People who code: we want your input. Take the Survey

Questions tagged [openscap]

Open source suite of SCAP tools

Filter by
Sorted by
Tagged with
1
vote
1answer
58 views

How do I cross-reference OpenSCAP benchmarks to the CIS documentation?

I'm using the SCAP WorkBench, and have gone in to customize the CIS profile for RHEL 8. The benchmark items are clearly titled with things like "Modify the System Login Banner". The item ...
-1
votes
1answer
25 views

Why Openshift 3 is missing from openscap static page?

I am trying to access https://static.open-scap.org/ssg-guides/ssg-ocp3-guide-index.html to understand some of the issues found in a scan but seems that this webpage is now missing. Anybody does know ...
0
votes
1answer
43 views

OpenSCAP for SLES 15 docker container and/or image

I see from this page that it is possible to scan either a running RHEL 7 docker container or the docker image. Is this only possible for RHEL 7 or can it be done for other operating systems? ...
0
votes
0answers
13 views

Input file cisco router config in openscap

I have a configuration file for a cisco router and I would like to integrate it as an input file on openscap. Is it technically possible? Thanks
1
vote
1answer
127 views

Performing an OpenSCAP Remediation via a chroot session — “Can't perform remediation in offline mode” Error

I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows: oscap-chroot /mnt/chroot_fs \ xccdf eval \ --remediate \ --...
0
votes
1answer
60 views

Anaconda openscap addon scan

I added openscap addon in kickstart. After the iso is installed, I run the scan on one vm with addon and one without addon. The scan results don't have much difference. For instance, passed 64 vs 61. ...
1
vote
0answers
164 views

Build SCAP files from reference system

The current way of dealing with a SCAP configuration file is unwieldy. Let's look at the process as I read it in the documentation: Take a starting config file (CIS, DISA STIG, OpenSCAP reference) ...
0
votes
1answer
45 views

remediation script for centos 7 throws syntax errors

thanks in advance. i am running a fresh download of openscap on centos7 (patched). it produces a remediation script, but the script throws an error repeatedly. its the same syntax issue many times ...
0
votes
1answer
174 views

SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket

I'm running latest workbench: SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0 I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
1
vote
1answer
396 views

How to run OpenSCAP with my own PowerShell-script

I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml: <?xml version="1.0" encoding="UTF-8"?&...
1
vote
0answers
255 views

OpenSCAP warning: obtrusive data from probe

I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation. I receive a lot of ...
0
votes
1answer
1k views

How to rollback after openscap remediation

What is the best practice to rollback after a openscap remediate that made the system unstable other than to restore a system backup
1
vote
0answers
31 views

Verify on a client workstation that all GPOs are enforced using OpenSCAP

I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable. I have exported my GPO's to an XML file but I can't ...
1
vote
0answers
61 views

oscap-vm fails to produce HTML results

I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs. When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
4
votes
1answer
603 views

Evaluating DISA-STIG for Windows 7 returns only “notchecked”

I've downloaded the DISA_STIG for Windows 7 from https://www.stigviewer.com/stig/windows_7/ (XML version) and tried to evaluate my desktop with OSCAP 1.3.0 for windows, with the command: oscap xccdf ...
-1
votes
1answer
245 views

False positives when scanning CentOS7 with OpenSCAP

I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...
0
votes
1answer
659 views

OpenSCAP for windows target

I am searching for OpenSCAP support for windows target servers. Currently OpenSCAP does not allow to run scans locally against a Windows machine. Please check this post. But it does not have enough ...
2
votes
2answers
2k views

openscap and CentOS 7 OVAL definitions

I'm using the Redhat cve reports to run OVAL scans against CentOS 7. I'm trying to understand if the results are accurate, or if I should be doing it differently. If I run an OVAL report like this: ...
1
vote
1answer
101 views

OpenSCAP with external resources on a device with no external networking

I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
1
vote
1answer
4k views

Run OpenSCAP locally on Windows

Please tell me if I am missing something here. OpenSCAP will not currently allow you to run scans locally against a Windows machine. I have read posts on Experts Exchange that lead me to believe that ...
0
votes
1answer
302 views

not able to make SCE script working

I'm trying to use SCE script in openscap ds file and all I get is "notchecked" status here is my ds file: <ns0:data-stream-collection xmlns:dc="http://purl.org/dc/elements/1.1/" ...
0
votes
1answer
119 views

OpenSCAP reporting false for RHSA patches on Redhat6 Server x86_64

did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching. performed yum update and rebooted said server and its reflecting the newer version :2.6....
2
votes
1answer
490 views

Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate

I'm having trouble getting RHEL7.4 to use a tailoring file with the OSCAP addon . I've taken the following steps to make this work. Created a customization RPM using the scap-workbench tool Added ...
0
votes
1answer
51 views

OpenSCAP remediation won't boot

I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...
5
votes
2answers
1k views

How do I force Anaconda's SCAP add-on to let me use a USB keyboard?

The problem I'm creating an RHEL 7.3 installation image with a custom kickstart file. I can add this to my kickstart file to enable SCAP configuration during installation: %addon org_fedora_oscap ...
1
vote
1answer
3k views

Can I delete anaconda-ks.cfg and openscap_data from root folder?

I just noticed that after every fresh CentOS 7 (7.2) installation I perform, there are two files created in the root folder (/root): openscap_data folder anaconda-ks.cfg file As far as I understand ...
6
votes
3answers
13k views

Which CentOS security policy is suitable for a single-purpose server?

I am exploring CentOS as a possibility for hosting a number of servers (mail, web, database, etc). Each machine will have a single purpose, and security is a priority. At the first installation, I am ...
0
votes
1answer
2k views

Using CIS Benchmarks with openscap

I am trying to get CIS Centos 6 benchmarks running with openscap. But it does not work. I am calling it like this: oscap oval eval /var/tmp/cis-cat-full/benchmarks/CIS_CentOS_Linux_6_Benchmark_v2.0....
2
votes
1answer
523 views

How can I use openscap to do an offline OVAL scan of a Cisco router?

This doc describes a process of scanning a router's "show tech" file with a joval utility. I downloaded joval's trial, but didn't see that utility. Can openscap do offline OVAL scans of Cisco ...