Red Hat Security: Linux in Physical, Virtual, and Cloud

Bookmark this page
P123456789101112
PreviousNext

Lab: Managing Compliance with OpenSCAP

Performance Checklist

In this lab, you will confirm that OpenSCAP tools and SCAP Security Guide content is installed on one of your servers, use SCAP Workbench to create a tailoring file, use OpenSCAP to scan the server with that tailored policy, and use Ansible to remediate a compliance check that failed.

Outcomes

You should be able to:

  • Install OpenSCAP tools and the SCAP Security Guide.

  • Create a tailoring file using SCAP Workbench.

  • Scan the system using the customized policy.

  • Generate and use an Ansible Playbook to remediate failed compliance checks.

Confirm that the workstation and serverd machines are started.

Log in to workstation as student using student as the password. On workstation, run lab oscap-review setup to verify that the environment is ready. 

[student@workstation ~]$ lab oscap-review setup

  1. On workstation, customize the SCAP Security Guide Common Profile for General-Purpose Systems. Set the new profile identifier to xccdf_com.example_profile_lab-rhel7, disable all the rules, and then enable the following rules:

    • Disable Prelinking

    • Install AIDE

    • Build and Test AIDE Database

    Store the resulting tailoring file on workstation in /home/student/lab-tailoring.xml.

    1. On workstation, start SCAP Workbench by running the scap-workbench command. 

      [student@workstation ~]$ scap-workbench

      SCAP Workbench detects that the SCAP Security Guide is already installed on the system and asks you to select the content to use.

      In the Select content to load field, select RHEL7 and click Load Content.

    2. Locate the Profile field and select Common Profile for General-Purpose Systems.

      Click Customize at the right of that field.

    3. In the New Profile ID field, enter xccdf_com.example_profile_lab-rhel7 and click OK.

      The new window displays all the available rules.

    4. Click Deselect All and select the following rules in the System and Software Integrity section:

      • Disable Prelinking

      • Install AIDE

      • Build and Test AIDE Database

      Click OK.

    5. Save the customization in a tailoring file. Select File → Save Customization Only and enter lab-tailoring.xml for the file name in the /home/student directory.

      Close SCAP Workbench.

  2. Scan serverd for compliance with your customization of the Common Profile for General-Purpose Systems. Save the result on workstation in /home/student/lab-results.xml. Generate the HTML report of the scan and store it in /home/student/lab-results.html on workstation.

    1. Copy the lab-tailoring.xml tailoring file to serverd. You need this file to scan the system. 

      [student@workstation ~]$ scp lab-tailoring.xml student@serverd:
lab-tailoring.xml                             100% 7317   606.7KB/s   00:00

    2. Log in to serverd as student. No password is required. 

      [student@workstation ~]$ ssh student@serverd
[student@serverd ~]$

    3. Use the sudo -i command to switch identity to the root user. Use student as the password. 

      [student@serverd ~]$ sudo -i
[sudo] password for student: student
[root@serverd ~]#

    4. Install the openscap-scanner and the scap-security-guide packages. 

      [root@serverd ~]# yum install openscap-scanner scap-security-guide
...output omitted...
Is this ok [y/d/N]: y
...output omitted...
Complete!

    5. Scan the system for compliance with your customization. Save the result in the /root/lab-results.xml file. 

      [root@serverd ~]# oscap xccdf eval \
> --profile xccdf_com.example_profile_lab-rhel7 \
> --tailoring-file /home/student/lab-tailoring.xml \
> --results /root/lab-results.xml \
> /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
Title   Disable Prelinking
Rule    xccdf_org.ssgproject.content_rule_disable_prelink
Ident   CCE-27078-5
Result  pass

Title   Install AIDE
Rule    xccdf_org.ssgproject.content_rule_package_aide_installed
Ident   CCE-27096-7
Result  fail

Title   Build and Test AIDE Database
Rule    xccdf_org.ssgproject.content_rule_aide_build_database
Ident   CCE-27220-3
Result  fail

    6. When the scan is complete, convert the /root/lab-results.xml file in HTML. Save the HTML report as /root/lab-results.html. 

      [root@serverd ~]# oscap xccdf generate report \
> lab-results.xml > lab-results.html
[root@serverd ~]#

    7. Use scp to copy the two files to workstation. Use student as the password. 

      [root@serverd ~]# scp lab-results.* student@workstation:
The authenticity of host 'workstation (172.25.250.254)' can't be established.
ECDSA key fingerprint is SHA256:GCpIQxItJSWgZDzlmpnZINbwsjf9axrs+o6170OyOuk.
ECDSA key fingerprint is MD5:2b:98:e1:85:8b:c7:ea:31:72:08:4d:39:15:ec:5d:da.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'workstation,172.25.250.254' (ECDSA) to the list of known hosts.
student@workstation's password: student
lab-results.html                               100%  266KB   6.9MB/s   00:00
lab-results.xml                                100% 4304KB  10.5MB/s   00:00

    8. Log off from serverd. 

      [root@serverd ~]# logout
[student@serverd ~]$ logout
[student@workstation ~]$

  3. On workstation, generate the Ansible Playbook to resolve the compliance issues detected in the previous step. Save the Ansible Playbook as /home/student/RH415/labs/oscap-review/fix.yml and run it to resolve the compliance issues on serverd.

    The ansible.cfg and the inventory files have already been deployed for you in /home/student/RH415/labs/oscap-review/.

    1. Use the oscap xccdf generate fix command to generate the Ansible Playbook. Save the playbook as /home/student/RH415/labs/oscap-review/fix.yml. 

      [student@workstation ~]$ oscap xccdf generate fix \
> --profile xccdf_com.example_profile_lab-rhel7 \
> --tailoring-file lab-tailoring.xml \
> --fix-type ansible \
> --result-id "" \
> lab-results.xml > /home/student/RH415/labs/oscap-review/fix.yml
[student@workstation ~]$

    2. From the /home/student/RH415/labs/oscap-review/ directory, use the ansible-playbook command to run the playbook. The AIDE database build takes several minutes to complete. 

      [student@workstation ~]$ cd /home/student/RH415/labs/oscap-review/
[student@workstation oscap-review]$ ansible-playbook fix.yml
...output omitted...
PLAY RECAP *******************************************************
serverd.lab.example.com : ok=5  changed=3  unreachable=0  failed=0

  4. Scan serverd again for compliance with your customization of the Common Profile for General-Purpose Systems. Save the result on workstation in /home/student/lab-results-fix.xml.

    1. Log in to serverd as student. No password is required. 

      [student@workstation oscap-review]$ ssh student@serverd
[student@serverd ~]$

    2. Use the sudo -i command to switch identity to the root user. Use student as the password. 

      [student@serverd ~]$ sudo -i
[sudo] password for student: student
[root@serverd ~]#

    3. Scan the system for compliance with your customization. Save the result in the /root/lab-results-fix.xml file. 

      [root@serverd ~]# oscap xccdf eval \
> --profile xccdf_com.example_profile_lab-rhel7 \
> --tailoring-file /home/student/lab-tailoring.xml \
> --results /root/lab-results-fix.xml \
> /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
Title   Disable Prelinking
Rule    xccdf_org.ssgproject.content_rule_disable_prelink
Ident   CCE-27078-5
Result  pass

Title   Install AIDE
Rule    xccdf_org.ssgproject.content_rule_package_aide_installed
Ident   CCE-27096-7
Result  pass

Title   Build and Test AIDE Database
Rule    xccdf_org.ssgproject.content_rule_aide_build_database
Ident   CCE-27220-3
Result  pass

    4. Use scp to copy the /root/lab-results-fix.xml file to workstation. Use student as the password. 

      [root@serverd ~]# scp lab-results-fix.xml student@workstation:
student@workstation's password: student
lab-results-fix.xml                            100% 4304KB  11.0MB/s   00:00

    5. Log off from serverd. 

      [root@serverd ~]# logout
[student@serverd ~]$ logout
[student@workstation oscap-review]$

Evaluation

As the student user on workstation, run the lab oscap-review script with the grade argument to confirm success of this exercise. Correct any reported failures and rerun the script until successful. 

[student@workstation ~]$ lab oscap-review grade

Cleanup

On workstation, run the lab oscap-review cleanup command to clean up this exercise. 

[student@workstation ~]$ lab oscap-review cleanup

This concludes the lab.

PreviousNext
Revision: rh415-7.5-b847083