Please enable JavaScript.
Coggle requires JavaScript to display documents.
🛡️ Free OpenSCAP Enterprise Linux Security Compliance Implementation -…
🛡️ Free OpenSCAP Enterprise Linux Security Compliance Implementation
🛡️ OpenSCAP Enterprise Linux Security Compliance Implementation
📌 1. OpenSCAP Foundation
🔹 What is OpenSCAP
OpenSCAP = Open Security Content Automation Protocol
Purpose:
Automate security compliance checking
Detect Linux configuration weaknesses
Compare systems against security standards
Generate compliance reports
Enterprise Usage:
Security audits
Regulatory compliance
Hardening validation
Continuous compliance monitoring
🔹 SCAP Meaning
S = Security
C = Content
A = Automation
P = Protocol
SCAP provides:
Security standards
Machine-readable rules
Automated assessment
🔹 OpenSCAP Components
📦 OpenSCAP Scanner
Tool:
oscap
Purpose:
Executes compliance scans
Binary path:
/usr/bin/oscap
📦 SCAP Security Guide (SSG)
Contains security rules
Examples:
CIS Benchmark
DISA STIG
NIST
PCI-DSS
HIPAA
📦 XCCDF
Extensible Configuration Checklist Description Format
Meaning:
Security checklist written in XML
Contains:
Rules
Profiles
Severity
Remediation
📦 OVAL
Open Vulnerability and Assessment Language
Purpose:
Checks actual system state
Examples:
File permission check
Package installed check
Service status check
📦 CPE
Common Platform Enumeration
Purpose:
Identifies operating system
Example:
Ubuntu 24.04
RHEL 9
📦 ARF
Asset Reporting Format
Purpose:
Stores scan results
File:
results.xml
🖥️ 2. Enterprise OpenSCAP Architecture
Security Team
|
|
v
SCAP Content Repository
|
Contains:
CIS Benchmark XML
DISA STIG XML
NIST XML
|
v
Linux Servers
|
OpenSCAP Scanner
oscap
|
v
Compliance Results
|
Reports
HTML Report
XML Report
ARF Report
|
v
Security Dashboard
Examples:
Red Hat Satellite
Foreman
OpenSCAP Workbench
SIEM Integration
🐧 3. Install OpenSCAP on Linux
RHEL / CentOS / Rocky Linux
Install packages:
dnf install scap-security-guide openscap-scanner -y
Verify installation:
rpm -qa | grep scap
Check oscap:
oscap --version
Binary location:
which oscap
Output example:
/usr/bin/oscap
Ubuntu / Debian
Update repository:
apt update
Install:
apt install openscap-scanner scap-security-guide -y
Verify:
oscap --version
📂 4. Important Enterprise Paths
OpenSCAP Binary
/usr/bin/oscap
SCAP Content
RHEL:
/usr/share/xml/scap/ssg/content/
Ubuntu:
/usr/share/xml/scap/ssg/content/
Main XML Files
ssg-rhel9-ds.xml
ssg-ubuntu2404-ds.xml
Scan Reports
/var/log/
/opt/scap-results/
Custom Content
/opt/security/scap/
📚 5. Understanding SCAP Content Files
Datastream File
Example:
ssg-ubuntu2404-ds.xml
Contains:
XCCDF
OVAL
CPE
Profiles
View Content
Command:
oscap info ssg-ubuntu2404-ds.xml
Shows:
Profiles
Rules
Standards
🔍 6. Security Profiles
What is Profile?
Collection of security rules
Examples:
CIS Level 1 Server
CIS Level 2 Server
DISA STIG
PCI DSS
NIST 800-53
List profiles
Command:
oscap info file.xml
Example:
xccdf_org.ssgproject.content_profile_cis
🧪 7. Running Compliance Scan
Step 1
Select profile
Example:
CIS Ubuntu
Profile:
cis
Step 2
Execute scan
Command:
oscap xccdf eval \
--profile cis \
--results scan-result.xml \
ssg-ubuntu2404-ds.xml
Meaning:
xccdf eval
Run compliance evaluation
--profile
Select benchmark
--results
Save XML result
XML file
Security checklist
📊 8. Generate HTML Report
Convert XML result:
oscap xccdf generate report \
scan-result.xml \
report.html
Open:
Firefox report.html
Enterprise use:
Send report to:
Security Team
Auditor
Compliance Team
🔧 9. Remediation / Auto Fix
Generate remediation script:
oscap xccdf generate fix \
--profile cis \
--fix-type bash \
scan-result.xml \
remediation.sh
Run:
chmod +x remediation.sh
./remediation.sh
Purpose:
Automatically fix failed controls
🛠️ 10. Understanding Scan Results
PASS
Control satisfied
FAIL
Security weakness exists
ERROR
Scanner problem
NOT APPLICABLE
Rule does not apply
Example:
Rule:
Ensure password minimum length
Result:
FAIL
Reason:
/etc/security/pwquality.conf incorrect
🔐 11. Enterprise Compliance Workflow
Phase 1
Asset Inventory
Collect:
Servers
OS Version
Applications
Phase 2
Select Benchmark
Examples:
CIS Linux
DISA STIG
NIST
Phase 3
Scan
oscap xccdf eval
Phase 4
Analyze Findings
Identify:
Failed controls
Risk
Phase 5
Remediation
Manual fix
Automated fix
Phase 6
Validation
Rescan
Phase 7
Reporting
Compliance evidence
🏢 12. Enterprise Automation
Using Ansible
Install OpenSCAP
Deploy content
Run scans
Collect reports
Example:
ansible-playbook openscap.yml
Cron Automation
Schedule:
crontab -e
Example:
0 2
* oscap xccdf eval
Meaning:
Every day at 2 AM run compliance scan
🧩 13. OpenSCAP Integration
SIEM Integration
Send results to:
Elastic SIEM
Splunk
QRadar
Vulnerability Management
Integrate with:
Nessus
Qualys
Tenable
Configuration Management
Integrate with:
Ansible
Puppet
Satellite
🔐 14. Enterprise Hardening Example
Control:
Disable root SSH login
CIS Rule:
SSH Root Login Disabled
Check:
grep PermitRootLogin /etc/ssh/sshd_config
Fix:
PermitRootLogin no
Restart:
systemctl restart sshd
Rescan:
oscap xccdf eval
📝 15. Custom OpenSCAP Rules
Create custom policy:
/opt/security/custom-rule/
Contains:
Custom XCCDF
Custom OVAL
Used for:
Company security standards
Example:
Company requires:
Password expiry = 60 days
SSH timeout = 10 minutes
📈 16. Enterprise Tools Around OpenSCAP
🔹 OpenSCAP Workbench
GUI tool
Create custom profiles
🔹 Red Hat Satellite
Enterprise compliance management
🔹 Ansible
Automated remediation
🔹 Foreman
Server lifecycle management
🎯 17. Real Enterprise Implementation Example
1000 Linux Servers
|
v
Install OpenSCAP
|
v
Deploy CIS Benchmark
|
v
Weekly Scan
|
v
Generate Reports
|
v
Send Failed Controls
|
v
Remediation
|
v
Rescan
|
v
Compliance Achieved
🏆 18. Skills Required for Enterprise OpenSCAP Engineer
Linux Administration
User management
Permissions
SELinux
SSH
Firewall
Security Frameworks
CIS Benchmark
NIST 800-53
DISA STIG
PCI-DSS
Automation
Bash
Python
Ansible
Reporting
XML
HTML
SIEM Integration
🚀 19. Practical Learning Lab Roadmap
Lab 1
Install Ubuntu Server
Lab 2
Install OpenSCAP
Lab 3
Explore SCAP content
Lab 4
Run CIS scan
Lab 5
Analyze failures
Lab 6
Fix manually
Lab 7
Generate remediation
Lab 8
Automate with Ansible
Lab 9
Integrate reports with SIEM
Lab 10
Enterprise compliance workflow