Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ OpenSCAP Enterprise Linux Security Compliance Implementation To …
🛡️ OpenSCAP Enterprise Linux Security Compliance Implementation
To
Linux Security Baseline Implementation
1️⃣ Understanding OpenSCAP Foundation
🔹 What is OpenSCAP
OpenSCAP = Open Security Content Automation Protocol
Purpose:
Automate Linux security compliance checking
Used for:
CIS Benchmark assessment
DISA STIG compliance
NIST security controls mapping
PCI-DSS auditing
ISO 27001 technical compliance
Vulnerability assessment
🔹 OpenSCAP Components
SCAP Framework
Security Content Automation Protocol
Contains:
XCCDF
Extensible Configuration Checklist Description Format
Purpose:
Defines security checklist
Example:
Disable SSH root login
Password complexity
File permissions
OVAL
Open Vulnerability and Assessment Language
Purpose:
Checks actual system state
Example:
Is SSH root login disabled?
Does file exist?
Is package installed?
CPE
Common Platform Enumeration
Identifies operating system
Example:
Ubuntu 24.04
RHEL 9
Rocky Linux 9
CVE
Common Vulnerabilities and Exposures
Security vulnerability identifiers
Example:
CVE-2025-xxxx
DataStream
Combined SCAP content file
Usually:
ssg-rhel9-ds.xml
ssg-ubuntu2404-ds.xml
2️⃣ OpenSCAP Enterprise Architecture
🏢 Enterprise Flow
Security Team
Creates compliance requirement
Compliance Framework
CIS Benchmark
STIG
STIG = Security Technical Implementation Guide
STIG is a security hardening standard created by the U.S. Department of Defense (DoD) through the Defense Information Systems Agency (DISA).
NIST
SCAP Content
Security Guide Content
Example:
scap-security-guide
OpenSCAP Scanner
oscap command
Target Linux Servers
RHEL
Rocky Linux
Ubuntu
Results
XML Report
HTML Report
Compliance Score
Central Management
Satellite
Red Hat Insights
SIEM
Vulnerability Platform
3️⃣ Lab Environment Setup
🖥️ Recommended Enterprise Lab
Virtualization
VMware Workstation
VirtualBox
Hyper-V
Linux Servers
Server 01
Ubuntu 24.04
OpenSCAP Scanner
Server 02
RHEL 9
Target System
Server 03
Rocky Linux
Network
Management Network
SSH Access
Central Reporting
4️⃣ Install OpenSCAP Tools
🐧 Ubuntu Installation
Update system
sudo apt update
Install OpenSCAP Scanner
sudo apt install openscap-scanner -y
Install Security Content
sudo apt install ssg-debderived -y
🔴 RHEL Installation
Install packages
sudo dnf install openscap-scanner -y
Install security guide
sudo dnf install scap-security-guide -y
5️⃣ Verify Installation
Check version
oscap --version
Expected:
OpenSCAP command line tool version
6️⃣ Understand OpenSCAP File Structure
📁 Important Paths
Ubuntu
/usr/share/xml/scap/ssg/content/
RHEL
/usr/share/xml/scap/ssg/content/
Example files:
ssg-ubuntu2404-ds.xml
ssg-rhel9-ds.xml
File Meaning
DS File
DataStream file
Contains all of these:
XCCDF rules
OVAL checks
Profiles
Remediation scripts
7️⃣ Discover Available Security Profiles
Command:
oscap info /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
ssg = SCAP Security Guide
Output Contains:
Profiles
CIS Benchmark Level 1
CIS Benchmark Level 2
STIG
PCI-DSS
HIPAA
8️⃣ Select Compliance Profile
Example:
CIS Ubuntu Linux 24.04 Benchmark
Find profile ID
oscap info file.xml
Example:
xccdf_org.ssgproject.content_profile_cis
9️⃣ Perform First Security Scan
Basic Scan
sudo oscap xccdf eval \
--profile PROFILE_NAME \
security-content.xml
Enterprise Example:
sudo oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
/usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
🔟 Save Scan Results
XML Result
sudo oscap xccdf eval \
--profile cis \
--results scan-result.xml \
ssg-ubuntu2404-ds.xml
XML Purpose
Machine readable
Used by:
SIEM
Compliance tools
Automation
1️⃣1️⃣ Generate HTML Report
Convert XML to HTML
sudo oscap xccdf generate report \
scan-result.xml \
compliance-report.html
Open:
firefox compliance-report.html
Report Contains:
Passed controls
Failed controls
Severity
Remediation
1️⃣2️⃣ Understanding Scan Results
PASS
Control satisfied
FAIL
Security weakness found
ERROR
Scanner problem
NOT APPLICABLE
Rule does not apply
1️⃣3️⃣ Understanding OpenSCAP Rule
Example:
Ensure SSH Root Login Disabled
Rule Contains:
Rule ID
xccdf_rule_sshd_disable_root_login
Description
Security requirement
Check
OVAL test
Fix
Bash remediation script
1️⃣4️⃣ Remediation
Automatic Fix
sudo oscap xccdf eval \
--remediate \
--profile cis \
security-content.xml
What happens:
OpenSCAP modifies system configuration
Examples:
Edit sshd_config
Change permissions
Configure password policy
1️⃣5️⃣ Generate Remediation Script
Extract fixes:
oscap xccdf generate fix \
--fix-type bash \
scan-result.xml
Output:
remediation.sh
Run:
chmod +x remediation.sh
sudo ./remediation.sh
1️⃣6️⃣ Enterprise Scanning Workflow
Daily
Scheduled scan
Cron
Ansible
Weekly
Compliance report
Security team review
Monthly
Audit evidence
1️⃣7️⃣ Automation With Cron
Create schedule:
sudo crontab -e
Example:
02:00 daily scan
0 2
* oscap xccdf eval ...
1️⃣8️⃣ Enterprise Automation With Ansible
Architecture:
Ansible Controller
|
|
Linux Servers
Tasks:
Install OpenSCAP
Copy content
Run scan
Collect reports
1️⃣9️⃣ Integration With SIEM
OpenSCAP Output
XML
HTML
Send to:
Elastic SIEM
Splunk
QRadar
Detect:
Compliance failure
Configuration drift
2️⃣0️⃣ OpenSCAP vs Enterprise Tools
OpenSCAP
Free
Open source
Compliance focused
Tenable
Vulnerability focused
Qualys
Vulnerability + Compliance
CIS-CAT
CIS Benchmark official scanner
2️⃣1️⃣ Enterprise Directory Structure
Recommended:
/opt/security/
openscap/
content/
reports/
scripts/
logs/
Example:
/opt/security/openscap/reports/server01.html
2️⃣2️⃣ Real Enterprise Server Example
Server:
web-prod-01
Scan:
CIS Ubuntu Benchmark
Command:
oscap xccdf eval \
--profile cis \
--results web-prod.xml \
ssg-ubuntu2404-ds.xml
Report:
web-prod-report.html
Security Team Action:
Review failures
Create remediation ticket
Fix
Rescan
2️⃣3️⃣ OpenSCAP Troubleshooting
Problem:
Unable to open file
Check:
ls -l content-path
Problem:
Profile not found
Check:
oscap info file.xml
Problem:
Missing content
Install:
scap-security-guide
2️⃣4️⃣ Skills Required For Job
Linux
Permissions
SELinux
SSH
Systemd
Firewall
Security
CIS Benchmark
NIST
STIG
Automation
Bash
Python
Ansible
Tools
OpenSCAP
Nessus
Tenable
Qualys
2️⃣5️⃣ Final Enterprise OpenSCAP Lifecycle
📌 Install Scanner
↓
📌 Install Security Content
↓
📌 Select Compliance Profile
↓
📌 Scan Linux Server
↓
📌 Generate Report
↓
📌 Review Failed Controls
↓
📌 Apply Remediation
↓
📌 Rescan
↓
📌 Send Evidence To Audit Team
🛡️ OpenSCAP Enterprise Linux Security Compliance Implementation (Ubuntu)
1️⃣ OpenSCAP Introduction and Installation
🔹 OpenSCAP
Purpose:
Security Compliance Automation Framework
Full Name:
Open Security Content Automation Protocol
Used For:
Security baseline checking
Compliance auditing
Vulnerability configuration assessment
Regulatory compliance reporting
🔹 Install OpenSCAP Tools
Command:
sudo apt update
Purpose:
Update Ubuntu package database
Command:
sudo apt install openscap-scanner
Purpose:
Install OpenSCAP scanning engine
Command:
sudo apt install ssg-content
Purpose:
Install SCAP Security Guide content
Important Paths:
OpenSCAP Binary:
/usr/bin/oscap
SCAP Content Directory:
/usr/share/xml/scap/
Security Guide Content:
/usr/share/xml/scap/ssg/content/
2️⃣ Verify OpenSCAP Installation
🔹 Check Version
Command:
oscap --version
Purpose:
Display installed OpenSCAP version
Example Output:
OpenSCAP command line tool version
🔹 Show Help
Command:
oscap --help
Purpose:
Display available OpenSCAP modules and commands
🔹 Show Module Help
Command:
oscap xccdf eval --help
Purpose:
Show XCCDF scanning options
3️⃣ SCAP Terminology and File Types
🔹 SCAP
Full Name:
Security Content Automation Protocol
Purpose:
Standard format for security compliance automation
🔹 XCCDF
Full Name:
Extensible Configuration Checklist Description Format
Purpose:
Contains security rules, checks, severity and remediation
Example:
Password policy rule
SSH configuration rule
Firewall rule
🔹 OVAL
Full Name:
Open Vulnerability and Assessment Language
Purpose:
Technical language used to check system state
Example:
Check:
Is password maximum age configured?
OVAL collects:
Current system value
🔹 DataStream File
Extension:
.xml
Example:
ssg-ubuntu2404-ds.xml
Purpose:
Complete SCAP package containing:
XCCDF
OVAL
CPE
Profiles
🔹 Profile
Purpose:
Collection of security rules for a standard
Examples:
CIS Ubuntu Benchmark
DISA STIG
NIST
4️⃣ Locate OpenSCAP Content Files
🔹 List SCAP Directory
Command:
ls /usr/share/xml/scap/
Purpose:
Show available SCAP content
🔹 Search Security Guide Files
Command:
find /usr/share/xml/scap -name "*.xml"
Purpose:
Find all SCAP XML files
🔹 Example Enterprise Content Location
Path:
/opt/content/
Example:
/opt/content/build/ssg-ubuntu2404-ds.xml
5️⃣ oscap info Command
🔹 Display SCAP File Information
Command:
oscap info ssg-ubuntu2404-ds.xml
Purpose:
Show:
Document type
Profiles
Rules
Checks
Example:
oscap info \
/opt/content/build/ssg-ubuntu2404-ds.xml
6️⃣ XCCDF Evaluation Commands
🔹 Main Compliance Scan Command
Command:
oscap xccdf eval \
--profile PROFILE_ID \
SCAP_FILE.xml
Purpose:
Execute compliance assessment
Components:
oscap
OpenSCAP scanner
xccdf
Use XCCDF checklist engine
eval
Execute evaluation
7️⃣ Find Available Profiles
Command:
oscap info ssg-ubuntu2404-ds.xml
Purpose:
Display available profiles
Examples:
Profile:
cis
Profile:
stig
Profile:
standard
8️⃣ Run CIS Benchmark Scan
Command:
oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
ssg-ubuntu2404-ds.xml
Purpose:
Scan Ubuntu against CIS Benchmark
9️⃣ Save Scan Results
🔹 XML Result File
Command:
oscap xccdf eval \
--profile PROFILE_ID \
--results scan-result.xml \
ssg-ubuntu2404-ds.xml
Purpose:
Save machine readable report
🔹 HTML Report
Command:
oscap xccdf generate report \
scan-result.xml \
report.html
Purpose:
Create human readable compliance report
🔟 Complete Enterprise Scan Workflow
Step 1:
Download SCAP Content
Step 2:
Store Content
Enterprise Path:
/opt/content/scap/
Step 3:
Verify Content
Command:
oscap info file.xml
Step 4:
Select Profile
Command:
oscap info file.xml
Step 5:
Run Compliance Scan
Command:
oscap xccdf eval
Step 6:
Generate Report
Command:
oscap xccdf generate report
Step 7:
Review Failed Rules
Step 8:
Apply Remediation
Step 9:
Scan Again
1️⃣1️⃣ OVAL Commands
🔹 Validate OVAL File
Command:
oscap oval validate file.xml
Purpose:
Check OVAL syntax
🔹 Run OVAL Scan
Command:
oscap oval eval file.xml
Purpose:
Evaluate technical security checks
1️⃣2️⃣ CPE Commands
🔹 Validate CPE Content
Command:
oscap cpe validate file.xml
Purpose:
Verify platform definitions
1️⃣3️⃣ Validate SCAP Content
Command:
oscap xccdf validate file.xml
Purpose:
Check XCCDF file correctness
1️⃣4️⃣ Generate Compliance Report
Command:
oscap xccdf generate report \
result.xml \
compliance-report.html
Purpose:
Convert XML result into browser report
1️⃣5️⃣ Remediation Commands
🔹 Generate Fix Script
Command:
oscap xccdf generate fix \
--result-id xccdf_org.open-scap_testresult \
scan-result.xml
Purpose:
Generate remediation script
🔹 Apply Automatic Remediation
Command:
oscap xccdf eval \
--remediate \
--profile PROFILE_ID \
file.xml
Purpose:
Automatically fix failed controls
1️⃣6️⃣ Enterprise Directory Structure
/opt/
content/
scap/
ssg-ubuntu2404-ds.xml
reports/
scan-result.xml
compliance-report.html
remediation/
fix-script.sh
1️⃣7️⃣ OpenSCAP Enterprise Daily Operations
Daily:
Run compliance scan
Weekly:
Review failed controls
Monthly:
Generate compliance report
Quarterly:
Update SCAP content
1️⃣8️⃣ Enterprise Integration
OpenSCAP
Integrates With:
SIEM
Elastic SIEM
Splunk
Configuration Management
Ansible
Vulnerability Platforms
Tenable
Qualys
Ticketing
ServiceNow
1️⃣9️⃣ Important OpenSCAP Commands Quick Reference
oscap --version
Check OpenSCAP version
oscap info
Show SCAP content information
oscap xccdf eval
Run compliance scan
oscap xccdf generate report
Create HTML report
oscap xccdf generate fix
Create remediation script
oscap oval eval
Run OVAL evaluation
oscap validate
Validate SCAP files
oscap cpe validate
Validate platform definitions
2️⃣0️⃣ Enterprise Security Compliance Flow
🖥️ Ubuntu Server
↓
📦 SCAP Content
↓
🔍 OpenSCAP Scanner
↓
📋 XCCDF Rules
↓
⚙️ OVAL Checks
↓
📊 Compliance Result
↓
🌐 HTML Report
↓
🔧 Remediation
↓
✅ Re-Scan
↓
🛡️ Compliance Achieved
Enterprise Commands
oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis_level1_server \
--results /opt/content/build/cis-results.xml \
--report /opt/content/build/cis-report.html \
--oval-results \
ssg-ubuntu2404-ds.xml
🛡️ OpenSCAP Enterprise Implementation on Ubuntu
OpenSCAP Introduction
OpenSCAP
Open = Open Source
SCAP = Security Content Automation Protocol
Purpose
Security compliance scanning
Vulnerability checking
Configuration auditing
Security benchmark validation
Automated compliance reporting
Enterprise Usage
CIS Benchmark checking
NIST compliance checking
DISA STIG auditing
PCI-DSS compliance
ISO 27001 evidence collection
Government security audits
Main OpenSCAP Tool
oscap
Main OpenSCAP command
Located at
/usr/bin/oscap
Package
libopenscap8
Install OpenSCAP Ubuntu
Update Repository
apt update
Install OpenSCAP Scanner
apt install libopenscap8
Install SCAP Security Guide Content
apt install ssg-debderived
Verify Installation
oscap --version
Check Binary Location
which oscap
/usr/bin/oscap
OpenSCAP Directory Structure
OpenSCAP Binary
/usr/bin/oscap
SCAP Content Directory
/usr/share/xml/scap/
Security Guide Content
/usr/share/xml/scap/ssg/content/
Benchmark Files
XCCDF files
OVAL files
DataStream files
CPE files
Reports Location
User created
/opt/oscap/reports/
/var/log/oscap/
OpenSCAP File Types
XCCDF
Meaning
Extensible Configuration Checklist Description Format
Purpose
Security rules
Compliance requirements
Remediation instructions
Benchmark profiles
Example
CIS Ubuntu Benchmark
OVAL
Meaning
Open Vulnerability Assessment Language
Purpose
Technical checking logic
File checking
Package checking
Configuration checking
Example
Check SSH configuration
DataStream
Contains
XCCDF
OVAL
CPE
Common file
ssg-ubuntu2404-ds.xml
CPE
Checks operating system applicability
oscap Command Structure
oscap MODULE ACTION OPTIONS FILE
Example:
oscap xccdf eval profile.xml
Meaning:
oscap = scanner
xccdf = document type
eval = evaluate
profile.xml = benchmark file
Main OpenSCAP Commands
oscap --version
Purpose
Show installed OpenSCAP version
Usage
oscap --version
oscap info
Purpose
Display information about SCAP content
Shows
Profiles
Rules
IDs
Benchmark details
Command
oscap info ssg-ubuntu2404-ds.xml
oscap xccdf
Purpose
Work with compliance benchmarks
Main Actions
eval
Purpose
Run compliance scan
Example
oscap xccdf eval \
--profile cis \
ssg-ubuntu2404-ds.xml
validate
Purpose
Check XCCDF file correctness
Command
oscap xccdf validate file.xml
generate
Create reports
remediate
Purpose
Automatically fix findings
Example
oscap xccdf eval --remediate
oscap oval
Purpose
Vulnerability checking
validate
Validate OVAL file
eval
Execute vulnerability checks
oscap oval eval
Purpose
Run OVAL assessment
Example
oscap oval eval \
vulnerability.xml
oscap ds
Purpose
Manage DataStream files
list
Show content inside datastream
sds-compose
Create datastream
oscap cpe
Purpose
Check platform applicability
Enterprise Compliance Scan Workflow
Step 1
Install OpenSCAP
Step 2
Download Security Content
Step 3
Check Content
oscap info benchmark.xml
Step 4
Select Profile
Example:
CIS
STIG
NIST
Step 5
Run Scan
oscap xccdf eval
Step 6
Generate Reports
--results scan.xml
--report report.html
Step 7
Review Findings
Step 8
Apply Remediation
--remediate
Enterprise Practical Example Ubuntu 24.04
Find Content
ls /usr/share/xml/scap/ssg/content/
Check Benchmark
oscap info ssg-ubuntu2404-ds.xml
Run CIS Scan
oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
--results results.xml \
--report report.html \
ssg-ubuntu2404-ds.xml
View Report
firefox report.html
Check Result File
ls -lh results.xml
Automated Remediation
oscap xccdf eval \
--remediate \
benchmark.xml
Enterprise Integration
Ansible
Automated compliance fixing
SIEM
Send compliance results
Vulnerability Management
Track failures
Audit Evidence
Store HTML/XML reports