wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== Redhat compliance CIS ======

https://www.redhat.com/en/blog/center-internet-security-cis-compliance-red-hat-enterprise-linux-using-openscap

Install the package scap-security-guide to check compliance and remediation

=== Check ===

Get more information on the profile related to CIS, using the profile id (visible after the Title in the ssg-rhel8-ds.xml file): xccdf_org.ssgproject.content_profile_cis
  oscap info --profile xccdf_org.ssgproject.content_profile_cis /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Generate a result file and a html report using OpenSCAP scanner tool, CIS Benchmark version 1.0.0
  oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --results scan_results.xml --report scan_report.html /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml


=== Remediation ===

  /usr/share/scap-security-guide/ansible/
  /usr/share/scap-security-guide/bash/
  /usr/share/scap-security-guide/kickstart/
  
Remediate using ansible
  oscap xccdf generate fix --fix-type ansible --output PlaybookToRemediate.yml --result-id "" scan_results.xml

wiki

User Tools

Site Tools

Page Tools