap xccdf generate fix command can create an Ansible Playbook from the XML result file to fix the noncompliant checks.

In the following example, the first oscap command scans the local system, and then the second generates the Ansible Playbook for remediation.

[root@demo ~]# oscap xccdf eval \
> --profile xccdf_org.ssgproject.content_profile_pci-dss \
> --results /root/results.xml \
> /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
...output omitted...

[root@demo ~]# oscap xccdf generate fix \
> --profile xccdf_org.ssgproject.content_profile_pci-dss \
> --fix-type ansible \
> --result-id "" \
> /root/results.xml > remediation-playbook.yml
 

The generated Ansible Playbook is only relevant for the scanned system because it only includes the tasks to remediate the failed checks.

Adjusting Variables in the Remediation Ansible Playbook

You can edit the Ansible Playbook that the oscap xccdf generate fix command creates. In particular, the playbook exposes as variables some of the parameters associated with rules in the SCAP Security Guide profiles.

The following example shows an example of variables defined in a remediation Ansible Playbook.

...output omitted...
- hosts: all
  vars:
     var_accounts_maximum_age_login_defs: 90
     var_account_disable_post_pw_expiration: 90
     var_password_pam_dcredit: -1
     var_password_pam_minlen: 7
     var_password_pam_ucredit: -1
     var_password_pam_lcredit: -1
     var_auditd_space_left_action: email
     var_auditd_admin_space_left_action: single
     sshd_idle_timeout_value: 900
...output omitted...

Running a Remediation Ansible Playbook

The oscap xccdf generate fix command creates Ansible Playbooks with the hosts parameter set to all. You can adapt this parameter to specify the targeted group of systems to remediate, or you can create a custom inventory file that lists all these systems.

To specify a custom inventory file, use the -i inventory_file option with the ansible-playbook command.

[user@demo ~]$ ansible-playbook -i ./myinventory pci-dss.yml

Filtering Tasks

The remediation Ansible Playbooks can be quite large. Some of the tasks inside these playbooks can be disruptive, such as updating the whole system. Other tasks may remediate low severity issues, and you may want to skip them.

The tasks in a remediation Ansible Playbook have tags. Tags are an Ansible feature that allow you to run only tasks that have that tag.

The SCAP Security Guide XCCDF files specify particular tags for its Ansible snippets. Rather than running the whole playbook, you can specify one or more tags to filter the tasks to play.

The following playbook extract shows two tasks and their associated tags.

- name: "Security patches are up to date"
  package:
    name: "*"
    state: "latest"
  tags:
    - security_patches_up_to_date
    - high_severity
    - patch_strategy
    - low_complexity
    - high_disruption
    - CCE-26895-3
    - NIST-800-53-SI-2
    - NIST-800-53-SI-2(c)
    - NIST-800-53-MA-1(b)
    - PCI-DSS-Req-6.2
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-07-020260


- name: disable prelinking
  lineinfile:
    path: /etc/sysconfig/prelink
    regexp: '^PRELINKING='
    line: 'PRELINKING=no'
  tags:
    - disable_prelink
    - low_severity
    - restrict_strategy
    - low_complexity
    - low_disruption
    - CCE-27078-5
    - NIST-800-53-CM-6(d)
    - NIST-800-53-CM-6(3)
    - NIST-800-53-SC-28
    - NIST-800-53-SI-7
    - NIST-800-171-3.13.11
    - PCI-DSS-Req-11.5
    - CJIS-5.10.1.3

The following command shows how to only run the tasks tagged high_severity from an Ansible Playbook.

[user@demo ~]$ ansible-playbook --tags=high_severity pci-dss.yml

You can also specify multiple tags using a comma-separated list. See the Ansible documentation for more information.

Applying Profiles During Installation

You can call the OpenSCAP installer add-on from a Kickstart file to evaluate system compliance and automatically remediate deviations during installation. Because the add-on also performs the remediation, your new systems are compliant after installation.

For example, by adding the following lines in your Kickstart file, your new systems will be compliant with the SCAP Security Guide PCI-DSS profile after installation.

%addon org_fedora_oscap
content-type = scap-security-guide
profile = pci-dss
%end