SupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 8. Managing compliance policies

A compliance policy is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content.

You specify the schedule for scans on Satellite Server and the scans are performed on hosts. When a scan completes, a report in ARF format is generated and uploaded to Satellite Server. The compliance policy makes no changes to the scanned host.

A compliance policy defines a SCAP client configuration and a cron schedule. The policy is then deployed together with the SCAP client on hosts to which the policy is assigned.

8.1. Creating a compliance policy

By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies.

Prerequisites

Procedure

  1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
  2. Click New Policy or New Compliance Policy.
  3. Select the deployment method: Ansible, Puppet, or Manual. Then click Next.
  4. Enter a name for this policy, a description (optional), then click Next.

  5. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

    Note that Satellite does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the Default XCCDF Profile, will return empty reports.

  6. Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.

  7. Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.

    • If you select Weekly, also select the desired day of the week from the Weekday list.
    • If you select Monthly, also specify the desired day of the month in the Day of month field.
    • If you select Custom, enter a valid Cron expression in the Cron line field.
  8. Select the locations to which to apply the policy, then click Next.
  9. Select the organizations to which to apply the policy, then click Next.
  10. Optional: Select the host groups to which to assign the policy.
  11. Click Submit.

8.2. Viewing a compliance policy

You can preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when you plan policies.

Prerequisites

  • Your user account has a role assigned that has the view_policies permission.

Procedure

  1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
  2. In the Actions column of the required policy, click Show Guide or select it from the list.

8.3. Editing a compliance policy

In the Satellite web UI, you can edit compliance policies.

Puppet agent applies an edited policy to the host on the next run. By default, this occurs every 30 minutes. If you use Ansible, you must run the Ansible role manually again or have configured a recurring remote execution job that runs the Ansible role on hosts.

Prerequisites

  • Your user account has a role assigned that has the view_policies and edit_policies permissions.

Procedure

  1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
  2. Click the name of the required policy.
  3. Edit the necessary attributes.
  4. Click Submit.

8.4. Deleting a compliance policy

In the Satellite web UI, you can delete existing compliance policies.

Prerequisites

  • Your user account has a role assigned that has the view_policies and destroy_policies permissions.

Procedure

  1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
  2. In the Actions column of the required policy, select Delete from the list.
  3. Click OK in the confirmation message.
Red Hat logoGithubRedditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

© 2024 Red Hat, Inc.