1. Security compliance management

Security compliance management is the ongoing process of defining security policies, auditing systems for compliance with those policies, and resolving instances of non-compliance. Any non-compliance is managed according to the organization’s configuration management policies. Security policies range in scope from host-specific to industry-wide, therefore, flexibility in their definition is required.

With Foreman, you can schedule compliance auditing and reporting on all registered hosts.

2. Security content automation protocol

Foreman uses the Security Content Automation Protocol (SCAP) standard to define security policies.

SCAP is a framework of several specifications based on XML, such as checklists described in the Extensible Checklist Configuration Description Format (XCCDF) and vulnerabilities described in the Open Vulnerability and Assessment Language (OVAL). These specifications are encapsulated as data stream files.

Checklist items in XCCDF, also known as rules, express the desired configuration of a system item. For example, a rule may specify that no one can log in to a host over SSH using the root user account. Rules can be grouped into one or more XCCDF profiles, which allows multiple profiles to share a rule.

The OpenSCAP scanner tool evaluates system items on a host against the rules and generates a report in the Asset Reporting Format (ARF), which is then returned to Foreman for monitoring and analysis.

Table 1. Specifications in the SCAP framework 1.3 supported by the OpenSCAP scanner

Title

Description

Version

SCAP

Security Content Automation Protocol

1.3

XCCDF

Extensible Configuration Checklist Description Format

1.2

OVAL

Open Vulnerability and Assessment Language

5.11

-

Asset Identification

1.1

ARF

Asset Reporting Format

1.1

CCE

Common Configuration Enumeration

5.0

CPE

Common Platform Enumeration

2.3

CVE

Common Vulnerabilities and Exposures

2.0

CVSS

Common Vulnerability Scoring System

2.0
Additional resources

3. SCAP content in Foreman

SCAP content is a SCAP data-stream file that contains implementation of compliance, configuration, or security baselines. A single data stream usually includes multiple XCCDF profiles. An XCCDF profile defines an industry standard or custom security standard against which you can evaluate compliance of host configuration in Foreman, such as Protection Profile for General Purpose Operating Systems (OSPP), Health Insurance Portability and Accountability Act (HIPAA), and PCI-DSS v3.2.1 Control Baseline for Enterprise Linux 9. You can adapt existing XCCDF profiles according to your requirements using tailoring files.

In Foreman, you use an XCCDF profile from SCAP content and, eventually, a tailoring file, to define a compliance policy. Foreman includes default SCAP contents from SCAP Security Guide provided by the OpenSCAP project.

For more information on how to download, deploy, modify, and create your own content, see:

3.1. Supported SCAP versions

Foreman supports content of SCAP versions 1.2 and 1.3.

4. Compliance policy deployment options

You can use one of the following methods to deploy compliance policies:

Ansible deployment

You use an Ansible role to configure hosts for compliance scans.

Puppet deployment

You use a Puppet class and the Puppet agent to configure hosts for compliance scans.

Manual deployment

You manually configure hosts for compliance scans.

5. Installing the OpenSCAP plugin

You can install and enable the OpenSCAP plugin to generate SCAP compliance reports. The OpenSCAP plugin consists of the OpenSCAP Foreman plugin, the OpenSCAP Hammer CLI plugin, the OpenSCAP Smart Proxy plugin, and modules for policy deployment.

Procedure

  1. Install the OpenSCAP plugin on your Foreman server:

    # foreman-installer \
--enable-foreman-plugin-openscap \
--enable-foreman-cli-openscap \
--enable-foreman-proxy-plugin-openscap \
--foreman-proxy-plugin-openscap-ansible-module true \
--foreman-proxy-plugin-openscap-puppet-module true

  2. Optional: Install the OpenSCAP plugin on any Smart Proxy servers:

    # foreman-installer \
--enable-foreman-proxy-plugin-openscap \
--foreman-proxy-plugin-openscap-ansible-module true \
--foreman-proxy-plugin-openscap-puppet-module true

6. Configuring compliance policy deployment methods

Use one the following procedures to configure Foreman for the method that you have selected to deploy compliance policies. You will select one of these methods when you later create a compliance policy.

Procedure for Ansible deployment

  1. Import the theforeman.foreman_scap_client Ansible role.

    For more information, see Configuring hosts by using Ansible.

  2. Assign the created policy and the theforeman.foreman_scap_client Ansible role to a host or host group.

  3. To trigger the deployment, run the Ansible role on the host or host group either manually, or set up a recurring job by using remote execution for regular policy updates.

    For more information, see Configuring and Setting Up Remote Jobs in Managing hosts.

Procedure for Puppet deployment

  1. Ensure Puppet is enabled.

  2. Ensure the Puppet agent is installed on hosts.

  3. Import the Puppet environment that contains the foreman_scap_client Puppet module.

    For more information, see Configuring hosts by using Puppet.

  4. Assign the created policy and the foreman_scap_client Puppet class to a host or host group.

    Puppet triggers the deployment on the next regular run or you can run Puppet manually. Puppet runs every 30 minutes by default.

Procedure for manual deployment

  • For the manual deployment method, no additional Foreman configuration is required.

7. Listing available SCAP contents

Use this procedure to view what SCAP contents are already loaded in Foreman. To use the CLI instead of the Foreman web UI, see the CLI procedure.

Prerequisites

  • Your user account has a role assigned that has the view_scap_contents permission.

Procedure

  • In the Foreman web UI, navigate to Hosts > Compliance > SCAP contents.

CLI procedure

  • Run the following Hammer command on Foreman server:

    # hammer scap-content list \
--location "My_Location" \
--organization "My_Organization"

8. Configuring SCAP contents

You can upload SCAP data streams and tailoring files to define compliance policies.

8.1. Loading the default SCAP contents

By loading the default SCAP contents on Foreman server, you ensure that the data streams from the SCAP Security Guide (SSG) are loaded and assigned to all organizations and locations.

SSG is provided by the operating system of Foreman server and installed in /usr/share/xml/scap/ssg/content/. Note that the available data streams depend on the operating system version on which Foreman runs.

Prerequisites

  • Your user account has a role assigned that has the create_scap_contents permission.

Procedure

  • Use the following Hammer command on Foreman server:

    # hammer scap-content bulk-upload --type default

8.2. Getting supported SCAP contents for RHEL

You can get the latest SCAP Security Guide (SSG) for Red Hat Enterprise Linux on the Red Hat Customer Portal. You have to get a version of SSG that is designated for the minor RHEL version of your hosts.

Procedure

  1. Access the SCAP Security Guide in the package browser.

  2. From the Version menu, select the latest SSG version for the minor version of RHEL that your hosts are running. For example, for RHEL 8.6, select a version named *.el8_6.

  3. Download the package RPM.

  4. Extract the data-stream file (*-ds.xml) from the RPM. For example:

    $ rpm2cpio scap-security-guide-0.1.69-3.el8_6.noarch.rpm \
| cpio -iv --to-stdout ./usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
> ssg-rhel-8.6-ds.xml

  5. Upload the data stream to Foreman. For more information, see Uploading additional SCAP content.

Additional resources

8.3. Uploading additional SCAP content

You can upload additional SCAP content into Foreman server, either content created by yourself or obtained elsewhere. For example, you can get the latest OpenSCAP contents for additional systems from the SSG GitHub repository. To use the CLI instead of the Foreman web UI, see the CLI procedure.

Prerequisites

  • Your user account has a role assigned that has the create_scap_contents permission.

  • You have acquired a SCAP data-stream file.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > SCAP contents.

  2. Click Upload New SCAP Content.

  3. Enter a title in the Title text box, such as My SCAP Content.

  4. In Scap File, click Choose file, navigate to the location containing a SCAP data-stream file and click Open.

  5. On the Locations tab, select locations.

  6. On the Organizations tab, select organizations.

  7. Click Submit.

If the SCAP content file is loaded successfully, a message similar to Successfully created My SCAP Content is displayed.

CLI procedure

  1. Place the SCAP data-stream file to a directory on your Foreman server, such as /usr/share/xml/scap/my_content/.

  2. Run the following Hammer command on Foreman server:

    # hammer scap-content bulk-upload --type directory \
--directory /usr/share/xml/scap/my_content/ \
--location "My_Location" \
--organization "My_Organization"
Verification

8.4. Tailoring XCCDF profiles

You can customize existing XCCDF profiles using tailoring files without editing the original SCAP content. A single tailoring file can contain customizations of multiple XCCDF profiles.

You can create a tailoring file using the SCAP Workbench tool. For more information on using the SCAP Workbench tool, see Customizing SCAP Security Guide for your use case.

Then you can assign a tailoring file to a compliance policy to customize an XCCDF profile in the policy.

8.5. Uploading a tailoring file

After uploading a tailoring file, you can apply it in a compliance policy to customize an XCCDF profile.

Prerequisites

  • Your user account has a role assigned that has the create_tailoring_files permission.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Tailoring Files and click New Tailoring File.

  2. Enter a name in the Name text box.

  3. Click Choose File, navigate to the location containing the tailoring file and select Open.

  4. Click Submit to upload the chosen tailoring file.

9. Managing compliance policies

A compliance policy is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content.

You specify the schedule for scans on Foreman server and the scans are performed on hosts. When a scan completes, a report in ARF format is generated and uploaded to Foreman server. The compliance policy makes no changes to the scanned host.

A compliance policy defines a SCAP client configuration and a cron schedule. The policy is then deployed together with the SCAP client on hosts to which the policy is assigned.

9.1. Creating a compliance policy

By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies.

Prerequisites
Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Policies.

  2. Click New Policy or New Compliance Policy.

  3. Select the deployment method: Ansible, Puppet, or Manual. Then click Next.

  4. Enter a name for this policy, a description (optional), then click Next.

  5. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

    Note that Foreman does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the Default XCCDF Profile, will return empty reports.

  6. Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.

  7. Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.

    • If you select Weekly, also select the desired day of the week from the Weekday list.

    • If you select Monthly, also specify the desired day of the month in the Day of month field.

    • If you select Custom, enter a valid Cron expression in the Cron line field.

  8. Select the locations to which to apply the policy, then click Next.

  9. Select the organizations to which to apply the policy, then click Next.

  10. Optional: Select the host groups to which to assign the policy.

  11. Click Submit.

9.2. Viewing a compliance policy

You can preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when you plan policies.

Prerequisites

  • Your user account has a role assigned that has the view_policies permission.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Policies.

  2. In the Actions column of the required policy, click Show Guide or select it from the list.

9.3. Editing a compliance policy

In the Foreman web UI, you can edit compliance policies.

Puppet agent applies an edited policy to the host on the next run. By default, this occurs every 30 minutes. If you use Ansible, you must run the Ansible role manually again or have configured a recurring remote execution job that runs the Ansible role on hosts.

Prerequisites

  • Your user account has a role assigned that has the view_policies and edit_policies permissions.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Policies.

  2. Click the name of the required policy.

  3. Edit the necessary attributes.

  4. Click Submit.

9.4. Deleting a compliance policy

In the Foreman web UI, you can delete existing compliance policies.

Prerequisites

  • Your user account has a role assigned that has the view_policies and destroy_policies permissions.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Policies.

  2. In the Actions column of the required policy, select Delete from the list.

  3. Click OK in the confirmation message.

10. Deploying compliance policies

To deploy a compliance policy, you must install the SCAP client, update the cron schedule file, and upload the SCAP content selected in the policy onto a host.

10.1. Inclusion of remote SCAP resources

SCAP data streams can reference remote resources, such as OVAL files, that the SCAP client fetches over the internet when it runs on hosts. If a data stream requires a remote resource, you can see a warning from the OpenSCAP Scanner tool on your Foreman server, such as:

# oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml | grep "WARNING"
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2'
points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'.
Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file
which is referenced from datastream

By default, the SCAP client is configured to ignore the remote resources and skip the XCCDF rules that rely on the resources. The skipped rules then result in the notchecked status.

For hosts with internet access, you can enable the download of remote resources on hosts in Foreman.

Using the Ansible deployment method

Override the following Ansible variable:

  • Name: foreman_scap_client_fetch_remote_resources

  • Type: boolean

  • Value: true

For more information, see Overriding Ansible Variables in Foreman in Configuring hosts by using Ansible.

Using the Puppet deployment method

Configure the following Puppet Smart Class Parameter:

  • Name: fetch_remote_resources

  • Type: boolean

  • Value: true

For more information, see Configuring Puppet Smart Class Parameters in Configuring hosts by using Puppet.

10.2. Deploying a policy in a host group using Ansible

After you deploy a compliance policy in a host group using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the hosts according to the selected compliance policy.

The SCAP content in the compliance policy might require remote resources. For more information, see Inclusion of remote SCAP resources.

Prerequisites

  • You have enabled OpenSCAP on your Smart Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on Foreman server and enabled on the host. For example, for Enterprise Linux you might require:

    • Enterprise Linux 9 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 8 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 7 Server and Extras RPMs repositories

    You need repositories that provide the openscap-scanner package and its dependencies.

  • Foreman Client repository for the operating system version of the host is synchronized on Foreman server, available in the content view and the lifecycle environment of the host, and enabled for the host. For more information, see Changing the repository sets status for a host in Foreman in Managing content. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Ansible deployment option and assigned the host group.

Procedure

  1. In the Foreman web UI, navigate to Configure > Host Groups.

  2. Click the host group that you want to configure for OpenSCAP reporting.

  3. From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

  4. On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role.

  5. Optional: On the Parameters tab, configure any Ansible variables of the role.

  6. Click Submit to save your changes.

  7. In the row of the required host group, navigate to the Actions column and select Run all Ansible roles.

10.3. Deploying a policy on a host using Ansible

After you deploy a compliance policy on a host using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the host according to the selected compliance policy.

The SCAP content in the compliance policy might require remote resources. For more information, see Inclusion of remote SCAP resources.

Prerequisites

  • You have enabled OpenSCAP on your Smart Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on Foreman server and enabled on the host. For example, for Enterprise Linux you might require:

    • Enterprise Linux 9 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 8 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 7 Server and Extras RPMs repositories

    You need repositories that provide the openscap-scanner package and its dependencies.

  • Foreman Client repository for the operating system version of the host is synchronized on Foreman server, available in the content view and the lifecycle environment of the host, and enabled for the host. For more information, see Changing the repository sets status for a host in Foreman in Managing content. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Ansible deployment option.

Procedure

  1. In the Foreman web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

  2. From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

  3. On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role.

  4. Optional: On the Parameters tab, configure any Ansible variables of the role.

  5. Click Submit to save your changes.

  6. Click the Hosts breadcrumbs link to navigate back to the host index page.

  7. Select the host or hosts to which you want to add the policy.

  8. Click Select Action.

  9. Select Assign Compliance Policy from the list.

  10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

  11. Select the required policy from the list of available policies and click Submit.

  12. Click Select Action.

  13. Select Run all Ansible roles from the list.

10.4. Deploying a policy in a host group using Puppet

After you deploy a compliance policy in a host group using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the hosts on the next Puppet run according to the selected compliance policy.

The SCAP content in your compliance policy might require remote resources. For more information, see Inclusion of remote SCAP resources.

Prerequisites

  • You have enabled OpenSCAP on your Smart Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on Foreman server and enabled on the host. For example, for Enterprise Linux you might require:

    • Enterprise Linux 9 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 8 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 7 Server and Extras RPMs repositories

    You need repositories that provide the openscap-scanner package and its dependencies.

  • Foreman Client repository for the operating system version of the host is synchronized on Foreman server, available in the content view and the lifecycle environment of the host, and enabled for the host. For more information, see Changing the repository sets status for a host in Foreman in Managing content. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Puppet deployment option and assigned the host group.

Procedure

  1. In the Foreman web UI, navigate to Configure > Host Groups.

  2. Click the host group that you want to configure for OpenSCAP reporting.

  3. In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes.

  4. In the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

  5. On the Puppet ENC tab, add the foreman_scap_client Puppet class.

  6. Optional: Configure any Puppet Class Parameters.

  7. Click Submit to save your changes.

10.5. Deploying a policy on a host using Puppet

After you deploy a compliance policy on a host using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the host on the next Puppet run according to the selected compliance policy.

The SCAP content in your compliance policy might require remote resources. For more information, see Inclusion of remote SCAP resources.

Prerequisites

  • You have enabled OpenSCAP on your Smart Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on Foreman server and enabled on the host. For example, for Enterprise Linux you might require:

    • Enterprise Linux 9 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 8 BaseOS and Appstream RPMs repositories

    • Enterprise Linux 7 Server and Extras RPMs repositories

    You need repositories that provide the openscap-scanner package and its dependencies.

  • Foreman Client repository for the operating system version of the host is synchronized on Foreman server, available in the content view and the lifecycle environment of the host, and enabled for the host. For more information, see Changing the repository sets status for a host in Foreman in Managing content. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Puppet deployment option.

Procedure

  1. In the Foreman web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

  2. From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes.

  3. From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

  4. On the Puppet ENC tab, add the foreman_scap_client Puppet class.

  5. Optional: Configure any Puppet Class Parameters.

  6. Click the Hosts breadcrumbs link to navigate back to the host index page.

  7. Select the host or hosts to which you want to add the policy.

  8. Click Select Action.

  9. Select Assign Compliance Policy from the list.

  10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

  11. Select the required policy from the list of available policies and click Submit.

11. Running a security compliance scan on demand

Hosts perform OpenSCAP scans regularly by the CRON schedule defined in the compliance policies assigned to hosts. However, you can also run a scan on a host for all configured compliance policies manually at any time.

Prerequisites

  • Your user account has a role assigned that has the view_hosts, create_job_invocations, and view_job_invocations permissions.

  • You have created a compliance policy and deployed it on the host.

Procedure

  1. Navigate to Hosts > All Hosts.

  2. Click the hostname of the required host.

  3. On the host details page, expand the Schedule a job dropdown menu.

  4. Select Run OpenSCAP scan.

Verification

  1. In the host details overview, locate the Recent jobs card.

  2. Select the Running tab. Unless the job has already finished, the table shows a job called Run scan for all OpenSCAP policies.

  3. On the Recent jobs card, select the Finished tab.

  4. If the job has finished successfully, you should see the succeeded status in the row of the job.

  5. Optional: Click the job name to review invocation details.

12. Monitoring compliance

With Foreman, you can centralize compliance monitoring and management. A compliance dashboard provides an overview of compliance of hosts and the ability to view details for each host within the scope of that policy. Compliance reports provide a detailed analysis of compliance of each host with the applicable policy. With this information, you can evaluate the risks presented by each host and manage the resources required to bring hosts into compliance. By monitoring compliance with SCAP, you can verify policy compliance and detect changes in compliance.

12.1. Searching compliance reports

Use the Compliance Reports search field to filter the list of available reports on any subset of hosts.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Reports.

  2. Optional: To see a list of available search parameters, click the empty Search field.

  3. Enter the search query in the Search field and click Search. The search query is case insensitive.

Search query examples
Find all compliance reports for which more than five rules failed
failed > 5
Find all compliance reports created after January 1, 2023, for hosts with hostnames that contain prod-
host ~ prod- AND date > "Jan 1, 2023"
Find all reports generated by the rhel7_audit compliance policy from an hour ago
"1 hour ago" AND compliance_policy = date = "1 hour ago" AND compliance_policy = rhel7_audit
Find reports that pass an XCCDF rule
xccdf_rule_passed = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Find reports that fail an XCCDF rule
xccdf_rule_failed = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Find reports that have a result different than fail or pass for an XCCDF rule
xccdf_rule_othered = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Additional information

  • You can create complex queries with the following logical operators: and, not and has. For more information about logical operators, see Supported Operators for Granular Search in Administering Foreman.

  • You cannot use regular expressions in a search query. However, you can use multiple fields in a single search expression. For more information about all available search operators, see Supported Operators for Granular Search in Administering Foreman.

  • You can bookmark a search to reuse the same search query. For more information, see Creating Bookmarks in Administering Foreman.

12.2. Compliance email notifications

Foreman server sends an OpenSCAP Summary email to all users who subscribe to the Compliance policy summary email notifications. For more information on subscribing to email notifications, see Configuring Email Notification Preferences in Administering Foreman.

Each time a policy is run, Foreman checks the results against the previous run, noting any changes between them. The email is sent according to the frequency requested by each subscriber, providing a summary of each policy and its most recent result.

12.3. Viewing compliance policy statistics

You can view a compliance policy dashboard to verify compliance reports of a particular policy. The compliance policy dashboard provides a statistical summary of compliance of hosts and the ability to view report details for each host within the scope of that policy.

Consider prioritizing the following hosts when viewing compliance reports:

  • Hosts which were evaluated as Failed

  • Hosts labelled as Never audited because their status is unknown

Prerequisites

  • Your user account has a role assigned that has the view_policies permission.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Policies.

  2. In the row of the required policy, navigate to the Actions column and click Dashboard.

12.4. Remediating compliance failures

With Foreman, you can examine compliance reports and, in some cases, remediate cases of non-compliance. You can remediate compliance failures by using a remediation wizard or by applying remediation snippets manually.

Warning

Always test the recommended remedial actions or scripts in a non-production environment before implementing them in production. Remediation might render the system non-functional.
Prerequisites

  • Your user account has a role assigned that has the following permissions: view_arf_reports, view_hosts, create_job_invocations

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Reports.

  2. In the Reported At column, click the time link of the report you want to examine. Foreman displays a list of log messages describing the results of the scan.

  3. Locate a log message that describes a failed compliance check. In the Actions column, select Remediation to open the compliance remediation wizard. Follow the wizard to remediate the compliance failure.

    Note

    The remediation wizard might not be available for all compliance failures.
Additional resources

12.5. Deleting a compliance report

You can delete compliance reports on your Foreman.

Prerequisites

  • Your user account has a role assigned that has the view_arf_reports and destroy_arf_reports permissions.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Reports.

  2. In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.

  3. Click OK.

12.6. Deleting multiple compliance reports

You can delete multiple compliance policies simultaneously. However, in the Foreman web UI, compliance policies are paginated, so you must delete one page of reports at a time.

Prerequisites

  • Your user account has a role assigned that has the view_arf_reports and destroy_arf_reports permissions.

Procedure

  1. In the Foreman web UI, navigate to Hosts > Compliance > Reports.

  2. In the Compliance Reports window, select the compliance reports that you want to delete.

  3. In the upper right of the list, select Delete reports.

  4. Repeat these steps for as many pages as you want to delete.