6 votes

Which CentOS security policy is suitable for a single-purpose server?

Just use the default policy with no rules. These policies are about reporting that certain configuration declarations exist and are not being violated, which is somewhat orthogonal to actual security ...
Jonah Benton's user avatar
  • 1,252
2 votes
Accepted

How do I force Anaconda's SCAP add-on to let me use a USB keyboard?

If you add a tailoring-path, you probably need to update the profile line Defining tailoring-path doesn't automatically inject any new rules, it just adds another source to the search hierarchy. To ...
Alex P's user avatar
  • 181
2 votes

How do I force Anaconda's SCAP add-on to let me use a USB keyboard?

Based on this OpenShift blog post, you need to install some packages to have openSCAP log to syslog: yum install html2text util-linux-ng In terms of working around the issue itself, the check you ...
iwaseatenbyagrue's user avatar
2 votes
Accepted

OpenSCAP for windows target

There already is an alpha version of OpenSCAP for Windows. https://github.com/OpenSCAP/openscap/releases/tag/1.3.0_alpha1 This version is command-line only and implements only a subset of checks, but ...
Jan Cerny's user avatar
  • 151
2 votes

openscap and CentOS 7 OVAL definitions

This is one of the differences between RHEL and CentOS. Red Hat OVALs are not applicable to CentOS systems.
Jan Cerny's user avatar
  • 151
2 votes
Accepted

Openscap on RHEL access to older policies?

Only the last (v2.0.0) CIS RHEL8 version is delivered with the scap-security-guide package. Comparing the v1.0.1, which was previously delivered, with the v2.0.0, some rules were included, others ...
Marcus Burghardt's user avatar
2 votes

Using CIS Benchmarks with openscap

I am an OpenSCAP developer. We use the official XML Schemas provided by MITRE and CIS. From the messages it looks like the OVAL file you got is not a valid OVAL 5.11 file. You could work around it by ...
Martin Preisler's user avatar
2 votes

Ubuntu 20.04 CIS xccdf benchmarks

Try the OpenSCAP project GitHub repository: https://github.com/ComplianceAsCode/content/tree/master/ I think also the official CIS website (https://www.cisecurity.org/) provides XCCDF files for ...
unixoid's user avatar
  • 106
1 vote

Openscap scanner is incorrectly failing for a multiple DNS rule and I'm not sure why

You mention 4 nameserver entries. That might be the problem, and depending on your system, possibly 1 too many. man 5 resolv.conf nameserver Name server IP address Internet address of a ...
HBruijn's user avatar
  • 80.3k
1 vote

Getting a "diff" of two different OSCAP releases?

Explore $ oscap xccdf generate fix --help You will have to run this twice for each target. First time get the shell scripts applied to the system, second time to get oscap-anaconda-addon fixes.
Šimon Lukašík's user avatar
1 vote

Can oscap tool be run on a container to scan the host VM?

Theoretically, it could work, somehow. But I haven't tried that and I haven't heard about anyone using it this way. The container would need to have mounted the host filesystem mounted in some ...
Jan Cerny's user avatar
  • 151
1 vote

OpenScap scan results are false-positive

The Upstream project for these rules used by OpenSCAP is https://github.com/ComplianceAsCode/content. If you believe these rules are not working as expected, it would be great to file an issue there ...
Marcus Burghardt's user avatar
1 vote

specificity in root account email requirement (xccdf_org.ssgproject.content_rule_postfix_client_configure_mail_alias)

The email address is a variable. You will need to create a so-called tailoring file in which you would set a different value for the variable. Then, when you will run the scan of the target system, ...
Jan Cerny's user avatar
  • 151
1 vote

writing your own openscap scan profile

Use the scap-workbench gui on a system with a desktop. https://www.open-scap.org/tools/scap-workbench/ It gives you the option to only select the items you want to test for and save it as a profile.
AndyM's user avatar
  • 968
1 vote

OSCAP doesn't work for remediation on Ubuntu 18.04 install

Have you executed the command with elevated rights? OSCAP as a product makes various changes to protected files, which means you need to execute the command as sudo. Edit: Since you replied with the ...
Achilleas Yfantis's user avatar
1 vote

OpenSCAP ssh with keyfile

At least on scap-workbench 1.2.1 you can run the scan with Dry run toggled and this will give you the command line to be executed for the scan. With this command line you can override ssh options ...
Becker's user avatar
  • 21
1 vote
Accepted

Why Openshift 3 is missing from openscap static page?

OpenShift 3 has been removed from upstream. While OpenShift 3.11 will not be EOL until June 2022, the content for it will no longer be developed as OpenShift 4 content is prioritized. Starting from ...
Jan Cerny's user avatar
  • 151
1 vote

How to rollback after openscap remediation

Unfortunately there is no automated way of reverting the changes done by the remediation. You would need to understand what the remediation does and revert it manually. The only safe/easy way is to ...
Becker's user avatar
  • 21
1 vote

Evaluating DISA-STIG for Windows 7 returns only "notchecked"

the XML provided in the reference doesn't contain automated checks (e.g.: OVAL), it seems there are only manual checks. Looking at system attributes of check elements, I noted something strange, it ...
Yuuma's user avatar
  • 36
1 vote

Run OpenSCAP locally on Windows

OpenSCAP (OpenSCAP library and command line application) has recently enabled Windows support in its master branch. It is not complete, but it is working, as this Twitter post suggests: https://...
Jan Cerny's user avatar
  • 151
1 vote

not able to make SCE script working

I think the URL in system attribute in check element is wrong. <ns10:check system="http://wordpress-www-open-scap-org.b9ad.pro-us-east-1.openshiftapps.com/page/SCE"> There should be system="...
Jan Cerny's user avatar
  • 151
1 vote
Accepted

Tailoring file on kickstarted RHEL7.4 installation causes OSCAP plugin to not remediate

there were recent fixes to OSCAP addon related to tailoring in kickstart file: https://github.com/OpenSCAP/oscap-anaconda-addon/issues/36 https://github.com/OpenSCAP/oscap-anaconda-addon/issues/41 ...
Yuuma's user avatar
  • 36
1 vote
Accepted

Can I delete anaconda-ks.cfg and openscap_data from root folder?

As you pointed these are files created by the OS install ... if you don't need them you can delete them. If you open anaconda-ks.cfg will see the sequence of installation from partitions to packages ...
silviud's user avatar
  • 2,707
1 vote

Which CentOS security policy is suitable for a single-purpose server?

Would like to add my bit of findings and what really helped me. Such options make most users feel paranoid. I was also searching for a direct explanation which is short and to the point. I came across ...
Asif Kamran Malick's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible