Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
oscap evaluates SCAP content: the SCAP Security Guide package (scap-security-guide) ships data streams with profiles for each RHEL version. A scan gives an HTML report with pass/fail per rule and can create remediation as a Bash script, an Ansible playbook or a blueprint for image builder. oscap-podman scans container images; the RHEL installer can apply a profile at install time.
This is the Red Hat way to show compliance to auditors.
Zo schrijf je het
oscap xccdf eval --profile PROFILE [--results FILE] [--report FILE] DATASTREAM
oscap info DATASTREAMBelangrijkste delen
Commands
infoFILE- List profiles in a data stream.
xccdfeval- Run a scan.
xccdfgeneratefix- Make a remediation script/playbook.
xccdfgenerateguide- Make a guide (all rules of a profile).
ovaleval- Run OVAL checks (e.g. CVE data).
oscap-podmanIMAGExccdfeval…- Scan a container image.
Opties 7
Meest gebruikt
Flags
Niets past bij dit filter.
Voorbeelden 10
$ als gewone gebruiker# als root (of met sudo)
1Install and list the profiles
2Scan against CIS Level 1 Server
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --results results.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml3Count failed rules
grep -c 'result>fail<' results.xml xmllint --xpath "count(//*[local-name()='rule-result'][*[local-name()='result']='fail'])" results.xml4Make an Ansible playbook with the fixes
oscap xccdf generate fix --fix-type ansible --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --output cis-fix.yml /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml ansible-playbook -i inventory.ini cis-fix.yml --check5Fixes only for the failed rules
oscap xccdf generate fix --fix-type bash --result-id xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_cis_server_l1 --output fix-failed.sh results.xml6Check one rule only
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --rule xccdf_org.ssgproject.content_rule_sshd_disable_root_login /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml7Scan a container image
oscap-podman registry.access.redhat.com/ubi9/ubi:latest xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --report ubi9.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml8Check for known CVEs (Red Hat OVAL)
9Use the graphical workbench to tailor a profile
dnf install -y scap-workbench10Apply a profile at install time (kickstart)
cat ks.cfg %addon com_redhat_oscap content-type = scap-security-guide profile = xccdf_org.ssgproject.content_profile_cis_server_l1 %end
Niets past bij dit filter.
Let op
--remediatechanges the system at once (SSH, passwords, mounts) — test on a copy first.- Profiles are long; tailor them (skip rules that do not fit) and document why.
Bestanden
/usr/share/xml/scap/ssg/content/- Data streams (ssg-rhel9-ds.xml, ssg-rhel10-ds.xml).
Tips om te onthouden
- Run the scan in CI on the golden image; keep the HTML reports as evidence for audits.
Exitcodes
0 | All rules passed. |
1 | Error. |
2 | At least one rule failed (or unknown). |