# Running a Scan

## Available Profiles

SCAP Security Guide content is broken into groupings of security settings that correlate to a known policy. These groupings are named XCCDF Profiles, which not only reflect a grouping of security controls, but also any variable tailoring (e.g. password length customization). Available profiles are:

Important

The SCAP Security Guide serves as the upstream development community for many government baselines. Due to upstream/downstream development relationships, SSG content will likely be ahead of officially released government baselines. If you require scrict conformance against published baselines, always refer to the issuers website for current content.

- stig-rhel6-server

  The Security Technical Implimentation Guides (STIGs) and the NSA SNAC Guides are the configuration standards for U.S. Department of Defense Information Assurance and Information Assurance-Enabled devices/systems. Since 1998, DISA Field Security Operations (DISA FSO) has played a critical role enhancing the security posture of DoD's security systems by providing the Security Technical Implimentation Guides. This profile was created as a collaboration effort between the National Security Agency, DISA FSO, and Red Hat, to form an upstream development community around the Red Hat Enterprise Linux 6 STIG.

- usgcb-rhel6-server

  The purpose of the United States Government Configuration Baseline (USGCB) initiative is to create security configuration baselines for Information Technology products widely deployed across federal agencies. The USGCB baseline evolved from the Federal Desktop Core Configuration mandate. The USGCH is a Federal government-wide initiative that provides guidance to agencies on what should be done to improve and maintain an effective configuration settings focusing primarily on security.

- rht-ccp

  The Red Hat Certified Cloud Provider (CCP) program ensures that public cloud providers meet "testing and certification requirements to demonstrate that they can deliver a safe, scalable, supported and consistent environment for enterprise cloud deployments. The Red Hat Certified Cloud Provider program provides customers, ISVs, and partners with the confidence that Red Hat product experts have validated the solution so that implimentations begin with a solid foundation" In order to establish an automated security testing process, Red Hat is exploring the use of SCAP profiles to evaluate Red Hat Enterprise Linux baselines/AMIs before public cloud providers release them to their customer sets. This does not reflect a statement of direction for Red Hat, but rather transparency as Red Hat evaluates best practices to evaluate the security posture of public cloud images.

## Command Line Interface (CLI)

This document outlines the usage of OpenSCAP, a command-line utility packaged within Fedora and Red Hat Enterprise Linux which allows users to load, scan, validate, edit, and export SCAP documents. Additional details regarding OpenSCAP can be found on the project homepage located at http://open-scap.org/.

Five arguments to OpenSCAP are needed to perform a system scan against the upstream DISA STIG profile:

- --profile

  Mandatory, identifies which profile to scan against

- --results

  Optional, indicates location to place XML formatted results

- --report

  Optional, indicates location to place HTML formatted results

- --cpe

  Mandatory, identifies location of CPE dictionary

- xccdf location

  Mandatory, identifies location of XCCDF file

Putting these arguments together, a properly formatted command would be:

    $ sudo oscap xccdf eval --profile stig-rhel6-server \
    --results /root/ssg-results.xml \
    --report /root/ssg-report.xml \
    --cpe /usr/share/xml/scap/ssg/ssg-rhel6-cpe-dictionary.xml \
    /usr/share/xml/scap/ssg/ssg-rhel6-xccdf.xml

While the scan is running, you will see output similar to the following on your screen:

    Title   Install AIDE
    Rule    package_aide_installed
    Ident   CCE-27024-9
    Result  fail

    Title   Configure Periodic Execution of AIDE
    Rule    aide_periodic_cron_checking
    Ident   CCE-27222-9
    Result  notchecked

    Title   Verify File Permissions with RPM
    Rule    rpm_verify_permissions
    Ident   CCE-26731-0
    Result  fail

    Title   Verify File Hashes with RPM
    Rule    rpm_verify_hashes
    Ident   CCE-27223-7
    Result  pass

## Result Interpretation

s

HTML Results

  asdasdasd

  asdasd

XML Results

  Looking at the results.xml file, you will notice lines similar to those below:

      <rule-result idref="ensure_gpgcheck_globally_activated" time="2013-10-22T10:03:43" severity="high" weight="1.000000">
        <result>pass</result>
        <ident system="http://cce.mitre.org">CCE-26709-6</ident>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg:def:413" href="ssg-rhel6-oval.xml"/>
        </check>
      </rule-result>
      ......
      <rule-result idref="package_aide_installed" time="2013-10-22T10:03:43" severity="medium" weight="1.000000">
        <result>pass</result>
        <ident system="http://cce.mitre.org">CCE-27024-9</ident>
        <fix xmlns:xhtml="http://www.w3.org/1999/xhtml" system="urn:xccdf:fix:script:sh">
          yum -y install aide
        </fix>
        <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
          <check-content-ref name="oval:ssg:def:245" href="ssg-rhel6-oval.xml"/>
        </check>
      </rule-result>

  The XML above can be parsed as follows:

  XCCDF Rule Elements

  XML Tag | Meaning
  --- | ---
  <rule-result idref.....> | Identifies which XCCDF rule the result reflects
  <result> | Pass/Fail/Not Applicable
  <ident system.....> | Identifies corresponding CCE
  <fix> | Remediation actions, in bash, which will configure the system to be in compliance with the XCCDF rule
  <check system....> | Identifies which version of OVAL the check was authored against
  <check-content-ref ....> | Corresponding OVAL check name (name=....) and source OVAL file (href=....) this check came from. For general purpose users, this information can be ignored.

## Remediation

SCAP Security Guide embeds bash remediation scripts into the SCAP content. This allows for SCAP compatible tools to extract these remediation scripts to aide in potential remediation of system misconfigurations.

OpenSCAP, the CLI delivered with Fedora and Red Hat Enterprise Linux systems, contains the ability to transform XML results into an executable script. The syntax to generate a remediation script is:

    $ oscap xccdf generate fix \
    --result-id xccdf_org.open-scap_testresult_{profile-name} \
    /root/ssg-results.xml

Replace {profile-name} with the profile the system was scanned against. For example, for stig-rhel6-server:

    $ oscap xccdf generate fix \
    --result-id xccdf_org.open-scap_testresult_stig-rhel6-server \
    /root/ssg-results.xml

You will receive output similar to the following:

    $ oscap xccdf generate fix \
    --result-id xccdf_org.open-scap_testresult_stig-rhel6-server \
    /root/ssg-results.xml

    #!/bin/bash
    # OpenSCAP fix generator output for benchmark: DRAFT Guide
    # to the Secure Configuration of Red Hat Enterprise Linux 6

    # XCCDF rule: set_sysctl_net_ipv4_conf_default_rp_filter
    # CCE-26915-9
    #
    # Set runtime for net.ipv4.conf.default.rp_filter
    #
    sysctl -q -n -w net.ipv4.conf.default.rp_filter=1

    #
    # If net.ipv4.conf.default.rp_filter present in
    # /etc/sysctl.conf, change value to "1"
    # else, add "net.ipv4.conf.default.rp_filter = 1" to /etc/sysctl.conf
    #
    if grep --silent ^net.ipv4.conf.default.rp_filter /etc/sysctl.conf ; then sed -i \
     's/^net.ipv4.conf.default.rp_filter.*/net.ipv4.conf.default.rp_filter \
     = 1/g' /etc/sysctl.conf
    else
    echo "" >> /etc/sysctl.conf
    echo "# Set net.ipv4.conf.default.rp_filter to 1 per \
     security requirements" >> /etc/sysctl.conf
    echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.conf
    fi

    # XCCDF rule: uninstall_xinetd
    # CCE-27005-8
    if rpm -qa | grep -q xinetd; then
    yum -y remove xinetd
    fi

    # generated: 2013-07-05T13:56:30-04:00
    # END OF SCRIPT

This output could be redirected to a bash script, or built into your RHEL6 provisioning process (e.g. the %post section of a kickstart).