Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

8.4. Using oscap

The oscap command-line utility allows users to scan their local systems, validate security compliance content, and generate reports and guides based on these scans and evaluations. This utility serves as a front end to the OpenSCAP library and groups its functionalities to modules (sub-commands) based on a type of the SCAP content it processes.
The following sections explain how to install oscap, perform the most common operations, and display the relevant examples for these tasks. To learn more about specific sub-commands, use the --help option with an oscap command: 
oscap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --helposcap [options] module module_operation [module_operation_options_and_arguments] --help
Copy to Clipboard Toggle word wrap
where module represents a type of SCAP content that is being processed, and module_operation is a sub-command for the specific operation on the SCAP content.

Example 8.4. Getting Help on the Specific oscap Operation

~]$ oscap ds sds-split --help
oscap -> ds -> sds-split

Split given SourceDataStream into separate files

Usage: oscap [options] ds sds-split [options] SDS TARGET_DIRECTORY

SDS - Source data stream that will be split into multiple files.
TARGET_DIRECTORY - Directory of the resulting files.

Options:
   --datastream-id <id>          - ID of the datastream in the collection to use.
   --xccdf-id <id>               - ID of XCCDF in the datastream that should be evaluated.
Copy to Clipboard Toggle word wrap
To learn about all oscap features and the complete list of its options, see the oscap(8) manual page.

8.4.1. Installing oscap
링크 복사

To install oscap to your system, run the following command as root: 
~]# yum install openscap-scanner
Copy to Clipboard Toggle word wrap
This command allows you to install all packages required by oscap to function properly, including the openscap package.
If you want to write your own security content, you should also install the openscap-engine-sce package that provides the Script Check Engine (SCE). SCE is an extension to SCAP protocol that allows content authors to write their security content using a scripting language, such as Bash, Python or Ruby. The openscap-engine-sce package can be installed in the same way as the openscap-scanner package, however, you need to have access to the repository or channel with optional packages for your Red Hat Enterprise Linux variant. If your system is registered with Red Hat Subscription Management, enable the rhel-6-variant-optional-rpms repository as described in the Yum chapter of Red Hat Enterprise Linux 6 Deployment Guide, where variant is your Red Hat Enterprise Linux variant, such as server, or workstation. If your system is registered with RHN Classic, subscribe the system to the rhel-architecture-variant-6-optional channel as documented here: https://access.redhat.com/site/solutions/9907.
Optionally, after installing oscap, you can check capabilities of your version of oscap, what specifications it supports, where the certain oscap files are stored, what kinds of SCAP objects you can use, and other useful information. To display this information, type the following command: 
~]$ oscap -V
OpenSCAP command line tool (oscap) 1.0.8
Copyright 2009--2014 Red Hat Inc., Durham, North Carolina.

==== Supported specifications ====
XCCDF Version: 1.2
OVAL Version: 5.10.1
CPE Version: 2.3
CVSS Version: 2.0
CVE Version: 2.0
Asset Identification Version: 1.1
Asset Reporting Format Version: 1.1

==== Capabilities added by auto-loaded plugins ====
SCE Version: 1.0 (from libopenscap_sce.so.8)

==== Paths ====
Schema files: /usr/share/openscap/schemas
Schematron files: /usr/share/openscap/xsl
Default CPE files: /usr/share/openscap/cpe
Probes: /usr/libexec/openscap

==== Inbuilt CPE names ====
Red Hat Enterprise Linux - cpe:/o:redhat:enterprise_linux
Red Hat Enterprise Linux 5 - cpe:/o:redhat:enterprise_linux:5
Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6
Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7
Fedora 16 - cpe:/o:fedoraproject:fedora:16
Fedora 17 - cpe:/o:fedoraproject:fedora:17
Fedora 18 - cpe:/o:fedoraproject:fedora:18
Fedora 19 - cpe:/o:fedoraproject:fedora:19
Fedora 20 - cpe:/o:fedoraproject:fedora:20
Fedora 21 - cpe:/o:fedoraproject:fedora:21
Red Hat Enterprise Linux Optional Productivity Applications - cpe:/a:redhat:rhel_productivity
Red Hat Enterprise Linux Optional Productivity Applications 5 - cpe:/a:redhat:rhel_productivity:5

==== Supported OVAL objects and associated OpenSCAP probes ====
system_info                  probe_system_info           
family                       probe_family                
filehash                     probe_filehash              
environmentvariable          probe_environmentvariable   
textfilecontent54            probe_textfilecontent54     
textfilecontent              probe_textfilecontent       
variable                     probe_variable              
xmlfilecontent               probe_xmlfilecontent        
environmentvariable58        probe_environmentvariable58 
filehash58                   probe_filehash58            
inetlisteningservers         probe_inetlisteningservers  
rpminfo                      probe_rpminfo               
partition                    probe_partition             
iflisteners                  probe_iflisteners           
rpmverify                    probe_rpmverify             
rpmverifyfile                probe_rpmverifyfile         
rpmverifypackage             probe_rpmverifypackage      
selinuxboolean               probe_selinuxboolean        
selinuxsecuritycontext       probe_selinuxsecuritycontext
file                         probe_file                  
interface                    probe_interface             
password                     probe_password              
process                      probe_process               
runlevel                     probe_runlevel              
shadow                       probe_shadow                
uname                        probe_uname                 
xinetd                       probe_xinetd                
sysctl                       probe_sysctl                
process58                    probe_process58             
fileextendedattribute        probe_fileextendedattribute 
routingtable                 probe_routingtable
Copy to Clipboard Toggle word wrap
Before you can start using the oscap utility effectively, you also have to install or import some security content on your system. You can download the SCAP content from the respective web site, or if specified as an RPM file or package, you can install it from the specified location, or known repository, using the Yum package manager.
For example, to install the SCAP Security Guide (SSG) package that contains the latest set of security polices for Linux systems, run the following command: 
~]# yum install scap-security-guide
Copy to Clipboard Toggle word wrap
After you install the scap-security-guide package on your system, unless specified otherwise, the SSG security content is available under the /usr/share/xml/scap/ssg/content/ directory, and you can proceed with other security compliance operations.
To find out other possible sources of existing SCAP content that might suit your needs, see Section 8.8, “Additional Resources”.
After installing the SCAP content on your system, oscap can process the content by specifying the file path to the content. The oscap utility supports SCAP version 1.2 and is backward compatible with SCAP versions 1.1 and 1.0 so it can process earlier versions of the SCAP content without any special requirements.
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat