OpenSCAP: Tools for managing system security and standards compliance
open-scap.org
open-scap.org
1) what types of things does OpenSCAP audit?
2) does it support my mixture of operating systems?
3) is it for scanning remotely over a network?
4) does it scan the configuration of a computer from a local daemon?
After ~5 minutes of clicking, I eventually found this link:
https://www.open-scap.org/getting-started/
Which explains what they mean by their terms. However, it's not the traditional definition of "getting started" which means installation.
(Also, for some reason the web developer has severely reduced the user experience by hiding items, and only showing them once they have fully scrolled into view, which breaks the large sections of text. It makes it really hard to skim and learn.)
1) SCAP is its own xml based language which includes tests for things like packages installed, sysctl settings, and processes running, but it also has a generic "run this command and check regexp the results" type resource so you can pretty nuch check anything you want with a bit of work. Openscap is an opensource tool for running scap tests.
2) SCAP is a generic standard so it should be applicable to everything, but I've only ever used it on Linux so shrug. I would expect other unix's to be supported.
3) iirc it runs locally, but its pretty trivial to run via puppet (satellite 6 comes with puppet modules) or ansible to run it and pull the reports back to a central server
4) it doesn't run as a daemon, its a binary you run when you want a report. The Satellite puppet modules set up a cron job to run once a week,
Like all these things its only as good as the tests you run and the xml format isn't that easy to write unless you're willing to put in some serious work. There are existing test sets available (again Red Hat supply some) which are a good place to start
> 1) what types of things does OpenSCAP audit?
It uses a big XML file of tests (which generally you don't write - that is supplied by the OS vendor), called OVAL files. The tests can do a lot of stuff, I believe arbitrary stuff, but in general it's things like checking the permissions of files and directories, checking versions of packages installed to see if they are vulnerable, looking for misconfiguration, and so on.
> 2) does it support my mixture of operating systems?
Well you need the vulnerability data - ie. the XML/OVAL files. Red Hat [the company I work for] supply this for all of our Red Hat Enterprise Linux systems, and I believe you can get it for Windows too, but I don't know about others.
Here are the RHEL files: https://www.redhat.com/security/data/oval/
> 3) is it for scanning remotely over a network?
> 4) does it scan the configuration of a computer from a local daemon?
It's running a process inside the machine under test (and hence it's not really good for testing machines which have already been compromised and where the compromise has countermeasures). You can automate the program in the usual ways which would allow you to initiate a scan from your puppetmaster / ansible / whatever.
One of the things I did was extend it so that you can examine a disk image using libguestfs, but unfortunately only a subset of tests is then able to run, basically only those tests that can be done through pure file access. Nevertheless this allows you to scan (eg) all your VMs to see which ones are vulnerable to some subset of problems.
GitHub link: https://github.com/CISOfy/lynis