Questions tagged [openscap]

Open source suite of SCAP tools

Filter by
Sorted by
Tagged with
0 votes
1 answer
129 views

Looking for updated SSG for Amazon Linux 2 and Amazon Linux 2023

Are there any new data stream and xccdf checklist available for Amazon Linux 2 and Amazon Linux 2023? I am able to install the scap-security-guide on an Amazon Linux 2 server, but the data stream xml ...
0 votes
1 answer
54 views

Openscap scanner is incorrectly failing for a multiple DNS rule and I'm not sure why

I am trying to harden UBI 8 base images using the openscap tool. The scanner has a rule: xccdf_org.ssgproject.content_rule_network_configure_name_resolution which checks the /etc/resolv.conf file for ...
1 vote
2 answers
5k views

Run OpenSCAP locally on Windows

Please tell me if I am missing something here. OpenSCAP will not currently allow you to run scans locally against a Windows machine. I have read posts on Experts Exchange that lead me to believe that ...
0 votes
1 answer
162 views

OpenScap scan results are false-positive

I recently ran the OpenScap Audit scan on a SLES 12 machine, and the result seems to be false-positive. Eg for these two checks : 1) Ensure sudo logfile exists - sudo logfile The description for this ...
0 votes
1 answer
304 views

Removing CIS Level 2 RH profile from Rocky Linux 9

I have selected the Redhat CIS server level security profile while installation and now I am seeing lot of restriction. I like to remove this security profile from my Rocky Linux 9. I have tested the ...
0 votes
1 answer
53 views

Does OpenSCAP have a feature to add comments on XCCDF scan findings?

I am new to OpenSCAP and I was wondering if OpenSCAP has a feature to add comments one could insert to XCCDF scan findings that could be updated and be viewed in reports? Is it also possible to add ...
1 vote
1 answer
41 views

Getting a "diff" of two different OSCAP releases?

I am trying to get a "diff" of the commands that are executed as part of applying different releases of the oscap-anaconda-addon, specifically the STIGs applied in RHEL 7.9 and in AlmaLinux ...
0 votes
1 answer
95 views

OpenSCAP SCE script in Source DataStream file

I am new to OpenSCAP, and have a query about SCE scripts and the DataStream format. The SCE documentation for OpenSCAP states: The SCE scripts can be part of a Source DataStream. DataStream is a ...
0 votes
1 answer
184 views

oscap-ssh scanning ubuntu22.04 Result notapplicable

please tell me if there are any options to check the workstation on ubuntu22.04 using openscap. I downloaded ssg for Ubuntu22.04, but when I try to check, I get a Result notapplicable on all points.......
2 votes
1 answer
196 views

writing your own openscap scan profile

I am currently checking the remote machine using the command oscap-ssh login@host 22 xccdf eval -- profile xccdf_org.ssgproject.content_profile_standart --report name.html. But the test templates don'...
0 votes
1 answer
341 views

OpenSCAP Workbench customize Datastream Files

When i try to tailoring this datastream file, i get following error: Opened file '/Applications/scap-workbench.app/Contents/Resources/ssg/ssg-rhel7-ds.xml'. Error while opening file. There was a ...
0 votes
1 answer
78 views

Can oscap tool be run on a container to scan the host VM?

Can the openscap's oscap tool be run on a container to scan the host VM? NOTE: It runs fine on the RHEL container (after install) Dockerfile FROM registry.access.redhat.com/ubi8/ubi:latest RUN yum -y ...
0 votes
1 answer
89 views

oscap-chroot: offline mode is not supported by uname probe

We are trying to scan offline mounts using oscap-chroot on ubuntu 20 But we are getting following error: W: oscap: Requested offline mode is not supported by uname probe. Can you please help ...
1 vote
2 answers
560 views

OpenSCAP ssh with keyfile

I would like to test a CentOS system with OpenSCAP run from my Windows PC. The problem is that I can ssh to the CentOS with keyfile only, as per company policy. I did not find whether SCAP workbench ...
0 votes
1 answer
1k views

Ubuntu 20.04 CIS xccdf benchmarks

I was hoping that someone knew where to find xccdf files for Ubuntu 20.04 with CIS benchmarks to run with Openscap. It looks like the out-of-the-box Openscap only includes RHEL, firefox, and java. I ...
0 votes
1 answer
353 views

How do I use a certain remediation shell script in SCAP Workbench

I am new to SCAP Workbench and I am trying it out for the first time. I was wondering how do I use the remediation shell script for just one issue.
0 votes
1 answer
57 views

Openscap on RHEL access to older policies?

Currently using Openscap on some RHEL8.6 servers. I have a need to use / check older policies. Currently the package comes with CIS Linux 8 Benchmark™, v2.0.0, released 2022-02-23 Is it possible to ...
1 vote
1 answer
130 views

Openscap CIS RHEL6 Profile unavailible?

I'm running Open-SCAP Workbench 1.2.0 on RHEL8.6 installed via dnf, rpm: openscap-1.3.6-3.el8.x86_64. While choosing a profile after loading the 'RHEL 6' content (an ssg-rhel6-xccdf.xml file located ...
0 votes
1 answer
297 views

Can OpenScap generate 1 report compiling multiple results?

Sample command to evaluate: $ oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_rht-ccp --results scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml Sample command ...
0 votes
1 answer
237 views

OpenScap Debian 10 Benchmarks

The lastest openscap package I downloaded for Debian 10 does not include a datastream or benchmark for Debian 10. The latest release they have is debian 8 and I get "Not Applicable" when ...
1 vote
1 answer
92 views

specificity in root account email requirement (xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias)

The test for xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias is looking specifically for root: [email protected] in /etc/aliases and OpenSCAP remediation ...
0 votes
1 answer
558 views

Generating plain-text report in OpenSCAP

I have set up OpenSCAP for compliance testing. Right now I am generating xml and html reports. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_custom --results-arf results.xml --report ...
0 votes
1 answer
83 views

Issues using SCAP Workbench on Fedora 35

I have an issue with installing and running Flatpacks because I installed SCAP Workbench which changed my default system settings (Fedora 35).
0 votes
2 answers
2k views

Using CIS Benchmarks with openscap

I am trying to get CIS Centos 6 benchmarks running with openscap. But it does not work. I am calling it like this: oscap oval eval /var/tmp/cis-cat-full/benchmarks/CIS_CentOS_Linux_6_Benchmark_v2.0....
0 votes
2 answers
1k views

OSCAP doesn't work for remediation on Ubuntu 18.04 install

my oscap for ubuntu 18.04 doesn't remediate with the commands or through the gui through the scap workbench oscap xccdf eval --remediate -profile profilename xmlfilename this checks and shows the ...
1 vote
0 answers
112 views

oscap-vm fails to produce HTML results

I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs. When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
0 votes
2 answers
153 views

STIG validation -> group policy or user setting?

I'm trying to determine if the enforcement of a STIG rule is driven solely by group policy, or user setting, or some combination of both. By this, I mean that when a STIG rule is flagged as failing, ...
1 vote
1 answer
822 views

How do I cross-reference OpenSCAP benchmarks to the CIS documentation?

I'm using the SCAP WorkBench, and have gone in to customize the CIS profile for RHEL 8. The benchmark items are clearly titled with things like "Modify the System Login Banner". The item ...
-1 votes
1 answer
36 views

Why Openshift 3 is missing from openscap static page?

I am trying to access https://static.open-scap.org/ssg-guides/ssg-ocp3-guide-index.html to understand some of the issues found in a scan but seems that this webpage is now missing. Anybody does know ...
1 vote
0 answers
716 views

OpenSCAP warning: obtrusive data from probe

I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation. I receive a lot of ...
0 votes
1 answer
141 views

OpenSCAP for SLES 15 docker container and/or image

I see from this page that it is possible to scan either a running RHEL 7 docker container or the docker image. Is this only possible for RHEL 7 or can it be done for other operating systems? ...
1 vote
1 answer
316 views

Performing an OpenSCAP Remediation via a chroot session -- "Can't perform remediation in offline mode" Error

I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows: oscap-chroot /mnt/chroot_fs \ xccdf eval \ --remediate \ --...
0 votes
1 answer
168 views

Anaconda openscap addon scan

I added openscap addon in kickstart. After the iso is installed, I run the scan on one vm with addon and one without addon. The scan results don't have much difference. For instance, passed 64 vs 61. ...
1 vote
0 answers
183 views

Build SCAP files from reference system

The current way of dealing with a SCAP configuration file is unwieldy. Let's look at the process as I read it in the documentation: Take a starting config file (CIS, DISA STIG, OpenSCAP reference) ...
0 votes
1 answer
191 views

remediation script for centos 7 throws syntax errors

thanks in advance. i am running a fresh download of openscap on centos7 (patched). it produces a remediation script, but the script throws an error repeatedly. its the same syntax issue many times ...
0 votes
1 answer
541 views

SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket

I'm running latest workbench: SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0 I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
1 vote
1 answer
858 views

How to run OpenSCAP with my own PowerShell-script

I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml: <?xml version="1.0" encoding="UTF-8"?&...
0 votes
1 answer
1k views

How to rollback after openscap remediation

What is the best practice to rollback after a openscap remediate that made the system unstable other than to restore a system backup
-1 votes
1 answer
318 views

False positives when scanning CentOS7 with OpenSCAP

I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...
1 vote
0 answers
46 views

Verify on a client workstation that all GPOs are enforced using OpenSCAP

I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable. I have exported my GPO's to an XML file but I can't ...
2 votes
2 answers
2k views

openscap and CentOS 7 OVAL definitions

I'm using the Redhat cve reports to run OVAL scans against CentOS 7. I'm trying to understand if the results are accurate, or if I should be doing it differently. If I run an OVAL report like this: ...
4 votes
1 answer
1k views

Evaluating DISA-STIG for Windows 7 returns only "notchecked"

I've downloaded the DISA_STIG for Windows 7 from https://www.stigviewer.com/stig/windows_7/ (XML version) and tried to evaluate my desktop with OSCAP 1.3.0 for windows, with the command: oscap xccdf ...
7 votes
3 answers
14k views

Which CentOS security policy is suitable for a single-purpose server?

I am exploring CentOS as a possibility for hosting a number of servers (mail, web, database, etc). Each machine will have a single purpose, and security is a priority. At the first installation, I am ...
2 votes
1 answer
979 views

How can I use openscap to do an offline OVAL scan of a Cisco router?

This doc describes a process of scanning a router's "show tech" file with a joval utility. I downloaded joval's trial, but didn't see that utility. Can openscap do offline OVAL scans of Cisco ...
0 votes
1 answer
843 views

OpenSCAP for windows target

I am searching for OpenSCAP support for windows target servers. Currently OpenSCAP does not allow to run scans locally against a Windows machine. Please check this post. But it does not have enough ...
1 vote
1 answer
172 views

OpenSCAP with external resources on a device with no external networking

I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
0 votes
1 answer
497 views

not able to make SCE script working

I'm trying to use SCE script in openscap ds file and all I get is "notchecked" status here is my ds file: <ns0:data-stream-collection xmlns:dc="http://purl.org/dc/elements/1.1/" ...
0 votes
1 answer
158 views

OpenSCAP reporting false for RHSA patches on Redhat6 Server x86_64

did OpenSCAP scan initially and was inform of that the server had 16 hits on definitions that require patching. performed yum update and rebooted said server and its reflecting the newer version :2.6....
2 votes
1 answer
810 views

Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate

I'm having trouble getting RHEL7.4 to use a tailoring file with the OSCAP addon . I've taken the following steps to make this work. Created a customization RPM using the scap-workbench tool Added ...
0 votes
1 answer
67 views

OpenSCAP remediation won't boot

I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...