Hardening with OpenSCAP

SCAP stands for Security Content Automation Protocol. It is a framework of specifications developed and maintained by the National Institute of Standards and Technology (NIST) that supports automated configuration, vulnerability scanning, and policy compliance evaluation of systems in an organization. SCAP also standardizes how vulnerabilities and security configurations are communicated, both to machines and to human beings.

OpenSCAP is a collection of open source tools that implement the SCAP framework for Linux. It received the SCAP 1.2 certification from NIST in 2014. OpenSCAP works together with the SCAP Security Guide (SSG), which implements security guidelines recommended by respected authorities in a machine-readable format. This allows OpenSCAP to automatically audit and harden your system against recognized security baselines.

SCAP consists of the following components, which interact with each other to describe, evaluate, and report on the security state of a system.

The SCAP Security Guide is an open source project that provides machine-readable security policies for Linux systems. It translates established security benchmarks, such as Defense Information Systems Agency (DISA) STIGs and Center for Internet Security (CIS) benchmarks, into SCAP content that can be automatically applied and verified. The SCAP Security Guide delivers XCCDF checklists, OVAL checks, and ready-to-use remediation scripts in the form of Ansible playbooks and Bash scripts.

Using OpenSCAP together with the SCAP Security Guide provides the following benefits:

Applying security hardening without prior planning can lead to service disruptions, misconfigurations, and incomplete compliance. The steps below help you assess your environment, define the scope of hardening, and set up a safe testing workflow before touching production systems.

To install the required packages, proceed as follows:

Note

GUI tools such as SCAP Workbench are not available on . If you need to create a tailoring file to customize a profile, do so on a separate machine and transfer the file to the system. You can then apply it using the --tailoring-file option with oscap.

After installing the scap-security-guide package, the SCAP Security Guide security content is available in the following directories:

The following security profile is supported by SUSE for . The profile is maintained in the ComplianceAsCode repository.

To view the full list of profiles available in the DataStream file, including their IDs, run:

> oscap info /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml

The oscap xccdf eval command evaluates a system against the rules defined in a security profile and produces results in XML format. An HTML report can be generated alongside the XML results for human review. The evaluation typically takes a few minutes, depending on the number of rules in the selected profile.

Before scanning, ensure that the openscap-utils and scap-security-guide packages are installed as described in Section 4, “Installing OpenSCAP and the SCAP Security Guide”, and that you have reviewed the available profile as described in Section 5, “SSG Content, Directories, and Profiles”.

To scan your system locally against the general profile and save the results, run the following command:

> sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_general \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml

The results are saved to /tmp/results.xml and the HTML report to /tmp/report.html. Open the report in a web browser to review the evaluation results.

Some SCAP Security Guide content references external OVAL files, for example to check whether the system is patched against known CVEs. By default, OpenSCAP skips these remote resources and displays a warning. The following options control this behavior.

By default, oscap xccdf eval evaluates all rules in the selected profile. You can narrow the scope of evaluation using the following options.

To scan a remote machine over SSH, use oscap-ssh instead of oscap. The openscap-utils package must be installed on both the local and the remote machine. The interface mirrors that of oscap:

> sudo oscap-ssh user@host 22 xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_general \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml

After scanning your system, you can remediate identified policy violations automatically or manually. The SCAP Security Guide provides fix scripts in two formats — shell scripts and Ansible playbooks — that oscap can apply directly, or that you can review and run independently.

Important: Automatic remediation not always available

Automatic remediation is not offered for fixes that are too disruptive to apply safely on a running system. Such rules must be remediated manually.

The overall remediation process is as follows:

Note

Because is an immutable system, remediation must be run more than once with reboots between passes. The first pass uses transactional-update to apply changes to a new snapshot. After rebooting into the new snapshot, a second pass applies any remaining fixes. Rules are executed in alphabetical order and some have dependencies on others.

The simplest approach is to scan and remediate in a single command using the --remediate option. The system is first scanned, and then oscap immediately attempts to fix each failing rule.

Warning: Usage of the --skip-rule option

Always use --skip-rule to skip the rule xccdf_org.ssgproject.content_rule_accounts_authorized_local_users unless you have explicitly configured the variable var_accounts_authorized_local_users_regex. Failing to do so may prevent sudo from working after a reboot.

In the resulting results files, a rule result of fixed indicates a successful fix. A result of error indicates that the fix was not successful and the rule still does not pass evaluation.

Alternatively, you can separate the scan and remediation into two steps. This allows you to review the scan results before applying any fixes.

To inspect the remediation instructions before applying them, use oscap xccdf generate fix to save the fix content to a file without executing it.

To generate a shell script:

> oscap xccdf generate fix \
  --template urn:xccdf:fix:script:sh \
  --profile xccdf_org.ssgproject.content_profile_general \
  --output my-remediation-script.sh \
  /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml

To generate an Ansible playbook:

> oscap xccdf generate fix \
  --template urn:xccdf:fix:script:ansible \
  --profile xccdf_org.ssgproject.content_profile_general \
  --output my-remediation-playbook.yml \
  /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml

The SCAP Security Guide ships a pre-built shell script for the general profile. This can be used for straightforward remediation without conditions or tailoring.

Note

Within each script, rules follow the format: # BEGIN fix (N/TOTAL) for RULE-ID through to # END fix for RULE-ID. Rules that contain a line ending with IS MISSING! have no automatic remediation and must be applied manually.

To remediate using Ansible playbooks, perform the following procedure.

Note

You may need to repeat the remediation steps more than once. Some rules require a system restart to take effect, and rules are executed in alphabetical order, which means dependencies between rules may not be resolved in a single pass.

If you need to customize the general profile — for example, to exclude specific rules — create a tailoring file on a separate machine using SCAP Workbench, then transfer it to the system. Apply it with the --tailoring-file option:

> sudo oscap xccdf eval --remediate \
  --profile xccdf_org.mycompany_profile_custom \
  --tailoring-file ssg-slmicro6-ds-tailoring.xml \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  /usr/share/xml/scap/ssg/content/ssg-slmicro6-ds.xml