이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 9. Propagating SCAP content through the load balancer
If you use OpenSCAP to manage security compliance on your clients, you must configure the SCAP client to send ARF reports to the load balancer instead of Capsule. The configuration procedure depends on the method you have selected to deploy compliance policies.
9.1. Propagating SCAP content using Ansible deployment
Using this procedure, you can promote Security Content Automation Protocol (SCAP) content through the load balancer in the scope of the Ansible deployment method.
Prerequisites
- Ensure that you have configured Satellite for Ansible deployment of compliance policies. For more information, see Configuring Compliance Policy Deployment Methods in Managing security compliance.
Procedure
- In the Satellite web UI, navigate to Configure > Ansible > Variables.
-
Search for the
foreman_scap_client_portvariable and click its name. - In the Default Behavior area, ensure that the Override checkbox is selected.
-
In the Parameter Type list, ensure that
integeris selected. -
In the Default Value field, enter
9090. - In the Specify Matchers area, remove all matchers that override the default value.
- Click Submit.
-
Search for the
foreman_scap_client_servervariable and click its name. - In the Default Behavior area, ensure that the Override checkbox is selected.
-
In the Parameter Type list, ensure that
stringis selected. -
In the Default Value field, enter the FQDN of your load balancer, such as
loadbalancer.example.com. - In the Specify Matchers area, remove all matchers that override the default value.
- Click Submit.
Continue with deploying a compliance policy using Ansible. For more information, see:
- Deploying a Policy in a Host Group Using Ansible in Managing security compliance
- Deploying a Policy on a Host Using Ansible in Managing security compliance
Verification
On the client, verify that the
/etc/foreman_scap_client/config.yamlfile contains the following lines:# Foreman proxy to which reports should be uploaded :server: 'loadbalancer.example.com' :port: 9090
9.2. Propagating SCAP content using Puppet deployment
Using this procedure, you can promote Security Content Automation Protocol (SCAP) content through the load balancer in the scope of the Puppet deployment method.
Prerequisites
- Ensure that you have configured Satellite for Puppet deployment of compliance policies. For more information, see Configuring Compliance Policy Deployment Methods in Managing security compliance.
Procedure
- In the Satellite web UI, navigate to Configure > Puppet ENC > Classes.
-
Click
foreman_scap_client. - Click the Smart Class Parameter tab.
-
In the pane to the left of the Smart Class Parameter window, click
port. - In the Default Behavior area, select the Override checkbox.
-
From the Key Type list, select
integer. -
In the Default Value field, enter
9090. -
In the pane to the left of the Smart Class Parameter window, click
server. - In the Default Behavior area, select the Override checkbox.
-
From the Key Type list, select
string. -
In the Default Value field, enter the FQDN of your load balancer, such as
loadbalancer.example.com. - In the lower left of the Smart Class Parameter window, click Submit.
Continue with deploying a compliance policy using Puppet. For more information, see:
- Deploying a Policy in a Host Group Using Puppet in Managing security compliance
- Deploying a Policy on a Host Using Puppet in Managing security compliance
Verification
On the client, verify that the
/etc/foreman_scap_client/config.yamlfile contains the following lines:# Foreman proxy to which reports should be uploaded :server: 'loadbalancer.example.com' :port: 9090
