Link Search Menu Expand Document
LZone

OpenSCAP Cheat Sheet

CLI

Get XCCDF ruleset infos

oscap info /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
oscap info /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml
...

Use the printed profile names as input for --profile for xccdf eval runs

Output control

--report <file>          # For HTML table output
--results <file>         # For XML result output

XCCDF evaluation example

# Fedora
oscap xccdf eval \
    --report report.html \
    --profile xccdf_org.ssgproject.content_profile_pci-dss \
    /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

# Redhat
oscap xccdf eval \
    --report report.html \
    --profile xccdf_org.ssgproject.content_profile_pci-dss \
    /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

Evaluate and remediate

oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_rht-ccp --results scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml

Generate remediation shell script for review

oscap xccdf generate fix --template urn:xccdf:fix:script:sh --profile xccdf_org.ssgproject.content_profile_rht-ccp --output my-remediation-script.sh /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml

OVAL evaluation example

For Ubuntu download USN feed

type="usn"         # or "cve" for more details
input="com.ubuntu.$(lsb_release -cs).${type}.oval.xml"
wget "https://security-metadata.canonical.com/oval/${input}.bz2"
bunzip "${input}.bz2"

and check it with

oscap oval eval "${input}"

Install

apt-get install libopenscap8       # Ubuntu + Debian
apt-get install ssg-debian         # Debian SSG profiles (for Ubuntu see next section)
yum install scap-security-guide    # Fedora/Redhat

Ubuntu Audit

For full Ubuntu server profiles “Ubuntu Advantage” subscription is required

ua status              # See status
ua enable cis          # Enable CIS auditing
ua audit <level>       # Perform scan, level is e.g. "server_level1"

Misc