Red Hat Summit8.4.6. Using OpenSCAP to Remediate the System
OpenSCAP allows to automatically remediate systems that have been found in a non-compliant state. For system remediation, an XCCDF file with instructions is required. The scap-security-guide package constains certain remediation instructions.
System remediation consists of the following steps:
- OpenSCAP performs a regular XCCDF evaluation.
- An assessment of the results is performed by evaluating the OVAL definitions. Each rule that has failed is marked as a candidate for remediation.
- OpenSCAP searches for an appropriate fix element, resolves it, prepares the environment, and executes the fix script.
- Any output of the fix script is captured by OpenSCAP and stored within the
rule-resultelement. The return value of the fix script is stored as well. - Whenever OpenSCAP executes a fix script, it immediatelly evaluates the OVAL definition again (to verify that the fix script has been applied correctly). During this second run, if the OVAL evaluation returns success, the result of the rule is
fixed, otherwise it is anerror. - Detailed results of the remediation are stored in an output XCCDF file. It contains two
TestResultelements. The firstTestResultelement represents the scan prior to the remediation. The secondTestResultis derived from the first one and contains remediation results.
There are three modes of operation of OpenSCAP with regard to remediation: online, offline, and review.
8.4.6.1. OpenSCAP Online Remediation
Online remediation executes fix elements at the time of scanning. Evaluation and remediation are performed as a part of a single command.
To enable online remediation, use the
--remediate command-line option. For example, to execute online remediation using the scap-security-guide package, run:
~]$oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_rht-ccp --results scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml
The output of this command consists of two sections. The first section shows the result of the scan prior to the remediation, and the second section shows the result of the scan after applying the remediation. The second part can contain only
fixed and error results. The fixed result indicates that the scan performed after the remediation passed. The error result indicates that even after applying the remediation, the evaluation still does not pass.
