Managing security compliance

Access the SCAP Security Guide in the package browser.

From the Version menu, select the latest SSG version for the minor version of RHEL that your hosts are running. For example, for RHEL 8.6, select a version named *.el8_6.

Download the package RPM.

Extract the data-stream file (*-ds.xml) from the RPM. For example:

$ rpm2cpio scap-security-guide-0.1.69-3.el8_6.noarch.rpm \
| cpio -iv --to-stdout ./usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
> ssg-rhel-8.6-ds.xml

Upload the data stream to Foreman. For more information, see Uploading additional SCAP content.

In the Foreman web UI, navigate to Hosts > Compliance > SCAP contents.

Click Upload New SCAP Content.

Enter a title in the Title text box, such as My SCAP Content.

In Scap File, click Choose file, navigate to the location containing a SCAP data-stream file and click Open.

On the Locations tab, select locations.

On the Organizations tab, select organizations.

Click Submit.

Place the SCAP data-stream file to a directory on your Foreman server, such as /usr/share/xml/scap/my_content/.

Run the following Hammer command on Foreman server:

# hammer scap-content bulk-upload --type directory \
--directory /usr/share/xml/scap/my_content/ \
--location "My_Location" \
--organization "My_Organization"

In the Foreman web UI, navigate to Hosts > Compliance > Tailoring Files and click New Tailoring File.

Enter a name in the Name text box.

Click Choose File, navigate to the location containing the tailoring file and select Open.

Click Submit to upload the chosen tailoring file.

In the Foreman web UI, navigate to Hosts > Compliance > Policies.

Click New Policy or New Compliance Policy.

Select the deployment method: Ansible, Puppet, or Manual. Then click Next.

Enter a name for this policy, a description (optional), then click Next.

Select the SCAP Content and XCCDF Profile to be applied, then click Next.

Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.

Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.

Select the locations to which to apply the policy, then click Next.

Select the organizations to which to apply the policy, then click Next.

Optional: Select the host groups to which to assign the policy.

Click Submit.

In the Foreman web UI, navigate to Hosts > Compliance > Policies.

In the Actions column of the required policy, click Show Guide or select it from the list.

In the Foreman web UI, navigate to Hosts > Compliance > Policies.

Click the name of the required policy.

Edit the necessary attributes.

Click Submit.

In the Foreman web UI, navigate to Hosts > Compliance > Policies.

In the Actions column of the required policy, select Delete from the list.

Click OK in the confirmation message.

In the Foreman web UI, navigate to Configure > Host Groups.

Click the host group that you want to configure for OpenSCAP reporting.

From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role.

Optional: On the Parameters tab, configure any Ansible variables of the role.

Click Submit to save your changes.

In the row of the required host group, navigate to the Actions column and select Run all Ansible roles.

In the Foreman web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role.

Optional: On the Parameters tab, configure any Ansible variables of the role.

Click Submit to save your changes.

Click the Hosts breadcrumbs link to navigate back to the host index page.

Select the host or hosts to which you want to add the policy.

Click Select Action.

Select Assign Compliance Policy from the list.

In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

Select the required policy from the list of available policies and click Submit.

Click Select Action.

Select Run all Ansible roles from the list.

In the Foreman web UI, navigate to Configure > Host Groups.

Click the host group that you want to configure for OpenSCAP reporting.

In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes.

In the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Puppet ENC tab, add the foreman_scap_client Puppet class.

Optional: Configure any Puppet Class Parameters.

Click Submit to save your changes.

In the Foreman web UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes.

From the OpenSCAP Smart Proxy list, select the Smart Proxy with OpenSCAP enabled that you want to use.

On the Puppet ENC tab, add the foreman_scap_client Puppet class.

Optional: Configure any Puppet Class Parameters.

Click the Hosts breadcrumbs link to navigate back to the host index page.

Select the host or hosts to which you want to add the policy.

Click Select Action.

Select Assign Compliance Policy from the list.

In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

Select the required policy from the list of available policies and click Submit.

In the Foreman web UI, navigate to Hosts > Compliance > Reports.

Optional: To see a list of available search parameters, click the empty Search field.

Enter the search query in the Search field and click Search. The search query is case insensitive.

In the Foreman web UI, navigate to Hosts > Compliance > Policies.

In the row of the required policy, navigate to the Actions column and click Dashboard.

In the Foreman web UI, navigate to Hosts > Compliance > Reports.

In the Reported At column, navigate to the report of the required host and compliance policy, and click the time link.

Foreman displays a simplified list of policy rules with the results of the scan.

Optional: Filter the rules by check result. From the Show log messages dropdown list, select one of the following filters:

Optional: Examine the details of the rule. In the Message column, click the icon next to the name of the rule.

In the row of the required rule, navigate to the Actions column and click Hosts failing this rule.

In the Foreman web UI, navigate to Hosts > Compliance > Reports to list all compliance reports.

In the row of the required host, navigate to the Actions column and click Full Report to view the complete details of an evaluation report.

Navigate to the Evaluation Characteristics area to review basic details about the evaluation of the host against a specific profile.

Navigate to the Compliance and Scoring area to review evaluation statistics and the host compliance score.

Navigate to the Rule Overview to examine the rules.

Optional: Deselect the check statuses that you want to hide, such as pass, notapplicable, or fixed.

Optional: From the Group rule by dropdown menu, select the criterion for the grouping of rules, such as Severity.

Optional: Enter a search string into the search field to filter rules by title. The search is case insensitive and applied dynamically as you type.

Click the title of a rule to inspect further result details:

In the Foreman web UI, navigate to Hosts > Compliance > Reports.

In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.

Click OK.

In the Foreman web UI, navigate to Hosts > Compliance > Reports.

In the Compliance Reports window, select the compliance reports that you want to delete.

In the upper right of the list, select Delete reports.

Repeat these steps for as many pages as you want to delete.