Red Hat Security: Linux in Physical, Virtual, and Cloud

Objectives

After completing this section, students should be able to perform OpenSCAP scans of registered systems from the Satellite Server web UI and evaluate the results of those scans.

Performing OpenSCAP Scans using Red Hat Satellite

You can configure Red Hat Satellite as an easy way to centrally manage, run, and analyze OpenSCAP scans for all hosts in a Satellite host group. Your basic workflow might look like this:

In the rest of this section, you will learn how to set up a compliance policy and review the results of OpenSCAP scans made by that compliance policy in the Red Hat Satellite web UI.

Satellite User Permissions for OpenSCAP

Compliance scans from the Satellite Server's web UI require the administrator to create users with specific roles. Roles define a set of permissions and access levels. Each role contains one or more permission filters that specify the actions allowed for the role. Red Hat Satellite provides a set of predefined roles for managing compliance.

The following table shows some of the predefined roles required for OpenSCAP scans:

Managing Compliance Policies

In Red Hat Satellite, a compliance policy is a scheduled task to scan a host or host group for compliance with a particular XCCDF profile from SCAP content. The compliance policy is configured on the Satellite Server by users with appropriate role, but the scan is actually performed locally by each host. After a host runs the compliance scan, it uploads the scan results to the Satellite Server in Asset Reporting File (ARF) format, using the foreman_scap_client command.

A user with the Create ARF report role can create the scan report and upload it to the Satellite Server. A user with the Compliance manager or Compliance viewer role can view reports from the compliance report dashboard. Only the user with the Compliance manager role can manage compliance policies and SCAP content.

Creating Compliance Policies

You can use the Satellite Server web UI to define a compliance policy. A compliance policy includes:

Running Compliance Scans

When Puppet agent updates the compliance policy, it ensures that the OpenSCAP client has been installed, SCAP content is downloaded, and a Cron job is scheduled to periodically run the scan.

The SCAP content is downloaded to the /var/lib/openscap/content directory on each host. The Puppet agent creates a Cron file, /etc/cron.d/foreman_scap_client_cron, which configures the scan to run according to the specified schedule. It also creates the /etc/foreman_scap_client/config.yaml configuration file, which contains policy information to be applied to the host. The foreman_scap_client command uses this configuration file.

The /etc/foreman_scap_client/config.yaml configuration file defines the Satellite Server to be used for uploading the compliance report. The file also defines the compliance policy ID on the Satellite and the XCCDF profile that is used for compliance scans.

# DO NOT EDIT THIS FILE MANUALLY
# IT IS MANAGED BY PUPPET

# Foreman proxy to which reports should be uploaded
:server: 'satellite.lab.example.com'
:port: 9090
...output omitted...
# policy (key is id as in Foreman)
1:
:profile: 'xccdf_org.ssgproject.content_profile_common'
:content_path: '/var/lib/openscap/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d.xml'
# Download path
# A path to download SCAP content from proxy
:download_path: '/compliance/policies/1/
content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d'
:tailoring_path: ''
:tailoring_download_path: ''

In the above /etc/foreman_scap_client/config.yaml file, the scan results will be uploaded to satellite.lab.example.com. The compliance policy ID is 1 and the xccdf_org.ssgproject.content_profile_common XCCDF profile is applied to the host based on the OpenSCAP content stored in the /var/lib/openscap/content directory.

Running an OpenSCAP Scan Manually

You do not have to run the compliance policy's OpenSCAP scan manually. The compliance policy runs automatically based on its Cron job. However, you might want to run it manually for a host if you want an immediate compliance report for that host.

Use the compliance policy ID defined in the /etc/foreman_scap_client/config.yaml file to execute the OpenSCAP scan manually on a host. Use the foreman_scap_client command from a root shell on the host or the remote execution feature of the Satellite Server to execute the OpenSCAP scan.

Reviewing OpenSCAP Scan Results in Satellite Server

Red Hat Satellite enables centralized compliance monitoring for all the hosts using the compliance policy dashboard. The compliance policy dashboard provides an overview of the number of compliant hosts and details for each host based on the rules passed or failed during the scan. You can use this to evaluate the risks presented by the host and can take corrective action to bring the host into compliance.

Red Hat Satellite assumes that different users may have different roles in the compliance scanning process. If a particular Satellite user should be able to view compliance reports, you need to assign them the Compliance viewer role. If they need to work with SCAP content and tailoring files, configure compliance policies, and view the compliance reports, you need to assign them the Compliance manager role.

Viewing the Compliance Policy Dashboard

To view the compliance policy dashboard in the Satellite web UI, navigate to Hosts → Policies. Click the compliance policy for which you want to view the dashboard.

The dashboard provides the following information:

Figure 10.3: An example compliance policy dashboard in Red Hat Satellite

Evaluating OpenSCAP Reports

You can access the OpenSCAP reports for every host that is scanned by the compliance policy from the compliance report dashboard. You can use this to determine and prioritize remediation efforts for any hosts that the scans report are noncompliant.

Viewing Compliance Reports

A compliance report is an OpenSCAP report in ARF format, uploaded to the Satellite Server after an OpenSCAP scan on the host. To list all the available reports from the Satellite web UI, navigate to Hosts → Reports. The compliance report dashboard lists the total number of rules passed or failed during the scan. The detailed report for a particular host can also be viewed from the compliance report dashboard.

Figure 10.4: An example compliance report in Red Hat Satellite

The compliance report for each system is essentially the same information that you could get by running oscap xccdf eval manually on each machine. The big advantage of using a Red Hat Satellite compliance policy to manage these scans is the scalability and central coordination it provides. You can set up and manage scans for many systems from one central interface. You can go to one central interface to review the results of any system's scan. You can delegate authority to auditors to view the results of the latest scans. Finally, you can compare scans more easily to look for patterns of misconfiguration or common issues.