8.4. Using oscap The oscap command-line utility allows users to scan their local systems, validate security compliance content, and generate reports and guides based on these scans and evaluations. This utility serves as a front end to the OpenSCAP library and groups its functionalities to modules (sub-commands) based on a type of the SCAP content it processes. The following sections explain how to install oscap , perform the most common operations, and display the relevant examples for these tasks. To learn more about specific sub-commands, use the --help option with an oscap command: oscap [ options ] module module_operation [ module_operation_options_and_arguments ] --help where module represents a type of SCAP content that is being processed, and module_operation is a sub-command for the specific operation on the SCAP content. Example 8.4. Getting Help on the Specific oscap Operation To learn about all oscap features and the complete list of its options, see the oscap(8) manual page. 8.4.1. Installing oscap To install oscap to your system, run the following command as root : This command allows you to install all packages required by oscap to function properly, including the openscap package. If you want to write your own security content, you should also install the openscap-engine-sce package that provides the Script Check Engine (SCE). SCE is an extension to SCAP protocol that allows content authors to write their security content using a scripting language, such as Bash, Python or Ruby. The openscap-engine-sce package can be installed in the same way as the openscap-scanner package, however, you need to have access to the repository or channel with optional packages for your Red Hat Enterprise Linux variant. If your system is registered with Red Hat Subscription Management, enable the rhel-6- variant -optional-rpms repository as described in the Yum chapter of Red Hat Enterprise Linux 6 Deployment Guide, where variant is your Red Hat Enterprise Linux variant, such as server , or workstation . If your system is registered with RHN Classic, subscribe the system to the rhel- architecture - variant -6-optional channel as documented here: https://access.redhat.com/site/solutions/9907 . Optionally, after installing oscap , you can check capabilities of your version of oscap , what specifications it supports, where the certain oscap files are stored, what kinds of SCAP objects you can use, and other useful information. To display this information, type the following command: Before you can start using the oscap utility effectively, you also have to install or import some security content on your system. You can download the SCAP content from the respective web site, or if specified as an RPM file or package, you can install it from the specified location, or known repository, using the Yum package manager. For example, to install the SCAP Security Guide (SSG) package that contains the latest set of security polices for Linux systems, run the following command: After you install the scap-security-guide package on your system, unless specified otherwise, the SSG security content is available under the /usr/share/xml/scap/ssg/content/ directory, and you can proceed with other security compliance operations. To find out other possible sources of existing SCAP content that might suit your needs, see Section 8.8, "Additional Resources" . After installing the SCAP content on your system, oscap can process the content by specifying the file path to the content. The oscap utility supports SCAP version 1.2 and is backward compatible with SCAP versions 1.1 and 1.0 so it can process earlier versions of the SCAP content without any special requirements.

Commands:
~]USD oscap ds sds-split --help oscap -> ds -> sds-split Split given SourceDataStream into separate files Usage: oscap [options] ds sds-split [options] SDS TARGET_DIRECTORY SDS - Source data stream that will be split into multiple files. TARGET_DIRECTORY - Directory of the resulting files. Options: --datastream-id <id> - ID of the datastream in the collection to use. --xccdf-id <id> - ID of XCCDF in the datastream that should be evaluated.
~]# yum install openscap-scanner
~]USD oscap -V OpenSCAP command line tool (oscap) 1.0.8 Copyright 2009--2014 Red Hat Inc., Durham, North Carolina. ==== Supported specifications ==== XCCDF Version: 1.2 OVAL Version: 5.10.1 CPE Version: 2.3 CVSS Version: 2.0 CVE Version: 2.0 Asset Identification Version: 1.1 Asset Reporting Format Version: 1.1 ==== Capabilities added by auto-loaded plugins ==== SCE Version: 1.0 (from libopenscap_sce.so.8) ==== Paths ==== Schema files: /usr/share/openscap/schemas Schematron files: /usr/share/openscap/xsl Default CPE files: /usr/share/openscap/cpe Probes: /usr/libexec/openscap ==== Inbuilt CPE names ==== Red Hat Enterprise Linux - cpe:/o:redhat:enterprise_linux Red Hat Enterprise Linux 5 - cpe:/o:redhat:enterprise_linux:5 Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6 Red Hat Enterprise Linux 7 - cpe:/o:redhat:enterprise_linux:7 Fedora 16 - cpe:/o:fedoraproject:fedora:16 Fedora 17 - cpe:/o:fedoraproject:fedora:17 Fedora 18 - cpe:/o:fedoraproject:fedora:18 Fedora 19 - cpe:/o:fedoraproject:fedora:19 Fedora 20 - cpe:/o:fedoraproject:fedora:20 Fedora 21 - cpe:/o:fedoraproject:fedora:21 Red Hat Enterprise Linux Optional Productivity Applications - cpe:/a:redhat:rhel_productivity Red Hat Enterprise Linux Optional Productivity Applications 5 - cpe:/a:redhat:rhel_productivity:5 ==== Supported OVAL objects and associated OpenSCAP probes ==== system_info probe_system_info family probe_family filehash probe_filehash environmentvariable probe_environmentvariable textfilecontent54 probe_textfilecontent54 textfilecontent probe_textfilecontent variable probe_variable xmlfilecontent probe_xmlfilecontent environmentvariable58 probe_environmentvariable58 filehash58 probe_filehash58 inetlisteningservers probe_inetlisteningservers rpminfo probe_rpminfo partition probe_partition iflisteners probe_iflisteners rpmverify probe_rpmverify rpmverifyfile probe_rpmverifyfile rpmverifypackage probe_rpmverifypackage selinuxboolean probe_selinuxboolean selinuxsecuritycontext probe_selinuxsecuritycontext file probe_file interface probe_interface password probe_password process probe_process runlevel probe_runlevel shadow probe_shadow uname probe_uname xinetd probe_xinetd sysctl probe_sysctl process58 probe_process58 fileextendedattribute probe_fileextendedattribute routingtable probe_routingtable
~]# yum install scap-security-guide