Objectives

After completing this section, students should be able to configure an existing Red Hat Satellite to perform OpenSCAP scans of registered servers.

Security Compliance Management with Red Hat Satellite

A security administrator manages security compliance by defining security policies and auditing hosts for compliance based on the policies defined. Any noncompliant hosts are remediated based on the organization's compliance requirements. These compliance policies need to be flexible, because an organization's policy might vary depending on the services provided by the host or the industry to which the organization belongs.

Red Hat Satellite is a systems management tool that can be used to configure new systems and provide software updates from Red Hat Network. It serves as a local repository of software content and a central point of management for Red Hat entitlements. Red Hat Satellite also performs provisioning and configuration management of systems to adhere to predefined standard operating environments.

One of the major benefits of Red Hat Satellite is that it can scale effectively to meet the demands of large enterprises. With the correct design, Red Hat Satellite delivers solid performance in the face of increasing workloads, even across a geographically distributed environment.

Several options are available for administering and using a Satellite Server. A web browser can be used to manage the Satellite Server through its web interface. A command-line interface is also available. Administrators with programming experience can use an API to create custom workflows or task automation.

Red Hat Satellite 6 can use the Security Content Automation Protocol (SCAP) to define security policies and monitor Satellite clients for policy compliance. You can use the Satellite Server to schedule recurring compliance auditing and reporting on all registered hosts. This allows security administrators to use a single interface to manage, monitor, and remediate groups of hosts based on the organization's compliance requirements.

Integrating OpenSCAP with Red Hat Satellite

Red Hat Satellite provides default SCAP content based on the version of Red Hat Enterprise Linux using the scap-security-guide package. With the scap-secuirity-guide package for Red Hat Enterprise Linux 7, the SCAP content for both Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7 is installed on the Satellite Server. The Satellite Server administrator can either create SCAP content or upload SCAP content from external sources. The SCAP content contains the Extensible Checklist Configuration Description Format (XCCDF) profile that defines the rules to be evaluated against a host or host group.

In Red Hat Satellite, a scheduled audit is referred to as a compliance policy. This is a scheduled task that checks the specified hosts or host groups for compliance against an XCCDF profile. The schedule is specified on the Satellite Server in the compliance policy, but the scans are performed on the hosts. On completion of a compliance scan, an Asset Reporting File (ARF) is generated in XML format and uploaded to the Satellite Server. The security administrator can then view these reports from the compliance policy dashboard.

Installing the OpenSCAP Plug-in for Red Hat Satellite

You must install the OpenSCAP plug-in on your Red Hat Satellite Server in order to integrate OpenSCAP support. The OpenSCAP plug-in provides OpenSCAP controls from the Satellite web interface. These controls are located under the Hosts menu in the Compliance section.

The default installation of Red Hat Satellite enables the OpenSCAP plug-in.

Uploading OpenSCAP Content to the Satellite Server

After configuring the plug-in, but before you create a compliance policy and apply it to a host, you must upload the default OpenSCAP content to your Satellite Server. You can also upload custom SCAP content provided by other sources. The uploaded SCAP content is independent of the operating systems used by your registered hosts.

Ensure that the scap-security-guide package is installed. You must run the following command on your Satellite Server to upload the default OpenSCAP content to it.

[root@satellite ~]# foreman-rake foreman_openscap:bulk_upload:default
Saved /usr/share/xml/scap/ssg/content/ssg-firefox-ds.xml as Red Hat firefox default content
Saved /usr/share/xml/scap/ssg/content/ssg-jre-ds.xml as Red Hat jre default content
Saved /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml as Red Hat rhel6 default content
Saved /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml as Red Hat rhel7 default content

To view the SCAP content uploaded to the Satellite Server using the web UI:

Figure 10.1: Default SCAP contents in Satellite Server

Use the hammer scap-content list command to list the SCAP contents.

[root@satellite ~]# hammer scap-content list
---|--------------------------------
ID | TITLE
---|--------------------------------
1  | Red Hat firefox default content
2  | Red Hat jre default content
3  | Red Hat rhel6 default content
4  | Red Hat rhel7 default content
---|--------------------------------

You can use the Satellite Server web UI to upload an individual SCAP DataStream file as SCAP content. To upload your own SCAP content to the Satellite Server web UI:

Preparing Satellite Clients for OpenSCAP Scans

Red Hat Satellite currently uses Puppet to manage compliance policies on its clients. When you create a new Satellite compliance policy, the clients' Puppet agents update the clients on their next run. They ensure that the OpenSCAP software and content is installed locally, and schedule the scan on the client as a Cron job. When you edit a Satellite compliance policy, the clients update it on the next run of their Puppet agent.

This means that you also need to import the foreman_scap_client Puppet module into your Satellite Server, so that you can make sure that the Satellite Server's registered clients are configured with Puppet agents and have the module installed.

Importing an OpenSCAP Puppet Module into Satellite Server

The OpenSCAP plug-in also provides the Puppet classes required to set up hosts to perform OpenSCAP scans and creates the Cron jobs for automated compliance scanning. Each Puppet environment associated with hosts or host groups to be audited using OpenSCAP needs to import the foreman_scap_client Puppet module. The foreman_scap_client Puppet module provides the client script that runs the OpenSCAP scan and uploads the result to the Satellite Server. The module is also executed by the cron jobs for automated compliance scanning.

Initiating a Puppet Agent Run on a Host

When the client's Puppet agent checks in, it imports the foreman_scap_client Puppet module and uses it to configure the OpenSCAP components locally. The foreman_scap_client Puppet module installs the rubygem-foreman_scap_client package and its dependencies. It also configures the /etc/foreman_scap_client/config.yaml file on the host with parameters that are needed to run scans and upload results to the Satellite Server.

A Puppet agent run can be initiated manually using any of the following methods:

The bootstrap.py script provided by the Satellite Server is used to register a system as both a host and a content host. The following is the list of options used with the bootstrap.py script:

During the execution of the bootstrap.py script, the Puppet agent is also executed on the host to install all the imported Puppet modules. Use the following command to register a system using the bootstrap.py script.

[root@demo ~]# wget https://satellite.lab.example.com/pub/bootstrap.py \
> --no-check-certificate
[root@demo ~]# chmod a+x bootstrap.py
[root@demo ~]# ./bootstrap.py -l admin -s satellite.lab.example.com \
> -o 'org-example' -L 'Default Location' -a serverkey -g org-hostgroup1 --force

Use the puppet agent --test --verbose command to run the Puppet agent on an individual host.

[root@demo ~]# puppet agent --test --verbose
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for serverd.lab.example.com
Info: Applying configuration version '1532692309'
Notice: /Stage[main]/Foreman_scap_client/File[foreman_scap_client]/content:
--- /etc/foreman_scap_client/config.yaml 2018-07-27 17:18:11.279676375 +0530
+++ /tmp/puppet-file20180727-2630-gep1op 2018-07-27 17:21:50.652457820 +0530
...output omitted...

Figure 10.2: Puppet agent run using remote execution

When the Puppet agent is configured on the client, it automatically runs periodically to check with the Satellite Server for updates. By default, this occurs every thirty minutes.