6.3.2. Creating a Compliance Policy
With Satellite 6, you can create a compliance policy to scan your content hosts to ensure that the hosts remain compliant to your security requirements.
You can use either Puppet or Ansible to deploy the compliance policy to your hosts. Note that Puppet runs by default every 30 minutes. If you assign a new policy, the next Puppet run synchronizes the policy to the host. However Ansible does not perform scheduled runs. To add a new policy, you must run Ansible role manually or using remote execution. For more information about remote execution, see Configuring and Setting up Remote Jobs in the Managing Hosts guide.
Prerequisites
Before you begin, you must decide whether you want to use a Puppet or Ansible deployment.
- For Puppet deployment, ensure that each host that you want to audit is associated with a Puppet environment. For more information, see 「Importing OpenSCAP Puppet Modules」.
-
For Ansible deployment, ensure that you import the
theforeman.foreman_scap_client
Ansible role. For more information about importing Ansible roles, see Getting Started with Ansible in Satellite in Configuring Satellite to use Ansible.
Procedure
- Navigate to Hosts > Policies, and select whether you want a manual, Ansible, or Puppet deployment.
- Enter a name for this policy, a description (optional), then click Next.
Select the SCAP Content and XCCDF Profile to be applied, then click Next.
Until BZ#1704582 is resolved, note that the
Default XCCDF Profile
might return an empty report.Specify the scheduled time when the policy is to be applied, then click Next.
Select Weekly, Monthly, or Custom from the Period list.
- If you select Weekly, also select the desired day of the week from the Weekday list.
- If you select Monthly, also specify the desired day of the month in the Day of month field.
If you select Custom, enter a valid Cron expression in the Cron line field.
The Custom option allows for greater flexibility in the policy’s schedule than either the Weekly or Monthly options.
- Select the locations to which the policy is to be applied, then click Next.
- Select the organizations to which the policy is to be applied, then click Next.
- Select the host groups to which the policy is to be applied, then click Submit.
When the Puppet agent runs on the hosts which belong to the selected host group, or hosts to which the policy has been applied, the OpenSCAP client will be installed and a Cron job added with the policy’s specified schedule. The SCAP Content
tab provides the name of the SCAP content file which will be distributed to the directory /var/lib/openscap/content/
on all target hosts.