Red Hat Security: Linux in Physical, Virtual, and Cloud

On workstation, open a browser and connect to the Satellite Server web UI at https://satellite.lab.example.com. If required, accept the self-signed certificate and log in as admin using redhat as the password.

Create a compliance policy named OpenSCAP-Policy1 using the default RHEL7 SCAP content. The policy should execute every 10 minutes.

1. Navigate to Hosts → Policies and click New Policy.

2. In the New Compliance Policy dialog box, enter OpenSCAP-Policy1 as the name of the policy. The policy description is optional. Click Next.

3. On the SCAP Content tab, select Red Hat rhel7 default content from the SCAP Content drop-down list. For XCCDF Profile, select Common Profile for General-Purpose Systems. Click Next.

4. On the Schedule tab, for Period, select Custom. Enter */10 * * * * in the Cron line field to run the scan every 10 minutes. Click Next.

5. On the Locations tab, select Default Location to move it to the Selected items list. Click Next.

6. On the Organizations tab, ensure that org-example is the selected organization. Click Next.

7. On the Hostgroups tab, select org-hostgroup1 to move it to the Selected items list. Click Submit to create the compliance policy.

Rerun the Puppet module on serverd to fetch the new compliance policy. Review the configuration of the compliance policy in the /etc/foreman_scap_client/config.yaml file.

1. Log in to serverd as student. No password is required. Use the sudo -i command to change to the root user. Use student as the password.

   [student@workstation ~]$ ssh student@serverd
   [student@serverd ~]$ sudo -i
   [sudo] password for student: student
   [root@serverd ~]# 

2. Run the following command on serverd to fetch the new compliance policy. The command executes the Puppet module on serverd, and configures the host to run foreman_scap_client using the new compliance policy.

   [root@serverd ~]# puppet agent --test --verbose
   Info: Using configured environment 'production'
   Info: Retrieving pluginfacts
   Info: Retrieving plugin
   Info: Loading facts
   Info: Caching catalog for serverd.lab.example.com
   Info: Applying configuration version '1532692309'
   Notice: /Stage[main]/Foreman_scap_client/File[foreman_scap_client]/content:
   --- /etc/foreman_scap_client/config.yaml  2018-07-27 17:18:11.279676375 +0530
   +++ /tmp/puppet-file20180727-2630-gep1op  2018-07-27 17:21:50.652457820 +0530
   @@ -21,3 +21,12 @@
   
    # policy (key is id as in Foreman)
   
    +1:
    +  :profile: 'xccdf_org.ssgproject.content_profile_common'
    +  :content_path: '/var/lib/openscap/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d.xml'
    +  # Download path
    +  # A path to download SCAP content from proxy
    +  :download_path: '/compliance/policies/1/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d'
    +  :tailoring_path: ''
    +  :tailoring_download_path: ''
    +
   
    Info: Computing checksum on file /etc/foreman_scap_client/config.yaml
    ...output omitted...
   
     # foreman_scap_client cron job
   
     +# Runs foreman_scap_client 1
     +*/10 * * * * root /usr/bin/foreman_scap_client 1 > /dev/null
     +
   
     Info: Computing checksum on file /etc/cron.d/foreman_scap_client_cron
    ...output omitted...
     Notice: Applied catalog in 0.30 seconds

3. View the /etc/foreman_scap_client/config.yaml file to confirm that the Satellite Server compliance policy ID and OpenSCAP XCCDF profile defined in the file.

   [root@serverd ~]# cat /etc/foreman_scap_client/config.yaml
   # DO NOT EDIT THIS FILE MANUALLY
   # IT IS MANAGED BY PUPPET
   
   ...output omitted...
   # policy (key is id as in Foreman)
   
   1:
     :profile: 'xccdf_org.ssgproject.content_profile_common'
     :content_path: '/var/lib/openscap/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d.xml'
     # Download path
     # A path to download SCAP content from proxy
     :download_path: '/compliance/policies/1/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d'
     :tailoring_path: ''
     :tailoring_download_path: ''

   In the preceding output the compliance policy ID is 1. The policy will use the xccdf_org.ssgproject.content_profile_common OpenSCAP profile.

Execute an OpenSCAP scan manually using the foreman_scap_client command installed by the Puppet module. (This command is also executed automatically by Cron according to the schedule specified when you created the compliance policy.)

1. Execute the foreman_scap_client command manually to run the OpenSCAP scan and upload the results to the Red Hat Satellite OpenSCAP capsule. Use the compliance policy ID specified in the /etc/foreman_scap_client/config.yaml file as an argument to the command.

   [root@serverd ~]# foreman_scap_client 1
   File /var/lib/openscap/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d.xml is missing. Downloading it from proxy.
   Download SCAP content xml from: https://satellite.lab.example.com:9090/compliance/policies/1/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d
   DEBUG: running: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_common  --results-arf /tmp/d20180727-2719-ois40f/results.xml /var/lib/openscap/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d.xml
   WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
   WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
   DEBUG: running: /usr/bin/bzip2 /tmp/d20180727-2719-ois40f/results.xml
   Uploading results to https://satellite.lab.example.com:9090/compliance/arf/1

2. Log off from serverd.

   [root@serverd ~]# logout
   [student@serverd ~]$ logout
   Connection to serverd closed.
   [student@workstation ~]$ 

Evaluate the compliance report in your Satellite Server web UI in order to determine which checks passed and which failed.

1. Navigate to Hosts → Reports to list the compliance reports uploaded by serverd. The page lists the number of passes, failures, and some in other categories for all the audited systems.

2. If there is more than one report, there will be more than one link under Reported At. To open the latest report, click the link under the Reported At column to view the details for the latest scan result.

3. Click View full report to evaluate the full report.