Skip to content

Instantly share code, notes, and snippets.

@dmccuk

dmccuk/oscap_centos8

Last active January 2, 2024 02:16
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dmccuk/b3533c2bc10f68a9c431c81c6f7cf166 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dmccuk/b3533c2bc10f68a9c431c81c6f7cf166 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dmccuk renamed this gist Jun 28, 2021. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → oscap_centos8
    View file
    File renamed without changes.
  2. dmccuk created this gist Jun 28, 2021.
    37 changes: 37 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    ### Install the required packages:
    sudo yum install openscap-scanner scap-security-guide

    ### Can we run a report?
    sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --report /tmp/report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
    first scan gives “notapplicable”

    ### Now do this…

    sudo cp /usr/share/openscap/cpe/openscap-cpe-dict.xml /usr/share/openscap/cpe/openscap-cpe-dict.xml.dist
    sudo cp /usr/share/openscap/cpe/openscap-cpe-oval.xml /usr/share/openscap/cpe/openscap-cpe-oval.xml.dist
    sudo curl -L https://raw.githubusercontent.com/OpenSCAP/openscap/maint-1.3/cpe/openscap-cpe-dict.xml -o /usr/share/openscap/cpe/openscap-cpe-dict.xml
    sudo curl -L https://raw.githubusercontent.com/OpenSCAP/openscap/maint-1.3/cpe/openscap-cpe-oval.xml -o /usr/share/openscap/cpe/openscap-cpe-oval.xml

    ### Does it work yet?
    sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --report /tmp/report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

    Still no…

    ### Now do this…
    sudo sed -i \
    -e 's|idref="cpe:/o:redhat:enterprise_linux|idref="cpe:/o:centos:centos|g' \
    -e 's|ref_id="cpe:/o:redhat:enterprise_linux|ref_id="cpe:/o:centos:centos|g' \
    /usr/share/xml/scap/ssg/content/ssg-rhel*.xml

    It replaces redhat:enterprise with centos:centos

    Now it works!

    ### List all the different profiles available:
    oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

    ### Run the report to check against the CIS benchmark:
    sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --report /tmp/report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

    ### Check the report.