Ce contenu n'est pas disponible dans la langue sélectionnée.
8.11. Scanning and Remediating Configuration Compliance of Container Images and Containers Using atomic scan
8.11.1. Scanning for Configuration Compliance of Container Images and Containers Using atomic scan
Use this type of scanning to evaluate Red Hat Enterprise Linux-based container images and containers with the SCAP content provided by the SCAP Security Guide (SSG) bundled inside the OpenSCAP container image. This enables scanning against any profile provided by the SCAP Security Guide.
Warning
The
atomic scan
functionality is deprecated, and the OpenSCAP container image is no longer updated with the new security compliance content. Therefore, prefer the oscap-docker
utility for security compliance scanning purposes.
Note
For a detailed description of the usage of the
atomic
command and containers, see the Product Documentation for Red Hat Enterprise Linux Atomic Host 7. The Red Hat Customer Portal also provides a guide to the atomic
command-line interface (CLI).
Prerequisites
- You have downloaded and installed the OpenSCAP container image from Red Hat Container Catalog (RHCC) using the
atomic install rhel7/openscap
command.
Procedure
- List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:
~]#
atomic help registry.access.redhat.com/rhel7/openscapVerify compliance of the latest Red Hat Enterprise Linux 7 container image with the Defense Information Systems Agency Security Technical Implementation Guide (DISA STIG) policy and generate an HTML report from the scan:~]#
atomic scan--scan_type
configuration_compliance--scanner_args
xccdf-id=
scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml,profile=
xccdf_org.ssgproject.content_profile_stig-rhel7-disa,report
registry.access.redhat.com/rhel7:latestThe output of the previous command contains the information about files associated with the scan at the end:............ Files associated with this scan are in /var/lib/atomic/openscap/2017-11-03-13-35-34-296606.
~]#
tree
/var/lib/atomic/openscap/2017-11-03-13-35-34-296606 /var/lib/atomic/openscap/2017-11-03-13-35-34-296606 ├── db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2 │ ├── arf.xml │ ├── fix.sh │ ├── json │ └── report.html └── environment.json 1 directory, 5 filesTheatomic scan
generates a subdirectory with all the results and reports from a scan in the /var/lib/atomic/openscap/ directory. The arf.xml file with results is generated on every scanning for configuration compliance. To generate a human-readable HTML report file, add thereport
suboption to the--scanner_args
option. - Optional: To generate XCCDF results readable by DISA STIG Viewer, add the
stig-viewer
suboption to the--scanner_args
option. The results are placed in stig.xml.
Note
When the
xccdf-id
suboption of the --scanner_args
option is omitted, the scanner searches for a profile in the first XCCDF component of the selected data stream file. For more details about data stream files, see Section 8.3.1, “Configuration Compliance in RHEL 7”.
8.11.2. Remediating Configuration Compliance of Container Images and Containers Using atomic scan
You can run the configuration compliance scan against the original container image to check its compliance with the DISA STIG policy. Based on the scan results, a fix script containing bash remediations for the failed scan results is generated. The fix script is then applied to the original container image - this is called a remediation. The remediation results in a container image with an altered configuration, which is added as a new layer on top of the original container image.
Important
Note that the original container image remains unchanged and only a new layer is created on top of it. The remediation process builds a new container image that contains all the configuration improvements. The content of this layer is defined by the security policy of scanning - in the previous case, the DISA STIG policy. This also means that the remediated container image is no longer signed by Red Hat, which is expected, because it differs from the original container image by containing the remediated layer.
Warning
The
atomic scan
functionality is deprecated, and the OpenSCAP container image is no longer updated with the new security compliance content. Therefore, prefer the oscap-docker
utility for security compliance scanning purposes.
Prerequisites
- You have downloaded and installed the OpenSCAP container image from Red Hat Container Catalog (RHCC) using the
atomic install rhel7/openscap
command.
Procedure
- List SCAP content provided by the OpenSCAP image for the configuration_compliance scan:
~]#
atomic help registry.access.redhat.com/rhel7/openscap - To remediate container images to the specified policy, add the
--remediate
option to theatomic scan
command when scanning for configuration compliance. The following command builds a new remediated container image compliant with the DISA STIG policy from the Red Hat Enterprise Linux 7 container image:~]#
atomic scan--remediate
--scan_type
configuration_compliance--scanner_args
profile=
xccdf_org.ssgproject.content_profile_stig-rhel7-disa,report
registry.access.redhat.com/rhel7:latest registry.access.redhat.com/rhel7:latest (db7a70a0414e589) The following issues were found: ............ Configure Time Service Maxpoll Interval Severity: Low XCCDF result: fail Configure LDAP Client to Use TLS For All Transactions Severity: Moderate XCCDF result: fail ............ Remediating rule 43/44: 'xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll' Remediating rule 44/44: 'xccdf_org.ssgproject.content_rule_ldap_client_start_tls' Successfully built 9bbc7083760e Successfully built remediated image 9bbc7083760e from db7a70a0414e589d7c8c162712b329d4fc670fa47ddde721250fb9fcdbed9cc2. Files associated with this scan are in /var/lib/atomic/openscap/2017-11-06-13-01-42-785000. - Optional: The output of the
atomic scan
command reports a remediated image ID. To make the image easier to remember, tag it with some name, for example:~]#
dockertag
9bbc7083760e rhel7_disa_stig