Questions tagged [openscap]
Open source suite of SCAP tools
50
questions
0
votes
1
answer
62
views
OpenSCAP SCE script in Source DataStream file
I am new to OpenSCAP, and have a query about SCE scripts and the DataStream format.
The SCE documentation for OpenSCAP states:
The SCE scripts can be part of a Source DataStream. DataStream is a ...
0
votes
1
answer
173
views
Removing CIS Level 2 RH profile from Rocky Linux 9
I have selected the Redhat CIS server level security profile while installation and now I am seeing lot of restriction. I like to remove this security profile from my Rocky Linux 9.
I have tested the ...
0
votes
1
answer
109
views
oscap-ssh scanning ubuntu22.04 Result notapplicable
please tell me if there are any options to check the workstation on ubuntu22.04 using openscap. I downloaded ssg for Ubuntu22.04, but when I try to check, I get a Result notapplicable on all points.......
- 1
1
vote
1
answer
32
views
Getting a "diff" of two different OSCAP releases?
I am trying to get a "diff" of the commands that are executed as part of applying different releases of the oscap-anaconda-addon, specifically the STIGs applied in RHEL 7.9 and in AlmaLinux ...
0
votes
1
answer
51
views
Can oscap tool be run on a container to scan the host VM?
Can the openscap's oscap tool be run on a container to scan the host VM?
NOTE: It runs fine on the RHEL container (after install)
Dockerfile
FROM registry.access.redhat.com/ubi8/ubi:latest
RUN yum -y ...
0
votes
1
answer
46
views
Does OpenSCAP have a feature to add comments on XCCDF scan findings?
I am new to OpenSCAP and I was wondering if OpenSCAP has a feature to add comments one could insert to XCCDF scan findings that could be updated and be viewed in reports? Is it also possible to add ...
- 1
0
votes
1
answer
237
views
OpenSCAP Workbench customize Datastream Files
When i try to tailoring this datastream file, i get following error:
Opened file '/Applications/scap-workbench.app/Contents/Resources/ssg/ssg-rhel7-ds.xml'.
Error while opening file.
There was a ...
- 1
0
votes
1
answer
758
views
Ubuntu 20.04 CIS xccdf benchmarks
I was hoping that someone knew where to find xccdf files for Ubuntu 20.04 with CIS benchmarks to run with Openscap. It looks like the out-of-the-box Openscap only includes RHEL, firefox, and java. I ...
- 21
0
votes
1
answer
137
views
OpenScap scan results are false-positive
I recently ran the OpenScap Audit scan on a SLES 12 machine, and the result seems to be false-positive.
Eg for these two checks :
1) Ensure sudo logfile exists - sudo logfile
The description for this ...
- 1
0
votes
1
answer
68
views
oscap-chroot: offline mode is not supported by uname probe
We are trying to scan offline mounts using oscap-chroot on ubuntu 20
But we are getting following error:
W: oscap: Requested offline mode is not supported by uname probe.
Can you please help ...
0
votes
1
answer
260
views
How do I use a certain remediation shell script in SCAP Workbench
I am new to SCAP Workbench and I am trying it out for the first time. I was wondering how do I use the remediation shell script for just one issue.
- 1
0
votes
1
answer
47
views
Openscap on RHEL access to older policies?
Currently using Openscap on some RHEL8.6 servers.
I have a need to use / check older policies.
Currently the package comes with CIS
Linux 8 Benchmark™, v2.0.0, released 2022-02-23
Is it possible to ...
- 948
1
vote
1
answer
109
views
Openscap CIS RHEL6 Profile unavailible?
I'm running Open-SCAP Workbench 1.2.0 on RHEL8.6 installed via dnf, rpm: openscap-1.3.6-3.el8.x86_64.
While choosing a profile after loading the 'RHEL 6' content (an ssg-rhel6-xccdf.xml file located ...
- 21
0
votes
1
answer
255
views
Can OpenScap generate 1 report compiling multiple results?
Sample command to evaluate:
$ oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_rht-ccp --results scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
Sample command ...
- 3
1
vote
1
answer
72
views
specificity in root account email requirement (xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias)
The test for xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias is looking specifically for root: [email protected] in /etc/aliases and OpenSCAP remediation ...
- 11
2
votes
1
answer
154
views
writing your own openscap scan profile
I am currently checking the remote machine using the command oscap-ssh login@host 22 xccdf eval -- profile xccdf_org.ssgproject.content_profile_standart --report name.html.
But the test templates don'...
0
votes
1
answer
426
views
Generating plain-text report in OpenSCAP
I have set up OpenSCAP for compliance testing. Right now I am generating xml and html reports.
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_custom --results-arf results.xml --report ...
0
votes
1
answer
209
views
OpenScap Debian 10 Benchmarks
The lastest openscap package I downloaded for Debian 10 does not include a datastream or benchmark for Debian 10. The latest release they have is debian 8 and I get "Not Applicable" when ...
0
votes
1
answer
76
views
Issues using SCAP Workbench on Fedora 35
I have an issue with installing and running Flatpacks because I installed SCAP Workbench which changed my default system settings (Fedora 35).
0
votes
2
answers
917
views
OSCAP doesn't work for remediation on Ubuntu 18.04 install
my oscap for ubuntu 18.04 doesn't remediate with the commands or through the gui through the scap workbench
oscap xccdf eval --remediate -profile profilename xmlfilename
this checks and shows the ...
- 1
1
vote
2
answers
486
views
OpenSCAP ssh with keyfile
I would like to test a CentOS system with OpenSCAP run from my Windows PC. The problem is that I can ssh to the CentOS with keyfile only, as per company policy.
I did not find whether SCAP workbench ...
0
votes
2
answers
128
views
STIG validation -> group policy or user setting?
I'm trying to determine if the enforcement of a STIG rule is driven solely by group policy, or user setting, or some combination of both. By this, I mean that when a STIG rule is flagged as failing, ...
- 101
1
vote
1
answer
777
views
How do I cross-reference OpenSCAP benchmarks to the CIS documentation?
I'm using the SCAP WorkBench, and have gone in to customize the CIS profile for RHEL 8. The benchmark items are clearly titled with things like "Modify the System Login Banner". The item ...
-1
votes
1
answer
35
views
Why Openshift 3 is missing from openscap static page?
I am trying to access https://static.open-scap.org/ssg-guides/ssg-ocp3-guide-index.html to understand some of the issues found in a scan but seems that this webpage is now missing. Anybody does know ...
- 101
0
votes
1
answer
126
views
OpenSCAP for SLES 15 docker container and/or image
I see from this page that it is possible to scan either a running RHEL 7 docker container or the docker image.
Is this only possible for RHEL 7 or can it be done for other operating systems? ...
- 101
1
vote
1
answer
296
views
Performing an OpenSCAP Remediation via a chroot session -- "Can't perform remediation in offline mode" Error
I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows:
oscap-chroot /mnt/chroot_fs \
xccdf eval \
--remediate \
--...
- 251
0
votes
1
answer
153
views
Anaconda openscap addon scan
I added openscap addon in kickstart. After the iso is installed, I run the scan on one vm with addon and one without addon. The scan results don't have much difference. For instance, passed 64 vs 61. ...
1
vote
0
answers
181
views
Build SCAP files from reference system
The current way of dealing with a SCAP configuration file is unwieldy. Let's look at the process as I read it in the documentation:
Take a starting config file (CIS, DISA STIG, OpenSCAP reference)
...
- 31
0
votes
1
answer
180
views
remediation script for centos 7 throws syntax errors
thanks in advance. i am running a fresh download of openscap on centos7 (patched). it produces a remediation script, but the script throws an error repeatedly. its the same syntax issue many times ...
- 3
0
votes
1
answer
510
views
SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket
I'm running latest workbench:
SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0
I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
- 1
1
vote
1
answer
795
views
How to run OpenSCAP with my own PowerShell-script
I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml:
<?xml version="1.0" encoding="UTF-8"?&...
1
vote
0
answers
666
views
OpenSCAP warning: obtrusive data from probe
I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation.
I receive a lot of ...
- 141
0
votes
1
answer
1k
views
How to rollback after openscap remediation
What is the best practice to rollback after a openscap remediate that made the system unstable other than to restore a system backup
1
vote
0
answers
45
views
Verify on a client workstation that all GPOs are enforced using OpenSCAP
I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable.
I have exported my GPO's to an XML file but I can't ...
- 11
1
vote
0
answers
108
views
oscap-vm fails to produce HTML results
I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs.
When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
4
votes
1
answer
1k
views
Evaluating DISA-STIG for Windows 7 returns only "notchecked"
I've downloaded the DISA_STIG for Windows 7 from https://www.stigviewer.com/stig/windows_7/ (XML version) and tried to evaluate my desktop with OSCAP 1.3.0 for windows, with the command:
oscap xccdf ...
- 41
-1
votes
1
answer
312
views
False positives when scanning CentOS7 with OpenSCAP
I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...
- 1
0
votes
1
answer
837
views
OpenSCAP for windows target
I am searching for OpenSCAP support for windows target servers. Currently OpenSCAP does not allow to run scans locally against a Windows machine. Please check this post. But it does not have enough ...
- 103
2
votes
2
answers
2k
views
openscap and CentOS 7 OVAL definitions
I'm using the Redhat cve reports to run OVAL scans against CentOS 7. I'm trying to understand if the results are accurate, or if I should be doing it differently. If I run an OVAL report like this:
...
- 181
1
vote
1
answer
165
views
OpenSCAP with external resources on a device with no external networking
I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
- 203
1
vote
1
answer
5k
views
Run OpenSCAP locally on Windows
Please tell me if I am missing something here. OpenSCAP will not currently allow you to run scans locally against a Windows machine.
I have read posts on Experts Exchange that lead me to believe that ...
- 11
0
votes
1
answer
470
views
not able to make SCE script working
I'm trying to use SCE script in openscap ds file and all I get is "notchecked" status
here is my ds file:
<ns0:data-stream-collection xmlns:dc="http://purl.org/dc/elements/1.1/"
...
- 1
0
votes
1
answer
156
views
OpenSCAP reporting false for RHSA patches on Redhat6 Server x86_64
did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching.
performed yum update and rebooted said server and its reflecting the newer version :2.6....
2
votes
1
answer
770
views
Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate
I'm having trouble getting RHEL7.4 to use a tailoring file with the OSCAP addon . I've taken the following steps to make this work.
Created a customization RPM using the scap-workbench tool
Added ...
- 23
0
votes
1
answer
66
views
OpenSCAP remediation won't boot
I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...
- 1
5
votes
2
answers
2k
views
How do I force Anaconda's SCAP add-on to let me use a USB keyboard?
The problem
I'm creating an RHEL 7.3 installation image with a custom kickstart file.
I can add this to my kickstart file to enable SCAP configuration during installation:
%addon org_fedora_oscap
...
- 181
1
vote
1
answer
4k
views
Can I delete anaconda-ks.cfg and openscap_data from root folder?
I just noticed that after every fresh CentOS 7 (7.2) installation I perform, there are two files created in the root folder (/root):
openscap_data folder
anaconda-ks.cfg file
As far as I understand ...
- 257
7
votes
3
answers
14k
views
Which CentOS security policy is suitable for a single-purpose server?
I am exploring CentOS as a possibility for hosting a number of servers (mail, web, database, etc). Each machine will have a single purpose, and security is a priority.
At the first installation, I am ...
- 549
0
votes
2
answers
2k
views
Using CIS Benchmarks with openscap
I am trying to get CIS Centos 6 benchmarks running with openscap. But it does not work. I am calling it like this:
oscap oval eval /var/tmp/cis-cat-full/benchmarks/CIS_CentOS_Linux_6_Benchmark_v2.0....
- 1,215
2
votes
1
answer
921
views
How can I use openscap to do an offline OVAL scan of a Cisco router?
This doc describes a process of scanning a router's "show tech" file with a joval utility.
I downloaded joval's trial, but didn't see that utility.
Can openscap do offline OVAL scans of Cisco ...
- 4,243