Hardening SUSE Linux with OpenSCAP

SCAP stands for Security Content Automation Protocol. It is a framework of specifications developed and maintained by the National Institute of Standards and Technology (NIST) that supports automated configuration, vulnerability scanning, and policy compliance evaluation of systems in an organization. SCAP also standardizes how vulnerabilities and security configurations are communicated, both to machines and to human beings.

OpenSCAP is a collection of open source tools that implement the SCAP framework for Linux. It received the SCAP 1.2 certification from NIST in 2014. OpenSCAP works together with the SCAP Security Guide (SSG), which implements security guidelines recommended by respected authorities in a machine-readable format. This allows OpenSCAP to automatically audit and harden your SUSE Linux system against recognized security baselines.

SCAP consists of the following components, which interact to describe, evaluate and report on the security state of a system.

The SCAP Security Guide is an open source project that provides machine-readable security policies for Linux systems. It translates established security benchmarks, such as Defense Information Systems Agency (DISA) STIGs and Center for Internet Security (CIS) benchmarks, into SCAP content that can be automatically applied and verified. The SCAP Security Guide delivers XCCDF checklists, OVAL checks, and ready-to-use remediation scripts in the form of Ansible playbooks and Bash scripts.

Using OpenSCAP together with the SCAP Security Guide provides the following benefits:

Applying security hardening without prior planning can lead to service disruptions, misconfigurations, and incomplete compliance. The steps below help you assess your environment, define the scope of hardening, and set up a safe testing workflow before touching production systems.

The following two packages are required for all scanning and remediation workflows described in this article:

Install both packages with the following command:

> sudo zypper install openscap-utils scap-security-guide

The following packages are optional and extend the core workflow:

> sudo zypper install scap-workbench ssg-apply

Tip: Security best practice for SCAP Workbench

Avoid installing SCAP Workbench on the target system you plan to harden. Instead, install it on a separate client machine and apply hardening to the target system remotely, maintaining an air gap until the target is connected to a potentially insecure network.

After installing the scap-security-guide package, the SSG security content is available in the following directories:

The following security profiles are supported by SUSE for SUSE Linux. The profiles are maintained in the ComplianceAsCode repository.

To view the full list of profiles available in the DataStream file, including their IDs, run:

> oscap info /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

The oscap xccdf eval command evaluates a system against the rules defined in a security profile and produces results in XML format. An HTML report can be generated alongside the XML results for human review. The evaluation typically takes a few minutes, depending on the number of rules in the selected profile.

Before scanning, ensure that the openscap-utils and scap-security-guide packages are installed as described in Section 4, “Installing OpenSCAP and the SCAP Security Guide”, and that you have selected a profile as described in Section 5, “SSG Content, directories and profiles”.

To scan your system locally against a profile and save the results, run the following command:

> sudo oscap xccdf eval \
  --profile PROFILE-ID \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

Replace PROFILE-ID with one of the profile IDs listed in Table 1, “Supported SCAP Security Guide profiles for SUSE Linux”. For example, to scan against the HIPAA profile:

> sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_hipaa \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

The results are saved to /tmp/results.xml and the HTML report to /tmp/report.html. Open the report in a web browser to review the evaluation results.

Some SCAP Security Guide content references external OVAL files, for example, to check whether the system is patched against known CVEs. By default, OpenSCAP skips these remote resources and displays a warning. The following options control this behavior.

By default, oscap xccdf eval evaluates all rules in the selected profile. You can narrow the scope of evaluation using the following options.

To scan a remote machine over SSH, use oscap-ssh instead of oscap. The openscap-utils package must be installed on both the local and the remote machine. The interface mirrors that of oscap:

> sudo oscap-ssh user@host 22 xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_hipaa \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

After scanning your system, you can remediate identified policy violations automatically or manually. The SCAP Security Guide provides fix scripts in two formats — shell scripts and Ansible playbooks — that oscap can apply directly, or that you can review and run independently.

Important: Automatic remediation not always available

Automatic remediation is not offered for fixes that are too disruptive to apply safely on a running system. Such rules must be remediated manually.

The overall remediation process is as follows:

Note

Remediation must be run more than once. Rules are applied in alphabetical order. Some rules have dependencies on others, and the system may need to be restarted between passes for changes to take effect.

The simplest approach is to scan and remediate in a single command using the --remediate option. The system is first scanned, and then oscap immediately attempts to fix each failing rule.

Warning: Usage of the --skip-rule option

Always use --skip-rule to skip the rule xccdf_org.ssgproject.content_rule_accounts_authorized_local_users unless you have explicitly configured the variable var_accounts_authorized_local_users_regex. Failing to do so may prevent sudo from working after a reboot.

> sudo oscap xccdf eval --remediate \
  --profile xccdf_org.ssgproject.content_profile_hipaa \
  --results /tmp/results.xml \
  --report /tmp/report.html \
  --skip-rule xccdf_org.ssgproject.content_rule_accounts_authorized_local_users \
  /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

For the changes to take effect, reboot the system.

> sudo reboot

In the resulting /tmp/results.xml file, the first TestResult element contains the scan results before remediation. The second TestResult element contains the results after remediation, where a rule result of fixed indicates a successful fix, and error indicates that the fix was not successful.

Alternatively, you can separate the scan and remediation into two steps. This allows you to review the scan results before applying any fixes.

To inspect the remediation instructions before applying them, use oscap xccdf generate fix to save the fix content to a file without executing it.

To generate a shell script:

> oscap xccdf generate fix \
  --template urn:xccdf:fix:script:sh \
  --profile xccdf_org.ssgproject.content_profile_hipaa \
  --output my-remediation-script.sh \
  /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

To generate an Ansible playbook:

> oscap xccdf generate fix \
  --template urn:xccdf:fix:script:ansible \
  --profile xccdf_org.ssgproject.content_profile_hipaa \
  --output my-remediation-playbook.yml \
  /usr/share/xml/scap/ssg/content/ssg-sle16-ds.xml

The SCAP Security Guide ships pre-built shell scripts for each supported profile. These can be used for straightforward remediation without conditions or tailoring.

Note

Within each script, rules follow the format: # BEGIN fix (N/TOTAL) for RULE-ID through to # END fix for RULE-ID. Rules that contain a line ending with IS MISSING! have no automatic remediation and must be applied manually.

For each supported profile, the SCAP Security Guide also ships Ansible playbooks that you can use for remediation.

Note

You may need to repeat the remediation steps more than once. Some rules require a system restart to take effect, and rules are executed in alphabetical order, which means dependencies between rules may not be resolved in a single pass.

If the available profiles do not fully match your requirements, you can create a customized profile using SCAP Workbench and save it as a tailoring file. The tailoring file can then be applied with oscap using the --tailoring-file option.