Chapter 7. Managing Security Compliance Security compliance management is the ongoing process of defining security policies, auditing systems for compliance with those policies, and resolving instances of non-compliance. Any non-compliance is managed according to the organization's configuration management policies. Security policies range in scope from host-specific to industry-wide, therefore, flexibility in their definition is required. With Satellite, you can schedule compliance auditing and reporting on all registered hosts. 7.1. Security Content Automation Protocol Satellite uses the Security Content Automation Protocol (SCAP) standard to define security policies. SCAP is a framework of several specifications based on XML, such as checklists described in the Extensible Checklist Configuration Description Format (XCCDF) and vulnerabilities described in the Open Vulnerability and Assessment Language (OVAL). These specifications are encapsulated as data stream files. Checklist items in XCCDF, also known as rules , express the desired configuration of a system item. For example, a rule may specify that no one can log in to a host over SSH using the root user account. Rules can be grouped into one or more XCCDF profiles , which allows multiple profiles to share a rule. The OpenSCAP scanner tool evaluates system items on a host against the rules and generates a report in the Asset Reporting Format (ARF), which is then returned to Satellite for monitoring and analysis. Table 7.1. Specifications in the SCAP Framework 1.3 supported by the OpenSCAP scanner Title Description Version SCAP Security Content Automation Protocol 1.3 XCCDF Extensible Configuration Checklist Description Format 1.2 OVAL Open Vulnerability and Assessment Language 5.11 - Asset Identification 1.1 ARF Asset Reporting Format 1.1 CCE Common Configuration Enumeration 5.0 CPE Common Platform Enumeration 2.3 CVE Common Vulnerabilities and Exposures 2.0 CVSS Common Vulnerability Scoring System 2.0 Additional resources For more information about SCAP, see the OpenSCAP project . 7.2. SCAP Content in Satellite SCAP content is a SCAP data-stream file that contains implementation of compliance, configuration, or security baselines. A single data stream usually includes multiple XCCDF profiles. An XCCDF profile defines an industry standard or custom security standard against which you can evaluate compliance of host configuration in Satellite, such as Protection Profile for General Purpose Operating Systems (OSPP), Health Insurance Portability and Accountability Act (HIPAA), and PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 9. You can adapt existing XCCDF profiles according to your requirements using tailoring files . In Satellite, you use an XCCDF profile from SCAP content and, eventually, a tailoring file, to define a compliance policy . Satellite includes default SCAP contents from SCAP Security Guide provided by the OpenSCAP project . For more information on how to download, deploy, modify, and create your own content, see: Red Hat Enterprise Linux 9 Security hardening Red Hat Enterprise Linux 8 Security hardening Red Hat Enterprise Linux 7 Security Guide Red Hat Enterprise Linux 6 Security Guide 7.2.1. Supported SCAP Versions Satellite supports content of SCAP versions 1.2 and 1.3. 7.3. Compliance Policy Deployment Options You can use one of the following methods to deploy compliance policies: Ansible deployment You use an Ansible role to configure hosts for compliance scans. Puppet deployment You use a Puppet class and the Puppet agent to configure hosts for compliance scans. Manual deployment You manually configure hosts for compliance scans. 7.4. Configuring Compliance Policy Deployment Methods Use one the following procedures to configure Satellite for the method that you have selected to deploy compliance policies. You will select one of these methods when you later create a compliance policy . Procedure for Ansible deployment Import the theforeman.foreman_scap_client Ansible role. For more information, see Configuring Red Hat Satellite to use Ansible . Assign the created policy and the theforeman.foreman_scap_client Ansible role to a host or host group. To trigger the deployment, run the Ansible role on the host or host group either manually, or set up a recurring job by using remote execution for regular policy updates. For more information, see Configuring and Setting Up Remote Jobs in Managing Hosts . Procedure for Puppet deployment Ensure Puppet is enabled. Ensure the Puppet agent is installed on hosts. Import the Puppet environment that contains the foreman_scap_client Puppet module. For more information, see Managing Configurations Using Puppet Integration in Red Hat Satellite . Assign the created policy and the foreman_scap_client Puppet class to a host or host group. Puppet triggers the deployment on the regular run or you can run Puppet manually. Puppet runs every 30 minutes by default. Procedure for manual deployment For the manual deployment method, no additional Satellite configuration is required. For information on manual deployment, see How to set up OpenSCAP Policies using Manual Deployment option in the Red Hat Knowledgebase . 7.5. Listing Available SCAP Contents Use this procedure to view what SCAP contents are already loaded in Satellite. To use the CLI instead of the Satellite web UI, see the CLI procedure . Prerequisite Your user account has the view_scap_contents permission. Procedure In the Satellite web UI, navigate to Hosts > Compliance - SCAP contents . CLI procedure Run the following Hammer command on Satellite Server: 7.6. Configuring SCAP Contents You can upload SCAP data streams and tailoring files to define compliance policies. 7.6.1. Loading the Default SCAP Contents By loading the default SCAP contents on Satellite Server, you ensure that the data streams from the SCAP Security Guide (SSG) are loaded and assigned to all organizations and locations. SSG is provided by the operating system of Satellite Server and installed in /usr/share/xml/scap/ssg/content/ . Note that the available data streams depend on the operating system version on which Satellite runs. You can only use this SCAP content to scan hosts that have the same minor RHEL version as your Satellite Server. For more information, see Section 7.6.2, "Getting Supported SCAP Contents for RHEL" . Prerequisites Your user account has a role assigned that has the create_scap_contents permission. Procedure Use the following Hammer command on Satellite Server: 7.6.2. Getting Supported SCAP Contents for RHEL You can get the latest SCAP Security Guide (SSG) for Red Hat Enterprise Linux on the Red Hat Customer Portal. You have to get a version of SSG that is designated for the minor RHEL version of your hosts. Procedure Access the SCAP Security Guide in the package browser . From the Version menu, select the latest SSG version for the minor version of RHEL that your hosts are running. For example, for RHEL 8.6, select a version named *.el8_6 . Download the package RPM. Extract the data-stream file ( *-ds.xml ) from the RPM. For example: Upload the data stream to Satellite. For more information, see Section 7.6.3, "Uploading Additional SCAP Content" . Additional resources Supported versions of the SCAP Security Guide in RHEL in the Red Hat Knowledgebase SCAP Security Guide profiles supported in RHEL 9 in Red Hat Enterprise Linux 9 Security hardening SCAP Security Guide profiles supported in RHEL 8 in Red Hat Enterprise Linux 8 Security hardening SCAP Security Guide profiles supported in RHEL 7 in Red Hat Enterprise Linux 7 Security Guide 7.6.3. Uploading Additional SCAP Content You can upload additional SCAP content into Satellite Server, either content created by yourself or obtained elsewhere. Note that Red Hat only provides support for SCAP content obtained from Red Hat. To use the CLI instead of the Satellite web UI, see the CLI procedure . Prerequisite Your user account has the create_scap_contents permission. You have acquired a SCAP data-stream file. Procedure In the Satellite web UI, navigate to Hosts > Compliance > SCAP contents . Click Upload New SCAP Content . Enter a title in the Title text box, such as My SCAP Content . In Scap File , click Choose file , navigate to the location containing a SCAP data-stream file and click Open . On the Locations tab, select locations. On the Organizations tab, select organizations. Click Submit . If the SCAP content file is loaded successfully, a message similar to Successfully created My SCAP Content is displayed. CLI procedure Place the SCAP data-stream file to a directory on your Satellite Server, such as /usr/share/xml/scap/my_content/ . Run the following Hammer command on Satellite Server: Verification List the available SCAP contents . The list of SCAP contents includes the new title. 7.6.4. Tailoring XCCDF Profiles You can customize existing XCCDF profiles using tailoring files without editing the original SCAP content. A single tailoring file can contain customizations of multiple XCCDF profiles. You can create a tailoring file using the SCAP Workbench tool. For more information on using the SCAP Workbench tool, see Customizing SCAP Security Guide for your use case . Then you can assign a tailoring file to a compliance policy to customize an XCCDF profile in the policy. 7.6.5. Uploading a Tailoring File After uploading a tailoring file, you can apply it in a compliance policy to customize an XCCDF profile. Prerequisite Your user account has the create_tailoring_files permission. Procedure In the Satellite web UI, navigate to Hosts > Compliance - Tailoring Files and click New Tailoring File . Enter a name in the Name text box. Click Choose File , navigate to the location containing the tailoring file and select Open . Click Submit to upload the chosen tailoring file. 7.7. Managing Compliance Policies A compliance policy is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content. You specify the schedule for scans on Satellite Server and the scans are performed on hosts. When a scan completes, a report in ARF format is generated and uploaded to Satellite Server. The compliance policy makes no changes to the scanned host. A compliance policy defines a SCAP client configuration and a cron schedule. The policy is then deployed together with the SCAP client on hosts to which the policy is assigned. 7.7.1. Compliance Policy A scheduled audit, also known as a compliance policy , is a scheduled task that checks the specified hosts for compliance against an XCCDF profile. The schedule for scans is specified by Satellite Server and the scans are performed on the host. When a scan completes, an Asset Reporting File (ARF) is generated in XML format and uploaded to Satellite Server. You can see the results of the scan in the compliance policy dashboard. No changes are made to the scanned host by the compliance policy. The SCAP content includes several profiles with associated rules but policies are not included by default. 7.7.2. Creating a Compliance Policy By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies. Prerequisites You have configured Satellite for your selected compliance policy deployment method . You have available SCAP contents, and eventually tailoring files, in Satellite. To verify what SCAP contents are available, see Section 7.5, "Listing Available SCAP Contents" . To upload SCAP contents and tailoring files, see Section 7.6, "Configuring SCAP Contents" . Your user account has the view_policies and create_policies permissions. Procedure In the Satellite web UI, navigate to Hosts > Compliance - Policies . Click New Policy or New Compliance Policy . Select the deployment method: Ansible , Puppet , or Manual . Then click . Enter a name for this policy, a description (optional), then click . Select the SCAP Content and XCCDF Profile to be applied, then click . Note that Satellite does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the Default XCCDF Profile , will return empty reports. Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File , then click . Specify the scheduled time when the policy is to be applied. Select Weekly , Monthly , or Custom from the Period list. The Custom option allows for greater flexibility in the policy's schedule. If you select Weekly , also select the desired day of the week from the Weekday list. If you select Monthly , also specify the desired day of the month in the Day of month field. If you select Custom , enter a valid Cron expression in the Cron line field. Select the locations to which to apply the policy, then click . Select the organizations to which to apply the policy, then click . Optional: Select the host groups to which to assign the policy. Click Submit . 7.7.3. Viewing a Compliance Policy You can preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when you plan policies. Prerequisite Your user account has the view_policies permission. Procedure In the Satellite web UI, navigate to Hosts > Compliance - Policies . In the Actions column of the required policy, click Show Guide or select it from the list. 7.7.4. Editing a Compliance Policy In the Satellite web UI, you can edit compliance policies. Puppet agent applies an edited policy to the host on the run. By default, this occurs every 30 minutes. If you use Ansible, you must run the Ansible role manually again or have configured a recurring remote execution job that runs the Ansible role on hosts. Prerequisite Your user account has the view_policies and edit_policies permissions. Procedure In the Satellite web UI, navigate to Hosts > Compliance - Policies . Click the name of the required policy. Edit the necessary attributes. Click Submit . 7.7.5. Deleting a Compliance Policy In the Satellite web UI, you can delete existing compliance policies. Prerequisite Your user account has the view_policies and destroy_policies permissions. Procedure In the Satellite web UI, navigate to Hosts > Compliance - Policies . In the Actions column of the required policy, select Delete from the list. Click OK in the confirmation message. 7.8. Deploying Compliance Policies To deploy a compliance policy, you must install the SCAP client, update the cron schedule file, and upload the SCAP content selected in the policy onto a host. 7.8.1. Deploying a Policy in a Host Group Using Ansible After you deploy a compliance policy in a host group using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the hosts according to the selected compliance policy. Prerequisites You have enabled OpenSCAP on your Capsule. For more information, see Enabling OpenSCAP on Capsule Servers in Installing Capsule Server . You have enabled and synced the Satellite Client 6 repository to Satellite, and enabled it on the hosts. You have created a compliance policy with the Ansible deployment option and assigned the host group. Procedure In the Satellite web UI, navigate to Configure > Host Groups . Click the host group that you want to configure for OpenSCAP reporting. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use. On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role. Optional: On the Parameters tab, configure any Ansible variables of the role. Click Submit to save your changes. In the row of the required host group, navigate to the Actions column and select Run all Ansible roles . 7.8.2. Deploying a Policy on a Host Using Ansible After you deploy a compliance policy on a host using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the host according to the selected compliance policy. Prerequisites You have enabled OpenSCAP on your Capsule. For more information, see Enabling OpenSCAP on Capsule Servers in Installing Capsule Server . You have enabled and synced the Satellite Client 6 repository to Satellite, and enabled it on the host. You have created a compliance policy with the Ansible deployment option. Procedure In the Satellite web UI, navigate to Hosts > All Hosts , and select Edit on the host you want to configure for OpenSCAP reporting. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use. On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role. Optional: On the Parameters tab, configure any Ansible variables of the role. Click Submit to save your changes. Click the Hosts breadcrumbs link to navigate back to the host index page. Select the host or hosts to which you want to add the policy. Click Select Action . Select Assign Compliance Policy from the list. In the Assign Compliance Policy window, select Remember hosts selection for the bulk action . Select the required policy from the list of available policies and click Submit . Click Select Action . Select Run all Ansible roles from the list. 7.8.3. Deploying a Policy in a Host Group Using Puppet After you deploy a compliance policy in a host group using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the hosts on the Puppet run according to the selected compliance policy. Prerequisites You have enabled OpenSCAP on your Capsule. For more information, see Enabling OpenSCAP on Capsule Servers in Installing Capsule Server . You have enabled and synced the Satellite Client 6 repository to Satellite, and enabled it on the hosts. You have created a compliance policy with the Puppet deployment option and assigned the host group. Procedure In the Satellite web UI, navigate to Configure > Host Groups . Click the host group that you want to configure for OpenSCAP reporting. In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes. In the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use. On the Puppet ENC tab, add the foreman_scap_client Puppet class. Optional: Configure any Puppet Class Parameters . Click Submit to save your changes. 7.8.4. Deploying a Policy on a Host Using Puppet After you deploy a compliance policy on a host using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the host on the Puppet run according to the selected compliance policy. Prerequisites You have enabled OpenSCAP on your Capsule. For more information, see Enabling OpenSCAP on Capsule Servers in Installing Capsule Server . You have enabled and synced the Satellite Client 6 repository to Satellite, and enabled it on the host. You have created a compliance policy with the Puppet deployment option. Procedure In the Satellite web UI, navigate to Hosts > All Hosts , and select Edit on the host you want to configure for OpenSCAP reporting. From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes. From the OpenSCAP Capsule list, select the Capsule with OpenSCAP enabled that you want to use. On the Puppet ENC tab, add the foreman_scap_client Puppet class. Optional: Configure any Puppet Class Parameters . Click the Hosts breadcrumbs link to navigate back to the host index page. Select the host or hosts to which you want to add the policy. Click Select Action . Select Assign Compliance Policy from the list. In the Assign Compliance Policy window, select Remember hosts selection for the bulk action . Select the required policy from the list of available policies and click Submit . 7.9. Running a Security Compliance Scan on Demand Hosts perform OpenSCAP scans regularly by the CRON schedule defined in the compliance policies assigned to hosts. However, you can also run a scan on a host for all configured compliance policies manually at any time. Prerequisites Your user account has the view_hosts , create_job_invocations , and view_job_invocations permissions. You have created a compliance policy and deployed it on the host. For more information about managing policies, see Section 7.7, "Managing Compliance Policies" . For more information about deploying policies, see Section 7.8, "Deploying Compliance Policies" . Procedure Navigate to Hosts > All Hosts . Click the hostname of the required host. On the host details page, expand the Schedule a job dropdown menu. Select Run OpenSCAP scan . Verification In the host details overview, locate the Recent jobs card. Select the Running tab. Unless the job has already finished, the table shows a job called Run scan for all OpenSCAP policies . On the Recent jobs card, select the Finished tab. If the job has finished successfully, you should see the succeeded status in the row of the job. Optional: Click the job name to review invocation details. 7.10. Monitoring Compliance With Satellite, you can centralize compliance monitoring and management. A compliance dashboard provides an overview of compliance of hosts and the ability to view details for each host within the scope of that policy. Compliance reports provide a detailed analysis of compliance of each host with the applicable policy. With this information, you can evaluate the risks presented by each host and manage the resources required to bring hosts into compliance. By monitoring compliance with SCAP, you can verify policy compliance and detect changes in compliance. 7.10.1. Searching Compliance Reports Use the Compliance Reports search field to filter the list of available reports on any subset of hosts. Procedure In the Satellite web UI, navigate to Hosts > Reports . Optional: To see a list of available search parameters, click the empty Search field. Enter the search query in the Search field and click Search . The search query is case insensitive. Search Query Examples Find all compliance reports for which more than five rules failed Find all compliance reports created after January 1, 2023, for hosts with hostnames that contain prod- Find all reports generated by the rhel7_audit compliance policy from an hour ago Find reports that pass an XCCDF rule Find reports that fail an XCCDF rule Find reports that have a result different than fail or pass for an XCCDF rule Additional Information You can create complex queries with the following logical operators: and , not and has . For more information about logical operators, see Supported Operators for Granular Search in Administering Red Hat Satellite . You cannot use regular expressions in a search query. However, you can use multiple fields in a single search expression. For more information about all available search operators, see Supported Operators for Granular Search in Administering Red Hat Satellite . You can bookmark a search to reuse the same search query. For more information, see Creating Bookmarks in Administering Red Hat Satellite . 7.10.2. Compliance Email Notifications Satellite Server sends an OpenSCAP Summary email to all users who subscribe to the Compliance policy summary email notifications. For more information on subscribing to email notifications, see Section 6.1, "Configuring Email Notifications" . Each time a policy is run, Satellite checks the results against the run, noting any changes between them. The email is sent according to the frequency requested by each subscriber, providing a summary of each policy and its most recent result. 7.10.3. Viewing Compliance Policy Statistics You can view a compliance policy dashboard to verify compliance reports of a particular policy. The compliance policy dashboard provides a statistical summary of compliance of hosts and the ability to view report details for each host within the scope of that policy. Consider prioritizing the following hosts when viewing compliance reports: Hosts which were evaluated as Failed Hosts labelled as Never audited because their status is unknown Prerequisite Your user account has the view_policies permission. Procedure In the Satellite web UI, navigate to Hosts > Policies . In the row of the required policy, navigate to the Actions column and click Dashboard . 7.10.4. Examining Hosts per Rule Compliance Result You can examine a simplified report and use policy rules to list hosts that have a certain compliance result, such as failing a particular rule. Prerequisite Your user account has the view_arf_reports and view_hosts permissions. Procedure In the Satellite web UI, navigate to Hosts > Reports . In the Reported At column, navigate to the report of the required host and compliance policy, and click the time link. Satellite displays a simplified list of policy rules with the results of the scan. Optional: Filter the rules by check result. From the Show log messages dropdown list, select one of the following filters: Failed and othered - to view rules that have failed or have not been checked during the scan, Failed only - to view only rules that have failed. Optional: Examine the details of the rule. In the Message column, click the icon to the name of the rule. In the row of the required rule, navigate to the Actions column and click Hosts failing this rule . 7.10.5. Examining Compliance Failures of a Host You can examine a full compliance report, determine why a host failed compliance on a rule, and, in some cases, see how to remediate a case of non-compliance. Warning Do not implement any of the recommended remedial actions or scripts without first testing them in a non-production environment. Remediation might render the system non-functional. A compliance report consists of the following areas: Introduction Evaluation Characteristics Compliance and Scoring Rule Overview Prerequisite Your user account has the view_arf_reports and view_hosts permissions. Procedure In the Satellite web UI, navigate to Hosts > Reports to list all compliance reports. In the row of the required host, navigate to the Actions column and click Full Report to view the complete details of an evaluation report. Navigate to the Evaluation Characteristics area to review basic details about the evaluation of the host against a specific profile. Navigate to the Compliance and Scoring area to review evaluation statistics and the host compliance score. Navigate to the Rule Overview to examine the rules. Optional: Deselect the check statuses that you want to hide, such as pass , notapplicable , or fixed . Optional: From the Group rule by dropdown menu, select the criterion for the grouping of rules, such as Severity . Optional: Enter a search string into the search field to filter rules by title. The search is case insensitive and applied dynamically as you type. Click the title of a rule to inspect further result details: A description of the rule with instructions for bringing the host into compliance if available. The rationale for the rule. In some cases, a remediation script. 7.10.6. Deleting a Compliance Report You can delete compliance reports on your Satellite. Prerequisite Your user account has the view_arf_reports and destroy_arf_reports permissions. Procedure In the Satellite web UI, navigate to Hosts > Reports . In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy's name, select Delete . Click OK . 7.10.7. Deleting Multiple Compliance Reports You can delete multiple compliance policies simultaneously. However, in the Satellite web UI, compliance policies are paginated, so you must delete one page of reports at a time. If you want to delete all OpenSCAP reports, use the script in Deleting OpenSCAP Reports in the API Guide . Prerequisite Your user account has the view_arf_reports and destroy_arf_reports permissions. Procedure In the Satellite web UI, navigate to Hosts > Reports . In the Compliance Reports window, select the compliance reports that you want to delete. In the upper right of the list, select Delete reports . Repeat these steps for as many pages as you want to delete.

Commands:
hammer scap-content list --location " My_Location " --organization " My_Organization "
hammer scap-content bulk-upload --type default
rpm2cpio scap-security-guide-0.1.69-3.el8_6.noarch.rpm | cpio -iv --to-stdout ./usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml > ssg-rhel-8.6-ds.xml
hammer scap-content bulk-upload --type directory --directory /usr/share/xml/scap/my_content/ --location " My_Location " --organization " My_Organization "
failed > 5
host ~ prod- AND date > "Jan 1, 2023"
"1 hour ago" AND compliance_policy = date = "1 hour ago" AND compliance_policy = rhel7_audit
xccdf_rule_passed = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
xccdf_rule_failed = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
xccdf_rule_othered = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions