8.11. Scanning and Remediating Configuration Compliance of Container Images and Containers Using atomic scan

Procedure

1. List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:

   ~]# atomic help registry.access.redhat.com/rhel7/openscap

   Copy to Clipboard Toggle word wrap
   Verify compliance of the latest Red Hat Enterprise Linux 7 container image with the Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) policy and generate an HTML report from the scan:

   ~]# atomic scan --scan_type configuration_compliance --scanner_args xccdf-id=scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml,profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa,report registry.access.redhat.com/rhel7:latest

   Copy to Clipboard Toggle word wrap
   The output of the previous command contains the information about files associated with the scan at the end:

   ............
   
   Files associated with this scan are in /var/lib/atomic/openscap/2017-11-03-13-35-34-296606.
   
   ~]# tree /var/lib/atomic/openscap/2017-11-03-13-35-34-296606
   /var/lib/atomic/openscap/2017-11-03-13-35-34-296606
   ├── db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2
   │   ├── arf.xml
   │   ├── fix.sh
   │   ├── json
   │   └── report.html
   └── environment.json
   
   1 directory, 5 files

   Copy to Clipboard Toggle word wrap
   The atomic scan generates a subdirectory with all the results and reports from a scan in the /var/lib/atomic/openscap/ directory. The arf.xml file with results is generated on every scanning for configuration compliance. To generate a human-readable HTML report file, add the report suboption to the --scanner_args option.
2. Optional: To generate XCCDF results readable by DISA STIG Viewer, add the stig-viewer suboption to the --scanner_args option. The results are placed in stig.xml.

Procedure

1. List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:

   ~]# atomic help registry.access.redhat.com/rhel7/openscap

   Copy to Clipboard Toggle word wrap
2. To remediate container images to the specified policy, add the --remediate option to the atomic scan command when scanning for configuration compliance. The following command builds a new remediated container image compliant with the DISA STIG policy from the Red Hat Enterprise Linux 7 container image:

   ~]# atomic scan --remediate --scan_type configuration_compliance --scanner_args profile=xccdf_org.ssgproject.content_profile_stig-rhel7-disa,report registry.access.redhat.com/rhel7:latest 
   
   registry.access.redhat.com/rhel7:latest (db7a70a0414e589)
   
   The following issues were found:
   ............
   	 Configure Time Service Maxpoll Interval
   	 Severity: Low
   		 XCCDF result: fail
   
   	 Configure LDAP Client to Use TLS For All Transactions
   	 Severity: Moderate
   		 XCCDF result: fail
   ............
   Remediating rule 43/44: 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll'
   Remediating rule 44/44: 'xccdf_org.ssgproject.content_rule_ldap_client_start_tls'
   
   Successfully built 9bbc7083760e
   Successfully built remediated image 9bbc7083760e from db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2.
   
   Files associated with this scan are in /var/lib/atomic/openscap/2017-11-06-13-01-42-785000.
   

   Copy to Clipboard Toggle word wrap
3. Optional: The output of the atomic scan command reports a remediated image ID. To make the image easier to remember, tag it with some name, for example:

   ~]# docker tag 9bbc7083760e rhel7_disa_stig 

   Copy to Clipboard Toggle word wrap