System Security via OpenSCAP
Uyuni uses OpenSCAP to audit clients. It allows you to schedule and view compliance scans for any client.
OpenSCAP auditing is available for use with traditional clients only. It is not available on Salt clients. |
To use openSCAP, you will need the spacewalk-oscap
package installed on the clients you want to audit.
About SCAP
The Security Certification and Authorization Package (SCAP) is a standardized compliance checking solution for enterprise-level Linux infrastructures. It is a line of specifications maintained by the National Institute of Standards and Technology (NIST) for maintaining system security for enterprise systems.
SCAP was created to provide a standardized approach to maintaining system security, and the standards that are used will therefore continually change to meet the needs of the community and enterprise businesses. New specifications are governed by NIST’s SCAP Release cycle to provide a consistent and repeatable revision work flow. For more information, see http://scap.nist.gov/timeline.html.
Uyuni uses OpenSCAP to implement the SCAP specifications. OpenSCAP is an auditing tool that utilizes the Extensible Configuration Checklist Description Format (XCCDF). XCCDF is a standard way of expressing checklist content and defines security checklists. It also combines with other specifications such as Common Platform Enumeration (CPE), Common Configuration Enumeration (CCE), and Open Vulnerability and Assessment Language (OVAL), to create a SCAP-expressed checklist that can be processed by SCAP-validated products.
OpenSCAP verifies the presence of patches by using content produced by the SUSE Security Team. OpenSCAP checks system security configuration settings and examines systems for signs of compromise by using rules based on standards and specifications. For more information about the SUSE Security Team, see https://www.suse.com/support/security.
Prepare Clients for an SCAP Scan
Before you begin, you need to prepare your client systems for SCAP scanning.
Ensure clients have the openscap-content
and openscap-utils
packages installed before you begin.
Use this command to determine the location of the appropriate SCAP files. Take a note of these paths for performing the scan:
+
rpm -ql openscap-content
+ The output should include these files:
+
/usr/share/openscap/scap-oval.xml /usr/share/openscap/scap-xccdf.xml /usr/share/openscap/scap-yast2sec-oval.xml /usr/share/openscap/scap-yast2sec-xccdf.xml
OpenSCAP Content Files
OpenSCAP uses SCAP content files to define test rules.
These content files are created based on the XCCDF or OVAL standards.
You can download publicly available content files and customize it to your requirements.
You can install the openscap-content
package for default content file templates.
Alternatively, if you are familiar with XCCDF or OVAL, you can create your own content files.
We recommend you use templates to create your SCAP content files. If you create and use your own custom content files, you do so at your own risk. If your system becomes damaged through the use of custom content files, you might not be supported by SUSE. |
When you have created your content files, you need to transfer the file to the client.
You can do this in the same way as you move any other file, using physical storage media, or across a network with ftp
or scp
.
We recommend that you create a package to distribute content files to clients that you are managing with Uyuni. Packages can be signed and verified to ensure their integrity. For more information, see Custom Channels.
Perform an Audit Scan
When you have transferred your content files, you can perform audit scans. Audit scans can be triggered using the Uyuni Web UI. You can also use the Uyuni API to schedule regular scans.
-
In the Uyuni Web UI, navigate to
and select the client you want to scan. -
Navigate to the
Audit
tab, and theSchedule
subtab. -
In the
Path to XCCDF Document
field, enter the path to the XCCDF content file on the client. For example:/usr/share/openscap/scap-yast2sec-xccdf.xml
-
The scan will run at the client’s next scheduled synchronization.
The XCCDF content file is validated before it is run on the remote system. If the content file includes invalid arguments, the test will fail.
-
Before you begin, ensure that the client to be scanned has Python and XML-RPC libraries installed.
-
Choose an existing script or create a script for scheduling a system scan through
system.scap.scheduleXccdfScan
. For example:#!/usr/bin/python client = xmlrpclib.Server('https://spacewalk.example.com/rpc/api') key = client.auth.login('username', 'password') client.system.scap.scheduleXccdfScan(key, <1000010001>, '<path_to_xccdf_file.xml>', '--profile <profile_name>')
In this example: *
<1000010001>
is the system ID (sid). *<path_to_xccdf_file.xml>
is the path to the content file location on the client. For example,/usr/local/share/scap/usgcb-sled15desktop-xccdf.xml
. *<profile_name>
is an additional argument for theoscap
command. For example, useunited_states_government_configuration_baseline
(USGCB). -
Run the script on the client you want to scan, from the command prompt.
Scan Results
Information about the scans you have run is in the Uyuni Web UI. Navigate to to All Scans.
for a table of results. For more information about the data in this table, seeTo ensure that detailed information about scans is available, you need to enable it on the client.
In the Uyuni Web UI, navigate to Configuration
tab, and check the Enable Upload of Detailed SCAP Files
option.
When enabled, this generates an additional HTML file on every scan, which contains extra information.
The results will show an extra line similar to this:
Detailed Results: xccdf-report.html xccdf-results.xml scap-yast2sec-oval.xml.result.xml
To retrieve scan information from the command line, use the spacewalk-report
command:
spacewalk-report system-history-scap spacewalk-report scap-scan spacewalk-report scap-scan-results
You can also use the Uyuni API to view results, with the system.scap
handler.