Questions tagged [openscap]

Open source suite of SCAP tools

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

remediation script for centos 7 throws syntax errors

thanks in advance. i am running a fresh download of openscap on centos7 (patched). it produces a remediation script, but the script throws an error repeatedly. its the same syntax issue many times ...
0
votes
1answer
36 views

SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket

I'm running latest workbench: SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0 I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
0
votes
1answer
117 views

How to run OpenSCAP with my own PowerShell-script

I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml: <?xml version="1.0" encoding="UTF-8"?&...
1
vote
0answers
82 views

OpenSCAP warning: obtrusive data from probe

I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation. I receive a lot of ...
0
votes
1answer
1k views

How to rollback after openscap remediation

What is the best practice to rollback after a openscap remediate that made the system unstable other than to restore a system backup
0
votes
0answers
342 views

OpenSCAP scan on Windows 10

I am attempting to scan my personal Windows 10 machine using oscap, however, all the rules are coming back as "notchecked". scan output: https://pastebin.com/raw/hzy6SU4y I downloaded the xml file ...
0
votes
0answers
24 views

Verify on a client workstation that all GPOs are enforced using OpenSCAP

I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable. I have exported my GPO's to an XML file but I can't ...
1
vote
0answers
49 views

oscap-vm fails to produce HTML results

I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs. When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
2
votes
1answer
383 views

Evaluating DISA-STIG for Windows 7 returns only “notchecked”

I've downloaded the DISA_STIG for Windows 7 from https://www.stigviewer.com/stig/windows_7/ (XML version) and tried to evaluate my desktop with OSCAP 1.3.0 for windows, with the command: oscap xccdf ...
-1
votes
1answer
198 views

False positives when scanning CentOS7 with OpenSCAP

I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...
0
votes
1answer
507 views

OpenSCAP for windows target

I am searching for OpenSCAP support for windows target servers. Currently OpenSCAP does not allow to run scans locally against a Windows machine. Please check this post. But it does not have enough ...
1
vote
2answers
1k views

openscap and CentOS 7 OVAL definitions

I'm using the Redhat cve reports to run OVAL scans against CentOS 7. I'm trying to understand if the results are accurate, or if I should be doing it differently. If I run an OVAL report like this: ...
1
vote
1answer
82 views

OpenSCAP with external resources on a device with no external networking

I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
1
vote
1answer
3k views

Run OpenSCAP locally on Windows

Please tell me if I am missing something here. OpenSCAP will not currently allow you to run scans locally against a Windows machine. I have read posts on Experts Exchange that lead me to believe that ...
0
votes
1answer
247 views

not able to make SCE script working

I'm trying to use SCE script in openscap ds file and all I get is "notchecked" status here is my ds file: <ns0:data-stream-collection xmlns:dc="http://purl.org/dc/elements/1.1/" ...
0
votes
1answer
106 views

OpenSCAP reporting false for RHSA patches on Redhat6 Server x86_64

did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching. performed yum update and rebooted said server and its reflecting the newer version :2.6....
2
votes
1answer
407 views

Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate

I'm having trouble getting RHEL7.4 to use a tailoring file with the OSCAP addon . I've taken the following steps to make this work. Created a customization RPM using the scap-workbench tool Added ...
0
votes
1answer
48 views

OpenSCAP remediation won't boot

I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...
5
votes
2answers
1k views

How do I force Anaconda's SCAP add-on to let me use a USB keyboard?

The problem I'm creating an RHEL 7.3 installation image with a custom kickstart file. I can add this to my kickstart file to enable SCAP configuration during installation: %addon org_fedora_oscap ...
1
vote
1answer
3k views

Can I delete anaconda-ks.cfg and openscap_data from root folder?

I just noticed that after every fresh CentOS 7 (7.2) installation I perform, there are two files created in the root folder (/root): openscap_data folder anaconda-ks.cfg file As far as I understand ...
6
votes
3answers
12k views

Which CentOS security policy is suitable for a single-purpose server?

I am exploring CentOS as a possibility for hosting a number of servers (mail, web, database, etc). Each machine will have a single purpose, and security is a priority. At the first installation, I am ...
0
votes
1answer
2k views

Using CIS Benchmarks with openscap

I am trying to get CIS Centos 6 benchmarks running with openscap. But it does not work. I am calling it like this: oscap oval eval /var/tmp/cis-cat-full/benchmarks/CIS_CentOS_Linux_6_Benchmark_v2.0....
2
votes
1answer
435 views

How can I use openscap to do an offline OVAL scan of a Cisco router?

This doc describes a process of scanning a router's "show tech" file with a joval utility. I downloaded joval's trial, but didn't see that utility. Can openscap do offline OVAL scans of Cisco ...