Chapter 9. Deploying Compliance Policies

Procedure

1. On your Satellite Server, examine the data stream you use in your compliance policy to find out which missing resource you must download:

   # oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml | grep "WARNING"
   WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2'
   points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'.
   Use '--fetch-remote-resources' option to download it.
   WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file
   which is referenced from datastream

2. Examine the name of the local file that is referenced by the data stream:

   # oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
   ...
   		Referenced check files:
   			ssg-rhel8-oval.xml
   				system: http://oval.mitre.org/XMLSchema/oval-definitions-5
   			ssg-rhel8-ocil.xml
   				system: http://scap.nist.gov/schema/ocil/2
   			security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2
   				system: http://oval.mitre.org/XMLSchema/oval-definitions-5
   ...

3. On an online machine, download the missing resource:

   # curl -o security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2

   Important

   Ensure that the name of the downloaded file matches the name the data stream references.

4. Add the file as new custom file type content into your Satellite Server. For more information, see Managing Custom File Type Content in Managing Content.

   Note the URL on which your repository is published, such as http://satellite.example.com/pulp/content/My_Organization_Label/Library/custom/My_Product_Label/My_Repo_Label/.

5. Schedule a remote job to upload the file to the home directory of root on your host. For example, use the Run Command - Script Default job template and enter the following command:

   # curl -o /root/security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 http://satellite.example.com/pulp/content/My_Organization_Label/Library/custom/My_Product_Label/My_Repo_Label/security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2

   For more information about running remote jobs, see Executing a Remote Job in Managing Hosts.

6. Continue with deploying your compliance policy.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. Click the host group that you want to configure for OpenSCAP reporting.
3. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
4. On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role.
5. Optional: On the Parameters tab, configure any Ansible variables of the role.
6. Click Submit to save your changes.
7. In the row of the required host group, navigate to the Actions column and select Run all Ansible roles.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.
2. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
3. On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role.
4. Optional: On the Parameters tab, configure any Ansible variables of the role.
5. Click Submit to save your changes.
6. Click the Hosts breadcrumbs link to navigate back to the host index page.
7. Select the host or hosts to which you want to add the policy.
8. Click Select Action.
9. Select Assign Compliance Policy from the list.
10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.
11. Select the required policy from the list of available policies and click Submit.
12. Click Select Action.
13. Select Run all Ansible roles from the list.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. Click the host group that you want to configure for OpenSCAP reporting.
3. In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes.
4. In the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
5. On the Puppet ENC tab, add the foreman_scap_client Puppet class.
6. Optional: Configure any Puppet Class Parameters.
7. Click Submit to save your changes.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.
2. From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes.
3. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
4. On the Puppet ENC tab, add the foreman_scap_client Puppet class.
5. Optional: Configure any Puppet Class Parameters.
6. Click the Hosts breadcrumbs link to navigate back to the host index page.
7. Select the host or hosts to which you want to add the policy.
8. Click Select Action.
9. Select Assign Compliance Policy from the list.
10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.
11. Select the required policy from the list of available policies and click Submit.