Red Hat Security: Linux in Physical, Virtual, and Cloud

For Red Hat Insights to be able to access or create security policies, the compliance service requires that the scap-security-guide package is installed on your RHEL systems.

To access the policies that are available to the compliance service, navigate to Security → Compliance → SCAP Policies. On the SCAP policies page, you can create or edit security policies, and list the systems that are registered to each policy.

If your Red Hat Insights organization does not have any policies, then you are prompted to create a policy.

Figure 10.5: SCAP policies

After you create one or more policies, the policy list appears on the SCAP policies page.

Figure 10.6: List of policies

The process of creating a policy requires several steps, which include selecting the RHEL version, adding details (such as name and other attributes), selecting systems, and customizing the policy rules.

After you select the operating system, you can filter for a policy type by using the Policy type search field.

Figure 10.7: Create SCAP policy

After customizing the policy details, you select which systems to include in the policy from a list of available systems.

Figure 10.8: Select the systems

During the creation process, you can customize your policy for your environment's needs. Customizing your policy is useful because there are some rules that do not apply to all situations. In the following example, only the Sudo and Updating Software rules are selected.

Figure 10.9: SCAP customization

In the final step, you review the new policy before creating it.

Figure 10.10: Review SCAP policy

To create a compliance report, run the insights-client --compliance command as a user with root privileges. This command runs the scan for the configured policies and uploads the results to the compliance service databases.

To view the reports, navigate to Security → Compliance → Reports.

Red Hat Insights does not display any reports until you run the insights-client --compliance command.

Figure 10.11: SCAP reports

To make compliance reports available in the console, run the insights-client --compliance command:

[root@host ~]# insights-client --compliance
System uses SSG version 0.1.66
Saved tailoring file for xccdf_org.ssgproject.content_profile_cis_server_l1 to /var/tmp/oscap_tailoring_file-xccdf_org.ssgproject.content_profile_cis_server_l1.fruiolnu.xml
Running scan for xccdf_org.ssgproject.content_profile_cis_server_l1... this may take a while
Uploading Insights data.
Successfully uploaded report for demo.lab.example.com.

After running the insights-client command, reload the Reports page. The Reports page now shows the available reports:

Figure 10.12: SCAP reports

Click a report to see the policy details:

Figure 10.13: SCAP policy details

The Reports page displays a list of servers that use this policy. Click a server link to see the report details:

Figure 10.14: Server details

To download the report, click Download PDF. In the dialog that displays, choose which system data to include.

To generate periodic reports, you might use an automation controller provided by Red Hat Ansible Automation Platform to schedule Ansible Playbooks to periodically run the redhat.insights.compliance role on managed hosts that you must monitor.