6
votes
Which CentOS security policy is suitable for a single-purpose server?
Just use the default policy with no rules. These policies are about reporting that certain configuration declarations exist and are not being violated, which is somewhat orthogonal to actual security ...
2
votes
Accepted
How do I force Anaconda's SCAP add-on to let me use a USB keyboard?
If you add a tailoring-path, you probably need to update the profile line
Defining tailoring-path doesn't automatically inject any new rules, it just adds another source to the search hierarchy. To ...
2
votes
How do I force Anaconda's SCAP add-on to let me use a USB keyboard?
Based on this OpenShift blog post, you need to install some packages to have openSCAP log to syslog:
yum install html2text util-linux-ng
In terms of working around the issue itself, the check you ...
2
votes
Accepted
OpenSCAP for windows target
There already is an alpha version of OpenSCAP for Windows. https://github.com/OpenSCAP/openscap/releases/tag/1.3.0_alpha1
This version is command-line only and implements only a subset of checks, but ...
2
votes
openscap and CentOS 7 OVAL definitions
This is one of the differences between RHEL and CentOS. Red Hat OVALs are not applicable to CentOS systems.
2
votes
Accepted
Openscap on RHEL access to older policies?
Only the last (v2.0.0) CIS RHEL8 version is delivered with the scap-security-guide package. Comparing the v1.0.1, which was previously delivered, with the v2.0.0, some rules were included, others ...
2
votes
Using CIS Benchmarks with openscap
I am an OpenSCAP developer. We use the official XML Schemas provided by MITRE and CIS. From the messages it looks like the OVAL file you got is not a valid OVAL 5.11 file.
You could work around it by ...
2
votes
Ubuntu 20.04 CIS xccdf benchmarks
Try the OpenSCAP project GitHub repository:
https://github.com/ComplianceAsCode/content/tree/master/
I think also the official CIS website (https://www.cisecurity.org/) provides XCCDF files for ...
1
vote
Openscap scanner is incorrectly failing for a multiple DNS rule and I'm not sure why
You mention 4 nameserver entries.
That might be the problem, and depending on your system, possibly 1 too many.
man 5 resolv.conf
nameserver Name server IP address
Internet address of a ...
1
vote
Getting a "diff" of two different OSCAP releases?
Explore
$ oscap xccdf generate fix --help
You will have to run this twice for each target. First time get the shell scripts applied to the system, second time to get oscap-anaconda-addon fixes.
1
vote
Can oscap tool be run on a container to scan the host VM?
Theoretically, it could work, somehow. But I haven't tried that and I haven't heard about anyone using it this way. The container would need to have mounted the host filesystem mounted in some ...
1
vote
OpenScap scan results are false-positive
The Upstream project for these rules used by OpenSCAP is https://github.com/ComplianceAsCode/content.
If you believe these rules are not working as expected, it would be great to file an issue there ...
1
vote
specificity in root account email requirement (xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias)
The email address is a variable. You will need to create a so-called tailoring file in which you would set a different value for the variable. Then, when you will run the scan of the target system, ...
1
vote
writing your own openscap scan profile
Use the scap-workbench gui on a system with a desktop.
https://www.open-scap.org/tools/scap-workbench/
It gives you the option to only select the items you want to test for and save it as a profile.
1
vote
OSCAP doesn't work for remediation on Ubuntu 18.04 install
Have you executed the command with elevated rights?
OSCAP as a product makes various changes to protected files, which means you need to execute the command as sudo.
Edit: Since you replied with the ...
1
vote
OpenSCAP ssh with keyfile
At least on scap-workbench 1.2.1 you can run the scan with Dry run toggled and this will give you the command line to be executed for the scan. With this command line you can override ssh options ...
1
vote
Accepted
Why Openshift 3 is missing from openscap static page?
OpenShift 3 has been removed from upstream. While OpenShift 3.11 will not be EOL until June 2022, the content for it will no longer be developed as OpenShift 4 content is prioritized. Starting from ...
1
vote
How to rollback after openscap remediation
Unfortunately there is no automated way of reverting the changes done by the remediation. You would need to understand what the remediation does and revert it manually.
The only safe/easy way is to ...
1
vote
Evaluating DISA-STIG for Windows 7 returns only "notchecked"
the XML provided in the reference doesn't contain automated checks (e.g.: OVAL), it seems there are only manual checks.
Looking at system attributes of check elements, I noted something strange, it ...
1
vote
Run OpenSCAP locally on Windows
OpenSCAP (OpenSCAP library and command line application) has recently enabled Windows support in its master branch.
It is not complete, but it is working, as this Twitter post suggests: https://...
1
vote
not able to make SCE script working
I think the URL in system attribute in check element is wrong.
<ns10:check system="http://wordpress-www-open-scap-org.b9ad.pro-us-east-1.openshiftapps.com/page/SCE">
There should be
system="...
1
vote
Accepted
Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate
there were recent fixes to OSCAP addon related to tailoring in kickstart file:
https://github.com/OpenSCAP/oscap-anaconda-addon/issues/36
https://github.com/OpenSCAP/oscap-anaconda-addon/issues/41
...
1
vote
Accepted
Can I delete anaconda-ks.cfg and openscap_data from root folder?
As you pointed these are files created by the OS install ... if you don't need them you can delete them. If you open anaconda-ks.cfg will see the sequence of installation from partitions to packages ...
1
vote
Which CentOS security policy is suitable for a single-purpose server?
Would like to add my bit of findings and what really helped me.
Such options make most users feel paranoid. I was also searching for a direct explanation which is short and to the point. I came across ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
openscap × 52security × 6
linux × 4
redhat × 4
centos7 × 4
windows × 3
centos × 3
rhel7 × 3
kickstart × 2
anaconda × 2
powershell × 1
windows-7 × 1
windows-server-2012 × 1
cisco × 1
centos6 × 1
fedora × 1
ubuntu-18.04 × 1
rhel6 × 1
chroot × 1
benchmark × 1
profile × 1
rhel8 × 1
amazon-linux-2 × 1
cve × 1
rocky-linux × 1