5

Just use the default policy with no rules. These policies are about reporting that certain configuration declarations exist and are not being violated, which is somewhat orthogonal to actual security concerns. Furthermore, use of them without understanding what they do will cause confusing behavior.


2

I am an OpenSCAP developer. We use the official XML Schemas provided by MITRE and CIS. From the messages it looks like the OVAL file you got is not a valid OVAL 5.11 file. You could work around it by using --skip-valid but a better solution is to report this issue to CIS and get it fixed.


2

If you add a tailoring-path, you probably need to update the profile line Defining tailoring-path doesn't automatically inject any new rules, it just adds another source to the search hierarchy. To actually use it, you need to invoke the "tailored" profile by name, instead of the original profile, e.g.: %addon org_fedora_oscap content-type = scap-security-...


2

Based on this OpenShift blog post, you need to install some packages to have openSCAP log to syslog: yum install html2text util-linux-ng In terms of working around the issue itself, the check you mention basically does the following: sed -i "s/\(GRUB_CMDLINE_LINUX=\)\"\(.*\)\"/\1\"\2 nousb\"/" /etc/default/grub bootloader /sbin/grubby --update-kernel=...


2

There already is an alpha version of OpenSCAP for Windows. https://github.com/OpenSCAP/openscap/releases/tag/1.3.0_alpha1 This version is command-line only and implements only a subset of checks, but might be worth trying.


2

This is one of the differences between RHEL and CentOS. Red Hat OVALs are not applicable to CentOS systems.


1

OpenShift 3 has been removed from upstream. While OpenShift 3.11 will not be EOL until June 2022, the content for it will no longer be developed as OpenShift 4 content is prioritized. Starting from version 0.1.53, the OpenShift 3 guides are no longer provided. You can get the file from a previous version. The version 0.1.52 is the last version that ...


1

Unfortunately there is no automated way of reverting the changes done by the remediation. You would need to understand what the remediation does and revert it manually. The only safe/easy way is to backup the system files prior applying the remediation, as you already said.


1

the XML provided in the reference doesn't contain automated checks (e.g.: OVAL), it seems there are only manual checks. Looking at system attributes of check elements, I noted something strange, it seems to be defining an ID for the check, instead of defining the checking system to use, as every rule has a different checking system. What you need is a ...


1

OpenSCAP (OpenSCAP library and command line application) has recently enabled Windows support in its master branch. It is not complete, but it is working, as this Twitter post suggests: https://twitter.com/OpenSCAP/status/989107760464834560 The Windows version has not been released yet. However, it is possible to build it from source code on Windows using ...


1

I think the URL in system attribute in check element is wrong. <ns10:check system="http://wordpress-www-open-scap-org.b9ad.pro-us-east-1.openshiftapps.com/page/SCE"> There should be system="http://open-scap.org/page/SCE" See https://github.com/OpenSCAP/openscap/blob/maint-1.2/tests/sce/sce_xccdf.xml for an example. I wonder why is such a weird URL ...


1

there were recent fixes to OSCAP addon related to tailoring in kickstart file: https://github.com/OpenSCAP/oscap-anaconda-addon/issues/36 https://github.com/OpenSCAP/oscap-anaconda-addon/issues/41 Both issues were fixed in version 0.8. But there is still one standing: https://github.com/OpenSCAP/oscap-anaconda-addon/issues/40 Which means that the ...


1

As you pointed these are files created by the OS install ... if you don't need them you can delete them. If you open anaconda-ks.cfg will see the sequence of installation from partitions to packages install.


Only top voted, non community-wiki answers of a minimum length are eligible