3 ms·

OpenSCAP: Tools for managing system security and standards compliance

51 points by rayascott 9y ago

epistasis 9y ago
I have a lot of interest and questions about this, has anybody here been using this? I would like to know: 1) what types of things does OpenSCAP audit? 2) does it support my mixture of operating systems? 3) is it for scanning remotely over a network? 4) does it scan the configuration of a computer from a local daemon? After ~5 minutes of clicking, I eventually found this link: https://www.open-scap.org/getting-started/ https://www.open-scap.org/getting-started/ Which explains what they mean by their terms. However, it's not the traditional definition of "getting started" which means installation. (Also, for some reason the web developer has severely reduced the user experience by hiding items, and only showing them once they have fully scrolled into view, which breaks the large sections of text. It makes it really hard to skim and learn.)
- rwmj 9y ago
  I'll try my best at this although I've only been involved with OpenSCAP some time ago doing a bit of integration with libguestfs ... > 1) what types of things does OpenSCAP audit? It uses a big XML file of tests (which generally you don't write - that is supplied by the OS vendor), called OVAL files. The tests can do a lot of stuff, I believe arbitrary stuff, but in general it's things like checking the permissions of files and directories, checking versions of packages installed to see if they are vulnerable, looking for misconfiguration, and so on. > 2) does it support my mixture of operating systems? Well you need the vulnerability data - ie. the XML/OVAL files. Red Hat [the company I work for] supply this for all of our Red Hat Enterprise Linux systems, and I believe you can get it for Windows too, but I don't know about others. Here are the RHEL files: https://www.redhat.com/security/data/oval/ https://www.redhat.com/security/data/oval/ > 3) is it for scanning remotely over a network? > 4) does it scan the configuration of a computer from a local daemon? It's running a process inside the machine under test (and hence it's not really good for testing machines which have already been compromised and where the compromise has countermeasures). You can automate the program in the usual ways which would allow you to initiate a scan from your puppetmaster / ansible / whatever. One of the things I did was extend it so that you can examine a disk image using libguestfs, but unfortunately only a subset of tests is then able to run, basically only those tests that can be done through pure file access. Nevertheless this allows you to scan (eg) all your VMs to see which ones are vulnerable to some subset of problems.
- chr15p 9y ago
  Open SCAP has been part of the functionality of Red Hat's Satellite Server for years, in my experience not that many people use it, but enough for it to be well tested. Its been a while since I looked at it but from memeory... 1) SCAP is its own xml based language which includes tests for things like packages installed, sysctl settings, and processes running, but it also has a generic "run this command and check regexp the results" type resource so you can pretty nuch check anything you want with a bit of work. Openscap is an opensource tool for running scap tests. 2) SCAP is a generic standard so it should be applicable to everything, but I've only ever used it on Linux so shrug. I would expect other unix's to be supported. 3) iirc it runs locally, but its pretty trivial to run via puppet (satellite 6 comes with puppet modules) or ansible to run it and pull the reports back to a central server 4) it doesn't run as a daemon, its a binary you run when you want a report. The Satellite puppet modules set up a cron job to run once a week, Like all these things its only as good as the tests you run and the xml format isn't that easy to write unless you're willing to put in some serious work. There are existing test sets available (again Red Hat supply some) which are a good place to start
- mboelen 9y ago
  It almost does all that you ask. There is a big downside of the toolkit: it is filled with abbreviations, XML files, and binaries. For that reason, I still develop an alternative project focused on Linux, macOS, and Unix-derivatives. It is named Lynis and was founded in 2007. GitHub link: https://github.com/CISOfy/lynis https://github.com/CISOfy/lynis
- oso2k 9y ago
  Like another poster here, I work for Red Hat and we sometimes implement OpenSCAP as part of OpenShift (our Kubernetes distro) to do regular CVE scanning of container images. My colleague Andy Block has a repo to demonstrate this capability. https://github.com/sabre1041/image-scanning-signing-service https://github.com/sabre1041/image-scanning-signing-service
theossuary 9y ago
Biggest issue I've had with open scap is Amazon Linux doesn't support it, which sucks. Keep in mind if you do a lot in AWS
- mboelen 9y ago
  Did you try Lynis as an alternative?

51 points by rayascott 9y ago

I have a lot of interest and questions about this, has anybody here been using this? I would like to know: 1) what types of things does OpenSCAP audit? 2) does it support my mixture of operating systems? 3) is it for scanning remotely over a network? 4) does it scan the configuration of a computer from a local daemon? After ~5 minutes of clicking, I eventually found this link: https://www.open-scap.org/getting-started/ https://www.open-scap.org/getting-started/ Which explains what they mean by their terms. However, it's not the traditional definition of "getting started" which means installation. (Also, for some reason the web developer has severely reduced the user experience by hiding items, and only showing them once they have fully scrolled into view, which breaks the large sections of text. It makes it really hard to skim and learn.)

rwmj 9y ago
I'll try my best at this although I've only been involved with OpenSCAP some time ago doing a bit of integration with libguestfs ... > 1) what types of things does OpenSCAP audit? It uses a big XML file of tests (which generally you don't write - that is supplied by the OS vendor), called OVAL files. The tests can do a lot of stuff, I believe arbitrary stuff, but in general it's things like checking the permissions of files and directories, checking versions of packages installed to see if they are vulnerable, looking for misconfiguration, and so on. > 2) does it support my mixture of operating systems? Well you need the vulnerability data - ie. the XML/OVAL files. Red Hat [the company I work for] supply this for all of our Red Hat Enterprise Linux systems, and I believe you can get it for Windows too, but I don't know about others. Here are the RHEL files: https://www.redhat.com/security/data/oval/ https://www.redhat.com/security/data/oval/ > 3) is it for scanning remotely over a network? > 4) does it scan the configuration of a computer from a local daemon? It's running a process inside the machine under test (and hence it's not really good for testing machines which have already been compromised and where the compromise has countermeasures). You can automate the program in the usual ways which would allow you to initiate a scan from your puppetmaster / ansible / whatever. One of the things I did was extend it so that you can examine a disk image using libguestfs, but unfortunately only a subset of tests is then able to run, basically only those tests that can be done through pure file access. Nevertheless this allows you to scan (eg) all your VMs to see which ones are vulnerable to some subset of problems.
chr15p 9y ago
Open SCAP has been part of the functionality of Red Hat's Satellite Server for years, in my experience not that many people use it, but enough for it to be well tested. Its been a while since I looked at it but from memeory... 1) SCAP is its own xml based language which includes tests for things like packages installed, sysctl settings, and processes running, but it also has a generic "run this command and check regexp the results" type resource so you can pretty nuch check anything you want with a bit of work. Openscap is an opensource tool for running scap tests. 2) SCAP is a generic standard so it should be applicable to everything, but I've only ever used it on Linux so shrug. I would expect other unix's to be supported. 3) iirc it runs locally, but its pretty trivial to run via puppet (satellite 6 comes with puppet modules) or ansible to run it and pull the reports back to a central server 4) it doesn't run as a daemon, its a binary you run when you want a report. The Satellite puppet modules set up a cron job to run once a week, Like all these things its only as good as the tests you run and the xml format isn't that easy to write unless you're willing to put in some serious work. There are existing test sets available (again Red Hat supply some) which are a good place to start
mboelen 9y ago
It almost does all that you ask. There is a big downside of the toolkit: it is filled with abbreviations, XML files, and binaries. For that reason, I still develop an alternative project focused on Linux, macOS, and Unix-derivatives. It is named Lynis and was founded in 2007. GitHub link: https://github.com/CISOfy/lynis https://github.com/CISOfy/lynis
oso2k 9y ago
Like another poster here, I work for Red Hat and we sometimes implement OpenSCAP as part of OpenShift (our Kubernetes distro) to do regular CVE scanning of container images. My colleague Andy Block has a repo to demonstrate this capability. https://github.com/sabre1041/image-scanning-signing-service https://github.com/sabre1041/image-scanning-signing-service

theossuary 9y ago

Biggest issue I've had with open scap is Amazon Linux doesn't support it, which sucks. Keep in mind if you do a lot in AWS

mboelen 9y ago
Did you try Lynis as an alternative?