Questions tagged [openscap]
Open source suite of SCAP tools
29
questions with no upvoted or accepted answers
2
votes
1
answer
983
views
How can I use openscap to do an offline OVAL scan of a Cisco router?
This doc describes a process of scanning a router's "show tech" file with a joval utility.
I downloaded joval's trial, but didn't see that utility.
Can openscap do offline OVAL scans of Cisco ...
- 4,253
1
vote
1
answer
136
views
Openscap CIS RHEL6 Profile unavailible?
I'm running Open-SCAP Workbench 1.2.0 on RHEL8.6 installed via dnf, rpm: openscap-1.3.6-3.el8.x86_64.
While choosing a profile after loading the 'RHEL 6' content (an ssg-rhel6-xccdf.xml file located ...
- 21
1
vote
1
answer
826
views
How do I cross-reference OpenSCAP benchmarks to the CIS documentation?
I'm using the SCAP WorkBench, and have gone in to customize the CIS profile for RHEL 8. The benchmark items are clearly titled with things like "Modify the System Login Banner". The item ...
1
vote
1
answer
319
views
Performing an OpenSCAP Remediation via a chroot session -- "Can't perform remediation in offline mode" Error
I am attempting to perform an OpenSCAP remediation through a chroot session. My command is structured as follows:
oscap-chroot /mnt/chroot_fs \
xccdf eval \
--remediate \
--...
- 251
1
vote
0
answers
184
views
Build SCAP files from reference system
The current way of dealing with a SCAP configuration file is unwieldy. Let's look at the process as I read it in the documentation:
Take a starting config file (CIS, DISA STIG, OpenSCAP reference)
...
- 31
1
vote
1
answer
864
views
How to run OpenSCAP with my own PowerShell-script
I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml:
<?xml version="1.0" encoding="UTF-8"?&...
1
vote
0
answers
729
views
OpenSCAP warning: obtrusive data from probe
I'm using OpenSCAP 1.3.1 on Windows 10 Professional (64-bit) with the CISecurity OVAL vulnerability definitions, schema version 5.11.1. My definition files all pass validation.
I receive a lot of ...
- 141
1
vote
0
answers
47
views
Verify on a client workstation that all GPOs are enforced using OpenSCAP
I would like to verify that all my GPOs are enforced on client workstations using OpenSCAP. A manual verification of each policy is not acceptable.
I have exported my GPO's to an XML file but I can't ...
- 11
1
vote
0
answers
112
views
oscap-vm fails to produce HTML results
I am getting started with oscap-vm, basically using openscap in an offline mode to scan VM images looking for CVEs.
When I use oscap-vm installed on RHEL7.6 and scan Ubuntu images, oscap-vm fails ...
1
vote
1
answer
172
views
OpenSCAP with external resources on a device with no external networking
I am attempting to scan a virtual machine generated off of a RHEL7 kickstart with some in-house configuration. Since the machine in question is still in testing, it's not yet authorized to connect out ...
- 203
0
votes
0
answers
17
views
automate remediation of a headless RHEL 8.9 AMI with exclusions
I'm trying to automate remediation of a headless RHEL 8.9 AMI. What is the best way to remediate ALL but a specific subset of the STIG requirements? I.e., there are 4 STIG requirements that we know ...
0
votes
0
answers
25
views
SCAP Compliance Checker 5.9 - Unable to load Ubuntu DIS STIG 22.04
I am trying to import/load DISA STIG Ubuntu 22.04 found on the STIG Library but it keeps giving out about the content type. https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_CAN_Ubuntu_22-...
0
votes
1
answer
152
views
Looking for updated SSG for Amazon Linux 2 and Amazon Linux 2023
Are there any new data stream and xccdf checklist available for Amazon Linux 2 and Amazon Linux 2023?
I am able to install the scap-security-guide on an Amazon Linux 2 server, but the data stream xml ...
- 1
0
votes
1
answer
326
views
Removing CIS Level 2 RH profile from Rocky Linux 9
I have selected the Redhat CIS server level security profile while installation and now I am seeing lot of restriction. I like to remove this security profile from my Rocky Linux 9.
I have tested the ...
0
votes
1
answer
194
views
oscap-ssh scanning ubuntu22.04 Result notapplicable
please tell me if there are any options to check the workstation on ubuntu22.04 using openscap. I downloaded ssg for Ubuntu22.04, but when I try to check, I get a Result notapplicable on all points.......
- 1
0
votes
1
answer
56
views
Does OpenSCAP have a feature to add comments on XCCDF scan findings?
I am new to OpenSCAP and I was wondering if OpenSCAP has a feature to add comments one could insert to XCCDF scan findings that could be updated and be viewed in reports? Is it also possible to add ...
- 1
0
votes
1
answer
350
views
OpenSCAP Workbench customize Datastream Files
When i try to tailoring this datastream file, i get following error:
Opened file '/Applications/scap-workbench.app/Contents/Resources/ssg/ssg-rhel7-ds.xml'.
Error while opening file.
There was a ...
- 1
0
votes
1
answer
94
views
oscap-chroot: offline mode is not supported by uname probe
We are trying to scan offline mounts using oscap-chroot on ubuntu 20
But we are getting following error:
W: oscap: Requested offline mode is not supported by uname probe.
Can you please help ...
0
votes
1
answer
365
views
How do I use a certain remediation shell script in SCAP Workbench
I am new to SCAP Workbench and I am trying it out for the first time. I was wondering how do I use the remediation shell script for just one issue.
- 1
0
votes
1
answer
580
views
Generating plain-text report in OpenSCAP
I have set up OpenSCAP for compliance testing. Right now I am generating xml and html reports.
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_custom --results-arf results.xml --report ...
0
votes
1
answer
241
views
OpenScap Debian 10 Benchmarks
The lastest openscap package I downloaded for Debian 10 does not include a datastream or benchmark for Debian 10. The latest release they have is debian 8 and I get "Not Applicable" when ...
0
votes
1
answer
83
views
Issues using SCAP Workbench on Fedora 35
I have an issue with installing and running Flatpacks because I installed SCAP Workbench which changed my default system settings (Fedora 35).
0
votes
2
answers
157
views
STIG validation -> group policy or user setting?
I'm trying to determine if the enforcement of a STIG rule is driven solely by group policy, or user setting, or some combination of both. By this, I mean that when a STIG rule is flagged as failing, ...
- 101
0
votes
1
answer
142
views
OpenSCAP for SLES 15 docker container and/or image
I see from this page that it is possible to scan either a running RHEL 7 docker container or the docker image.
Is this only possible for RHEL 7 or can it be done for other operating systems? ...
- 101
0
votes
1
answer
172
views
Anaconda openscap addon scan
I added openscap addon in kickstart. After the iso is installed, I run the scan on one vm with addon and one without addon. The scan results don't have much difference. For instance, passed 64 vs 61. ...
0
votes
1
answer
546
views
SCAP - Workbench on MAC (with Remote Machine option) - Failed to create SSH master socket
I'm running latest workbench:
SCAP Workbench 1.2.1, compiled with Qt 5.13.2, using OpenSCAP 1.4.0
I can't run a scan on remote server using RHEL7 (DISA STIG profile - or any profile) because of a ...
- 1
0
votes
1
answer
70
views
OpenSCAP remediation won't boot
I am runnnig OenSCAP on a CentOS 6.9 box, after I run it and remediate the findings my machine won't boot. It gets to the CentOS splash screen and stops. When I hit Alt+d it will loop when loading ...
- 1
-1
votes
0
answers
22
views
Openscap Workbench
I've set up Openscap Workbench on my local machine, imported the ssg containing a profile for ubuntu-2004, and successfully transferred the ssg.xml to a remote server. I then used the openscap eval ...
- 1
-1
votes
1
answer
319
views
False positives when scanning CentOS7 with OpenSCAP
I just installed OpenSCAP Benchmark scanner on a CentOS7 box I had stigged by hand. There are a huge number of false positives showing up and I'm not sure if it's a bug or somehow it's not remediated ...
- 1