Questions tagged [openscap]

Open source suite of SCAP tools

Filter by
Sorted by
Tagged with
1 vote
0 answers
36 views

writing your own openscap scan profile

I am currently checking the remote machine using the command oscap-ssh login@host 22 xccdf eval -- profile xccdf_org.ssgproject.content_profile_standart --report name.html. But the test templates don'...
user avatar
0 votes
1 answer
44 views

Generating plain-text report in OpenSCAP

I have set up OpenSCAP for compliance testing. Right now I am generating xml and html reports. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_custom --results-arf results.xml --report ...
user avatar
0 votes
0 answers
25 views

OpenScap Debian 10 Benchmarks

The lastest openscap package I downloaded for Debian 10 does not include a datastream or benchmark for Debian 10. The latest release they have is debian 8 and I get "Not Applicable" when ...
user avatar
0 votes
0 answers
127 views

OpenSCAP on Debian 11

Building out and SIEM server on a Debian 11 OS. Does anyone know when the package libopenscap8 will become available? After reviewing the packages available for Debian servers, I found it was ...
user avatar
  • 1
0 votes
1 answer
33 views

Issues using SCAP Workbench on Fedora 35

I have an issue with installing and running Flatpacks because I installed SCAP Workbench which changed my default system settings (Fedora 35).
user avatar
0 votes
2 answers
392 views

OSCAP doesn't work for remediation on Ubuntu 18.04 install

my oscap for ubuntu 18.04 doesn't remediate with the commands or through the gui through the scap workbench oscap xccdf eval --remediate -profile profilename xmlfilename this checks and shows the ...
user avatar
  • 1
1 vote
1 answer
179 views

OpenSCAP ssh with keyfile

I would like to test a CentOS system with OpenSCAP run from my Windows PC. The problem is that I can ssh to the CentOS with keyfile only, as per company policy. I did not find whether SCAP workbench ...
user avatar
0 votes
2 answers
38 views

STIG validation -> group policy or user setting?

I'm trying to determine if the enforcement of a STIG rule is driven solely by group policy, or user setting, or some combination of both. By this, I mean that when a STIG rule is flagged as failing, ...
user avatar
  • 101
1 vote
1 answer
428 views

How do I cross-reference OpenSCAP benchmarks to the CIS documentation?

I'm using the SCAP WorkBench, and have gone in to customize the CIS profile for RHEL 8. The benchmark items are clearly titled with things like "Modify the System Login Banner". The item ...
user avatar
-1 votes
1 answer
30 views

Why Openshift 3 is missing from openscap static page?

I am trying to access https://static.open-scap.org/ssg-guides/ssg-ocp3-guide-index.html to understand some of the issues found in a scan but seems that this webpage is now missing. Anybody does know ...
user avatar
  • 101
0 votes
1 answer
65 views

OpenSCAP for SLES 15 docker container and/or image

I see from this page that it is possible to scan either a running RHEL 7 docker container or the docker image. Is this only possible for RHEL 7 or can it be done for other operating systems? ...
user avatar
  • 101
1 vote
1 answer
199 views

Performing an OpenSCAP Remediation via a chroot session -- "Can't perform remediation in offline mode" Error

I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows: oscap-chroot /mnt/chroot_fs \ xccdf eval \ --remediate \ --...
user avatar
0 votes
1 answer
92 views

Anaconda openscap addon scan

I added openscap addon in kickstart. After the iso is installed, I run the scan on one vm with addon and one without addon. The scan results don't have much difference. For instance, passed 64 vs 61. ...
user avatar
1 vote
0 answers
169 views

Build SCAP files from reference system

The current way of dealing with a SCAP configuration file is unwieldy. Let's look at the process as I read it in the documentation: Take a starting config file (CIS, DISA STIG, OpenSCAP reference) ...
user avatar
  • 31
0 votes
1 answer
103 views

remediation script for centos 7 throws syntax errors

thanks in advance. i am running a fresh download of openscap on centos7 (patched). it produces a remediation script, but the script throws an error repeatedly. its the same syntax issue many times ...
user avatar
  • 3
0 votes
1 answer
337 views

SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket

I'm running latest workbench: SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0 I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
user avatar
1 vote
1 answer
579 views

How to run OpenSCAP with my own PowerShell-script

I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml: <?xml version="1.0" encoding="UTF-8"?&...
user avatar
1 vote
0 answers
402 views

OpenSCAP warning: obtrusive data from probe

I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation. I receive a lot of ...
user avatar
  • 141
0 votes
1 answer
1k views

How to rollback after openscap remediation

What is the best practice to rollback after a openscap remediate that made the system unstable other than to restore a system backup
user avatar
1 vote
0 answers
38 views

Verify on a client workstation that all GPOs are enforced using OpenSCAP

I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable. I have exported my GPO's to an XML file but I can't ...
user avatar
  • 11
1 vote
0 answers
74 views

oscap-vm fails to produce HTML results

I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs. When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
user avatar
4 votes
1 answer
799 views

Evaluating DISA-STIG for Windows 7 returns only "notchecked"

I've downloaded the DISA_STIG for Windows 7 from https://www.stigviewer.com/stig/windows_7/ (XML version) and tried to evaluate my desktop with OSCAP 1.3.0 for windows, with the command: oscap xccdf ...
user avatar
-1 votes
1 answer
270 views

False positives when scanning CentOS7 with OpenSCAP

I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...
user avatar
  • 1
0 votes
1 answer
753 views

OpenSCAP for windows target

I am searching for OpenSCAP support for windows target servers. Currently OpenSCAP does not allow to run scans locally against a Windows machine. Please check this post. But it does not have enough ...
user avatar
2 votes
2 answers
2k views

openscap and CentOS 7 OVAL definitions

I'm using the Redhat cve reports to run OVAL scans against CentOS 7. I'm trying to understand if the results are accurate, or if I should be doing it differently. If I run an OVAL report like this: ...
user avatar
  • 181
1 vote
1 answer
123 views

OpenSCAP with external resources on a device with no external networking

I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
user avatar
  • 203
1 vote
1 answer
5k views

Run OpenSCAP locally on Windows

Please tell me if I am missing something here. OpenSCAP will not currently allow you to run scans locally against a Windows machine. I have read posts on Experts Exchange that lead me to believe that ...
user avatar
0 votes
1 answer
342 views

not able to make SCE script working

I'm trying to use SCE script in openscap ds file and all I get is "notchecked" status here is my ds file: <ns0:data-stream-collection xmlns:dc="http://purl.org/dc/elements/1.1/" ...
user avatar
0 votes
1 answer
133 views

OpenSCAP reporting false for RHSA patches on Redhat6 Server x86_64

did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching. performed yum update and rebooted said server and its reflecting the newer version :2.6....
user avatar
2 votes
1 answer
595 views

Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate

I'm having trouble getting RHEL7.4 to use a tailoring file with the OSCAP addon . I've taken the following steps to make this work. Created a customization RPM using the scap-workbench tool Added ...
user avatar
0 votes
1 answer
55 views

OpenSCAP remediation won't boot

I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...
user avatar
  • 1
5 votes
2 answers
2k views

How do I force Anaconda's SCAP add-on to let me use a USB keyboard?

The problem I'm creating an RHEL 7.3 installation image with a custom kickstart file. I can add this to my kickstart file to enable SCAP configuration during installation: %addon org_fedora_oscap ...
user avatar
  • 181
1 vote
1 answer
4k views

Can I delete anaconda-ks.cfg and openscap_data from root folder?

I just noticed that after every fresh CentOS 7 (7.2) installation I perform, there are two files created in the root folder (/root): openscap_data folder anaconda-ks.cfg file As far as I understand ...
user avatar
  • 237
6 votes
3 answers
13k views

Which CentOS security policy is suitable for a single-purpose server?

I am exploring CentOS as a possibility for hosting a number of servers (mail, web, database, etc). Each machine will have a single purpose, and security is a priority. At the first installation, I am ...
user avatar
  • 499
0 votes
2 answers
2k views

Using CIS Benchmarks with openscap

I am trying to get CIS Centos 6 benchmarks running with openscap. But it does not work. I am calling it like this: oscap oval eval /var/tmp/cis-cat-full/benchmarks/CIS_CentOS_Linux_6_Benchmark_v2.0....
user avatar
  • 1,153
2 votes
1 answer
634 views

How can I use openscap to do an offline OVAL scan of a Cisco router?

This doc describes a process of scanning a router's "show tech" file with a joval utility. I downloaded joval's trial, but didn't see that utility. Can openscap do offline OVAL scans of Cisco ...
user avatar
  • 3,979