Managing security compliance

Procedure

1. Access the SCAP Security Guide in the package browser.
2. From the Version menu, select the latest SSG version for the minor version of RHEL that your hosts are running. For example, for RHEL 8.6, select a version named *.el8_6.
3. Download the package RPM.

4. Extract the data-stream file (*-ds.xml) from the RPM. For example:

   $ rpm2cpio scap-security-guide-0.1.69-3.el8_6.noarch.rpm \
   | cpio -iv --to-stdout ./usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
   > ssg-rhel-8.6-ds.xml

5. Upload the data stream to Satellite. For more information, see Section 7.3, “Uploading additional SCAP content”.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > SCAP contents.
2. Click Upload New SCAP Content.
3. Enter a title in the Title text box, such as My SCAP Content.
4. In Scap File, click Choose file, navigate to the location containing a SCAP data-stream file and click Open.
5. On the Locations tab, select locations.
6. On the Organizations tab, select organizations.
7. Click Submit.

CLI procedure

1. Place the SCAP data-stream file to a directory on your Satellite Server, such as /usr/share/xml/scap/my_content/.

2. Run the following Hammer command on Satellite Server:

   # hammer scap-content bulk-upload --type directory \
   --directory /usr/share/xml/scap/my_content/ \
   --location "My_Location" \
   --organization "My_Organization"

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Tailoring Files and click New Tailoring File.
2. Enter a name in the Name text box.
3. Click Choose File, navigate to the location containing the tailoring file and select Open.
4. Click Submit to upload the chosen tailoring file.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
2. Click New Policy or New Compliance Policy.
3. Select the deployment method: Ansible, Puppet, or Manual. Then click Next.
4. Enter a name for this policy, a description (optional), then click Next.

5. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

   Note that Satellite does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the Default XCCDF Profile, will return empty reports.

6. Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.

7. Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.

   • If you select Weekly, also select the desired day of the week from the Weekday list.
   • If you select Monthly, also specify the desired day of the month in the Day of month field.
   • If you select Custom, enter a valid Cron expression in the Cron line field.
8. Select the locations to which to apply the policy, then click Next.
9. Select the organizations to which to apply the policy, then click Next.
10. Optional: Select the host groups to which to assign the policy.
11. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
2. In the Actions column of the required policy, click Show Guide or select it from the list.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
2. Click the name of the required policy.
3. Edit the necessary attributes.
4. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
2. In the Actions column of the required policy, select Delete from the list.
3. Click OK in the confirmation message.

Procedure

1. On your Satellite Server, examine the data stream you use in your compliance policy to find out which missing resource you must download:

   # oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml | grep "WARNING"
   WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2'
   points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'.
   Use '--fetch-remote-resources' option to download it.
   WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file
   which is referenced from datastream

2. Examine the name of the local file that is referenced by the data stream:

   # oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
   ...
   		Referenced check files:
   			ssg-rhel8-oval.xml
   				system: http://oval.mitre.org/XMLSchema/oval-definitions-5
   			ssg-rhel8-ocil.xml
   				system: http://scap.nist.gov/schema/ocil/2
   			security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2
   				system: http://oval.mitre.org/XMLSchema/oval-definitions-5
   ...

3. On an online machine, download the missing resource:

   # curl -o security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2

   Important

   Ensure that the name of the downloaded file matches the name the data stream references.

4. Add the file as new custom file type content into your Satellite Server. For more information, see Managing custom file type content in Managing content.

   Note the URL on which your repository is published, such as http://satellite.example.com/pulp/content/My_Organization_Label/Library/custom/My_Product_Label/My_Repo_Label/.

5. Schedule a remote job to upload the file to the home directory of root on your host. For example, use the Run Command - Script Default job template and enter the following command:

   # curl -o /root/security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 http://satellite.example.com/pulp/content/My_Organization_Label/Library/custom/My_Product_Label/My_Repo_Label/security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2

   For more information about running remote jobs, see Executing a Remote Job in Managing hosts.

6. Continue with deploying your compliance policy.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. Click the host group that you want to configure for OpenSCAP reporting.
3. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
4. On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role.
5. Optional: On the Parameters tab, configure any Ansible variables of the role.
6. Click Submit to save your changes.
7. In the row of the required host group, navigate to the Actions column and select Run all Ansible roles.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.
2. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
3. On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role.
4. Optional: On the Parameters tab, configure any Ansible variables of the role.
5. Click Submit to save your changes.
6. Click the Hosts breadcrumbs link to navigate back to the host index page.
7. Select the host or hosts to which you want to add the policy.
8. Click Select Action.
9. Select Assign Compliance Policy from the list.
10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.
11. Select the required policy from the list of available policies and click Submit.
12. Click Select Action.
13. Select Run all Ansible roles from the list.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. Click the host group that you want to configure for OpenSCAP reporting.
3. In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes.
4. In the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
5. On the Puppet ENC tab, add the foreman_scap_client Puppet class.
6. Optional: Configure any Puppet Class Parameters.
7. Click Submit to save your changes.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.
2. From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes.
3. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use.
4. On the Puppet ENC tab, add the foreman_scap_client Puppet class.
5. Optional: Configure any Puppet Class Parameters.
6. Click the Hosts breadcrumbs link to navigate back to the host index page.
7. Select the host or hosts to which you want to add the policy.
8. Click Select Action.
9. Select Assign Compliance Policy from the list.
10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.
11. Select the required policy from the list of available policies and click Submit.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Reports.
2. Optional: To see a list of available search parameters, click the empty Search field.
3. Enter the search query in the Search field and click Search. The search query is case insensitive.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Policies.
2. In the row of the required policy, navigate to the Actions column and click Dashboard.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Reports.
2. In the Reported At column, navigate to the report of the required host and compliance policy, and click the time link.
3. Satellite displays a simplified list of policy rules with the results of the scan.

4. Optional: Filter the rules by check result. From the Show log messages dropdown list, select one of the following filters:

   • Failed and othered – to view rules that have failed or have not been checked during the scan,
   • Failed only – to view only rules that have failed.
5. Optional: Examine the details of the rule. In the Message column, click the icon next to the name of the rule.
6. In the row of the required rule, navigate to the Actions column and click Hosts failing this rule.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Reports to list all compliance reports.
2. In the row of the required host, navigate to the Actions column and click Full Report to view the complete details of an evaluation report.
3. Navigate to the Evaluation Characteristics area to review basic details about the evaluation of the host against a specific profile.
4. Navigate to the Compliance and Scoring area to review evaluation statistics and the host compliance score.
5. Navigate to the Rule Overview to examine the rules.
6. Optional: Deselect the check statuses that you want to hide, such as pass, notapplicable, or fixed.
7. Optional: From the Group rule by dropdown menu, select the criterion for the grouping of rules, such as Severity.
8. Optional: Enter a search string into the search field to filter rules by title. The search is case insensitive and applied dynamically as you type.

9. Click the title of a rule to inspect further result details:

   • A description of the rule with instructions for bringing the host into compliance if available.
   • The rationale for the rule.
   • In some cases, a remediation script.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Reports.
2. In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.
3. Click OK.

Procedure

1. In the Satellite web UI, navigate to Hosts > Compliance > Reports.
2. In the Compliance Reports window, select the compliance reports that you want to delete.
3. In the upper right of the list, select Delete reports.
4. Repeat these steps for as many pages as you want to delete.