s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

oscap

OpenSCAP: check RHEL systems and images against security profiles (CIS, DISA STIG, PCI-DSS, ANSSI) and generate fixes.

المستوى
خدمة DevSecOps
المجموعة
الفحص الأمني والتقوية
يحتاج root
نعم
الحزمة
openscap-scanner

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

oscap evaluates SCAP content: the SCAP Security Guide package (scap-security-guide) ships data streams with profiles for each RHEL version. A scan gives an HTML report with pass/fail per rule and can create remediation as a Bash script, an Ansible playbook or a blueprint for image builder. oscap-podman scans container images; the RHEL installer can apply a profile at install time.

This is the Red Hat way to show compliance to auditors.

طريقة الكتابة

oscap xccdf eval --profile PROFILE [--results FILE] [--report FILE] DATASTREAM
oscap info DATASTREAM

الأجزاء الرئيسية

Commands

info FILE
List profiles in a data stream.
xccdf eval
Run a scan.
xccdf generate fix
Make a remediation script/playbook.
xccdf generate guide
Make a guide (all rules of a profile).
oval eval
Run OVAL checks (e.g. CVE data).
oscap-podman IMAGE xccdf eval …
Scan a container image.

الخيارات 7

الأكثر استخدامًا

Flags

--profile ID
Profile (e.g. xccdf_org.ssgproject.content_profile_cis).
--results FILE.xml
ARF/XCCDF results.
--report FILE.html
HTML report.
--remediate
Fix while scanning (careful!).
--fix-type bash|ansible|blueprint
Kind of fix (generate fix).
--rule ID
Only one rule.
--tailoring-file FILE
Your changes to a profile.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1Install and list the profiles

    dnf install -y openscap-scanner scap-security-guide
oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml | grep -i "profile" | head -30

  2. 2Scan against CIS Level 1 Server

    oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --results results.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

  3. 3Count failed rules

    grep -c 'result>fail<' results.xml
xmllint --xpath "count(//*[local-name()='rule-result'][*[local-name()='result']='fail'])" results.xml

  4. 4Make an Ansible playbook with the fixes

    oscap xccdf generate fix --fix-type ansible --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --output cis-fix.yml /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
ansible-playbook -i inventory.ini cis-fix.yml --check

  5. 5Fixes only for the failed rules

    oscap xccdf generate fix --fix-type bash --result-id xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_cis_server_l1 --output fix-failed.sh results.xml

  6. 6Check one rule only

    oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --rule xccdf_org.ssgproject.content_rule_sshd_disable_root_login /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

  7. 7Scan a container image

    oscap-podman registry.access.redhat.com/ubi9/ubi:latest xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --report ubi9.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

  8. 8Check for known CVEs (Red Hat OVAL)

    curl -sO https://security.access.redhat.com/data/oval/v2/RHEL9/rhel-9.oval.xml.bz2 && bunzip2 rhel-9.oval.xml.bz2
oscap oval eval --report cve-report.html rhel-9.oval.xml

  9. 9Use the graphical workbench to tailor a profile

    dnf install -y scap-workbench

  10. 10Apply a profile at install time (kickstart)

    cat ks.cfg
%addon com_redhat_oscap
    content-type = scap-security-guide
    profile = xccdf_org.ssgproject.content_profile_cis_server_l1
%end

انتبه

  • --remediate changes the system at once (SSH, passwords, mounts) — test on a copy first.
  • Profiles are long; tailor them (skip rules that do not fit) and document why.

الملفات

/usr/share/xml/scap/ssg/content/
Data streams (ssg-rhel9-ds.xml, ssg-rhel10-ds.xml).

نصائح للحفظ

  • Run the scan in CI on the golden image; keep the HTML reports as evidence for audits.

رموز الخروج

0All rules passed.
1Error.
2At least one rule failed (or unknown).

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man 8 oscap

افتح صفحة man (linux.die.net)www.redhat.com