diff --git a/DC-compliance-scans b/DC-compliance-scans new file mode 100644 index 0000000..f2fc105 --- /dev/null +++ b/DC-compliance-scans @@ -0,0 +1,9 @@ +MAIN="art-compliance-scans.xml" +ROOTID="art-compliance-scans" + +PROFCONDITION="suse-product" +#PROFCONDITION="suse-product;beta" +#PROFCONDITION="community-project" + +STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2022-ns" +FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns" diff --git a/images/src/png/example.png b/images/src/png/example.png deleted file mode 100644 index 639a02f..0000000 Binary files a/images/src/png/example.png and /dev/null differ diff --git a/images/src/png/openscap-report-header-example.png b/images/src/png/openscap-report-header-example.png new file mode 100644 index 0000000..d235dff Binary files /dev/null and b/images/src/png/openscap-report-header-example.png differ diff --git a/images/src/png/openscap-report-rule-details-example.png b/images/src/png/openscap-report-rule-details-example.png new file mode 100644 index 0000000..91bf37c Binary files /dev/null and b/images/src/png/openscap-report-rule-details-example.png differ diff --git a/images/src/png/openscap-report-rules-example.png b/images/src/png/openscap-report-rules-example.png new file mode 100644 index 0000000..1c708a5 Binary files /dev/null and b/images/src/png/openscap-report-rules-example.png differ diff --git a/images/src/png/openscap-report-summary-example.png b/images/src/png/openscap-report-summary-example.png new file mode 100644 index 0000000..20e8bc4 Binary files /dev/null and b/images/src/png/openscap-report-summary-example.png differ diff --git a/xml/art-compliance-scans.xml b/xml/art-compliance-scans.xml new file mode 100644 index 0000000..0059a50 --- /dev/null +++ b/xml/art-compliance-scans.xml @@ -0,0 +1,343 @@ + + + + %entities; +]> + +
+ + + Running compliance scans for &productname; + &productname; + &productnameshort; + + + + + This guide explains how to use &openscap; to run compliance scans on + Enterprise Linux systems registered with &productname; &productnumber;. + + + + + https://github.com/SUSE/doc-liberty/issues/new + documentation,issue + 7 + tahliar + + https://github.com/SUSE/doc-liberty/edit/maintenance/SLL7/xml/ + no + + Running compliance scans for &productname; + How to use &openscap; to run compliance scans on systems registered with &productname; &productnumber;. + Run compliance scans for &productname; &productnumber;. + + Auditing + Compliance + + + + 2025-02-21 + + + Initial guide creation + + + + + + +
+ Introduction + + &productname; (previously known as &suse; Liberty Linux) is a support service which uses its own branding and paths different from the &rhel; and other distributions built from the &rhla; source, such as CentOS and Oracle Linux. For a migrating customer it is important to understand how to properly deploy compliance profiles and run scans using tools such as &openscap; and ComplianceAsCode (also known as the &ssg;). + + + Just like &rhla;, &productname; provides the following components in its software update repositories: + + + + + The &openscap; scanner and utilities. + + + + + SCAP Workbench, a utility with a graphical user interface for SCAP content tailoring, editing, and validation. + + + + + The &ssg;, a collection of security guidance and baselines from to apply against systems for compliance. + + + + + Third-party compliance tools are not supported + + Third-party compliance tools, such as proprietary security scanners and upstream builds + of ComplianceAsCode content, might not recognize &productname; properly + and are not currently supported. + + +
+ +
+ Requirements + + Before running compliance scans, make sure your system meets the following requirements: + + + + + The target system is registered with &productname; as described in one + of the following guides: + + + + + + Registering &rhla; &productnumber; or CentOS Linux &productnumber; with &rmt; + + + + + + Registering &rhla; &productnumber; or CentOS Linux &productnumber; with &suma; + + + + + + + The most recent versions of the following packages are installed: + + + + + sles_es-release-server + + + + + openscap + + + + + openscap-scanner + + + + + scap-security-guide + + + Supported <package>scap-security-guide</package> version + + &rhla; 7 and its clones are no longer supported by the upstream + ComplianceAsCode project. Therefore, the most + recent version of scap-security-guide + available from the &productname; LTSS &productnumber; repository is + scap-security-guide-0.1.73-1.el7_9. + + + + + + Installing these packages might also install additional dependencies. + + + + + The installed packages are provided by &suse;. You can check the vendor + with the rpm -qi command. For example: + +&prompt.root;rpm -qi openscap-scanner | grep -i vendor +Vendor : SUSE LLC <https://www.suse.com/> + + You can also check the distribution name. For example: + +&prompt.root;rpm -q --queryformat '%{DISTRIBUTION}\n' openscap +SLES Expanded Support platform + + If the vendor or distribution is different from the output shown above, + reinstall the packages from the &productname; LTSS &productnumber; repository, + and make sure no other repository overrides &productname;. + + + + + SCAP Workbench + + The optional package scap-workbench is also available, + but is not required to run scans locally from the command line. + + +
+ +
+ Listing installed profiles + + The &ssg; installs the compliance content under the path + /usr/share/xml/scap/ssg/content. + For compatibility, builds of the &ssg; for &productname; also provide additional + ssg-rhel* content in the same location as the + &productname; content. + + + To list the available compliance profiles for &productname; &productnumber;, + run the following command: + +&prompt.root;oscap info /usr/share/xml/scap/ssg/content/ssg-sles_esp7-ds.xml + + You can use grep to narrow down the results. For example, + to see only CIS profiles, run the following command: + +&prompt.root;oscap info /usr/share/xml/scap/ssg/content/ssg-sles_esp7-ds.xml | grep -i cis + Title: CIS Benchmark for Level 2 - Server + Id: xccdf_org.ssgproject.content_profile_cis + Title: CIS Benchmark for Level 1 - Server + Id: xccdf_org.ssgproject.content_profile_cis_server_l1 + Title: CIS Benchmark for Level 1 - Workstation + Id: xccdf_org.ssgproject.content_profile_cis_workstation_l1 + Title: CIS Benchmark for Level 2 - Workstation + Id: xccdf_org.ssgproject.content_profile_cis_workstation_l2 + + + +
+ +
+ Running a scan and generating a report + + It is recommended to run compliance scans being logged in as a user having privileges of accessing system settings (root) or using sudo, otherwise tests requiring such access may run improperly. + + + Please determine a profile name to use, based on recommendations from the previous chapter. For “CIS Benchmark for Level 2 - Server”, the command line may look like this: + +&prompt.root;oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis \ +--report /tmp/report.html --results-arf /tmp/results-arf.xml \ +/usr/share/xml/scap/ssg/content/ssg-sles_esp7-ds.xml + + It is expected to produce results of the scan both on a screen and saved into the files: /tmp/report.html will contain the HTML-formatted report with test results and recommended remediations. The /tmp/report-arf.xml is the same report in XML format. It may be used further in automation and report generation. + +Title Configure auditd admin_space_left Action on Low Disk Space +Rule xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action +Result fail + +Title Configure auditd Max Log File Size +Rule xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file +Result pass + +Title Configure auditd max_log_file_action Upon Reaching Maximum Log Size +Rule xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action +Result fail + +Title Configure auditd space_left Action on Low Disk Space +Rule xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action +Result fail +
+ +
+ Including remote resources in scans + + &productname; provides an external OVAL formatted content that you can use during scans. Such content includes information about recently addressed security vulnerabilities, etc. To make use of the content, ensure that the machine where scans are performed has access to https://ftp.suse.com and add --fetch-remote-resources to the command line: + +&prompt.root;oscap xccdf eval --fetch-remote-resources \ +--profile xccdf_org.ssgproject.content_profile_cis \ +--report /tmp/report.html --results-arf /tmp/results-arf.xml \ +/usr/share/xml/scap/ssg/content/ssg-sles_esp7-ds.xml + + Please note that scans depending on remote resources take more time to complete and produced reports from such scans are significantly larger than usual. + +
+ +
+ Using a report + + The HTML formatted OpenSCAP reports contain information collected off a target system and evaluation of the latter against the selected profile. + + + In the following screenshot, a typical header of a HTML report is displayed, containing information about the chosen security profile. + +
+ Header of a typical HTML-formatted report generated by OpenSCAP + + + + + + + + + The header of a typical HTML-formatted report generated by OpenSCAP. This example report is titled "Guide to the Secure Configuration of SUSE Liberty Linux 7" and uses the profile "CIS Benchmark for Level 2 - Server". + + +
+ + The report itself contains a summary of passed and failed tests, information about the tested system, and a list of rules included with the security profile, along with test results for each rule. + + + The report is interactive: it is possible to click rule names for more detail, check and uncheck filter options, etc. + + + To receive detailed information on each test result, including remediations, please click “Show all result details” button at the very bottom of the report. + + + Below screenshots show some of the functionality of a HTML report generated by OpenSCAP. + +
+ Summary of results in a typical HTML-formatted report generated by OpenSCAP + + + + + + + + + + + +
+
+ List of rules in a typical HTML-formatted report generated by OpenSCAP + + + + + + + + + + + +
+
+ Detailed information about a rule + + + + + + + + + + + +
+
+ + +