{"id":221,"date":"2018-10-17T06:08:21","date_gmt":"2018-10-17T06:08:21","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/katello-security-compliance-management-with-openscap-lisenet-com-linux-security\/"},"modified":"2018-10-17T06:08:21","modified_gmt":"2018-10-17T06:08:21","slug":"katello-security-compliance-management-with-openscap-lisenet-com-linux-security","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/katello-security-compliance-management-with-openscap-lisenet-com-linux-security\/","title":{"rendered":"Katello: Security Compliance Management with OpenSCAP | Lisenet.com :: Linux | Security"},"content":{"rendered":"

Working with Katello \u2013 part 6. We will configure OpenSCAP plugin to receive automated vulnerability assessment and security compliance audits from Foreman hosts. <\/p>\n

This article is part of the Homelab Project with KVM, Katello and Puppet<\/a> series.<\/p>\n

Homelab<\/h2>\n

We have Katello installed on a CentOS 7 server:<\/p>\n

katello.hl.local (10.11.1.4) \u2013 see here<\/a> for installation instructions<\/p>\n

See the image below to identify the homelab part this article applies to.<\/p>\n

\"\"<\/p>\n

OpenSCAP<\/h2>\n

The Security Content Automation Protocol (SCAP) enables the definition of configuration and security policies, also the means of auditing for compliance with those policies. In Foreman, SCAP is implemented with the tools provided by the OpenSCAP project.<\/p>\n

The OpenSCAP plugin enables Foreman to receive automated vulnerability assessment and security compliance audits from Foreman hosts. We can upload SCAP compliance contents, create compliance policies out of them and assign the policies to hosts or hostgroups.<\/p>\n

Installation<\/h2>\n

Detailed installation instructions can be found on the Foreman website. See references for a weblink.<\/p>\n

We need to install the following:<\/p>\n

    \n
  1. Foreman OpenSCAP (foreman_openscap).<\/li>\n
  2. Smart Proxy OpenSCAP (smart_proxy_openscap).<\/li>\n
  3. foreman_scap_client.<\/li>\n
  4. puppet-foreman_scap_client.<\/li>\n<\/ol>\n

    Install foreman_openscap<\/h3>\n

    # foreman-installer –enable-foreman-plugin-openscap<\/p>\n

    Install smart_proxy_openscap<\/h3>\n

    # foreman-installer –enable-foreman-proxy-plugin-openscap<\/p>\n

    If you want to, you can modify \/etc\/foreman-proxy\/settings.d\/openscap.yml with custom settings.<\/p>\n

    After installing smart_proxy_openscap on the proxy, refresh features of the proxy so it will register with OpenSCAP feature on the Foreman.<\/p>\n

    Install Puppet Module puppet-foreman_scap_client<\/h3>\n

    This puppet module will automatically install foreman_scap_client and configure the client with all parameters needed for the operation of foreman_scap_client.<\/p>\n

    # puppet module install theforeman-foreman_scap_client –environment homelab
    \nNotice: Preparing to install into \/etc\/puppetlabs\/code\/environments\/homelab\/modules …
    \nNotice: Downloading from https:\/\/forgeapi.puppet.com …
    \nNotice: Installing — do not interrupt …
    \n\/etc\/puppetlabs\/code\/environments\/homelab\/modules
    \n\u2514\u2500\u252c theforeman-foreman_scap_client (v0.3.18)
    \n \u2514\u2500\u2500 puppetlabs-stdlib (v4.24.0)<\/p>\n

    After installing the module, import new Puppet classes via Katello WebUI:<\/p>\n

    Configure > Puppet Classes > Import environments from katello.hl.local<\/p>\n

    Setup Foreman Plugins Repository<\/h3>\n

    Starting with puppet-foreman_scap_client 0.3.14 shipped with Foreman 1.14 the Foreman plugins yum repo can be set up if you define at least Foreman\u2019s major release version. This repository is needed to install foreman_scap_client, which will fail otherwise. <\/p>\n

    Note that packages are not signed.<\/p>\n

    Create a new repository and sync it:<\/p>\n

    # hammer repository create
    \n –product “el7_repos”
    \n –name “foreman-plugins-117”
    \n –label “foreman-plugins-117”
    \n –content-type “yum”
    \n –download-policy “on_demand”
    \n –url “https:\/\/yum.theforeman.org\/plugins\/1.17\/el7\/x86_64\/”
    \n# hammer repository synchronize
    \n –name “foreman-plugins-117”
    \n –product “el7_repos”<\/p>\n

    Add the new repository to the content view:<\/p>\n

    # hammer content-view add-repository
    \n –name “el7_content”
    \n –product “el7_repos”
    \n –repository “foreman-plugins-117”<\/p>\n

    Publish a new version of the content view that includes the Foreman plugins repository:<\/p>\n

    # hammer content-view publish
    \n –name “el7_content”
    \n –description “Publishing foreman plugins 1.17”<\/p>\n

    Let us see the version number that we want to promote:<\/p>\n

    # hammer content-view version list<\/p>\n

    Promote content view version to our \u201cstable\u201d lifecycle environment:<\/p>\n

    # hammer content-view version promote
    \n –content-view “el7_content”
    \n –version “11.0”
    \n –to-lifecycle-environment “stable”
    \n –description “Publishing foreman plugins 1.17”<\/p>\n

    At this point the new repository should be available to clients.<\/p>\n

    Usage<\/h2>\n

    Create Default SCAP Content<\/h3>\n

    This following will search for scap-security-guide SCAP contents and create SCAP content on the Foreman.<\/p>\n

    # foreman-rake foreman_openscap:bulk_upload:default
    \nSaved \/usr\/share\/xml\/scap\/ssg\/content\/ssg-centos6-ds.xml as Red Hat centos6 default content
    \nSaved \/usr\/share\/xml\/scap\/ssg\/content\/ssg-centos7-ds.xml as Red Hat centos7 default content
    \nSaved \/usr\/share\/xml\/scap\/ssg\/content\/ssg-firefox-ds.xml as Red Hat firefox default content
    \nSaved \/usr\/share\/xml\/scap\/ssg\/content\/ssg-jre-ds.xml as Red Hat jre default content
    \nSaved \/usr\/share\/xml\/scap\/ssg\/content\/ssg-rhel6-ds.xml as Red Hat rhel6 default content
    \nSaved \/usr\/share\/xml\/scap\/ssg\/content\/ssg-rhel7-ds.xml as Red Hat rhel7 default content<\/p>\n

    Create Policy Wizard<\/h3>\n

    Open Katello WebUI and navigate to the following:<\/p>\n

    Hosts > Compliance > Policies > New Compliance Policy<\/p>\n

    \"\"<\/p>\n

    Create a new policy and provide the following details:<\/p>\n

      \n
    1. Name of the policy (e.g. homelab).<\/li>\n
    2. Choose which SCAP content and SCAP profile to apply (e.g. STIG).<\/li>\n
    3. Choose schedule when to run this policy (e.g. weekly on Sundays).<\/li>\n
    4. Select which location \/ organization thes policy belongs to (e.g. Lisenet \/ HomeLab).<\/li>\n
    5. Choose which hostgroups you wish to pply this policy to (e.g. el7_group).<\/li>\n<\/ol>\n

      The result should look something like this:<\/p>\n

      \"\"<\/p>\n

      This will assign the policy to the specified hostgroup. All hosts which belong to the hostgroup will automatically be assigned to the policy, and the Puppet class will be included.<\/p>\n

      \"\"<\/p>\n

      Open Katello WebUI, edit Host Group and specify OpenSCAP Proxy:<\/p>\n

      \"\"<\/p>\n

      Make sure that all hosts that are assigned to the hostgroup have OpenSCAP Proxy assigned.<\/p>\n

      Hosts will get foreman_scap_client automatically installed and configured on the next Puppet agent run. There will be a cron file created \/etc\/cron.d\/foreman_scap_client_cron that runs according to the schedule that was chosen when creating the policy.<\/p>\n

      How to Run foreman_scap_client Manually<\/h3>\n

      Check the content of the cron file on a host you want to run the client on (we use db1.hl.local):<\/p>\n

      [db1]# cat \/etc\/cron.d\/foreman_scap_client_cron
      \n# DO NOT EDIT THIS FILE MANUALLY
      \n# IT IS MANAGED BY PUPPET
      \n
      \n# foreman_scap_client cron job
      \n
      \n# Runs foreman_scap_client 1
      \n0 1 * * 0 root \/usr\/bin\/foreman_scap_client 1 > \/dev\/null<\/p>\n

      Copy the line from the file and run:<\/p>\n

      [db1]# \/usr\/bin\/foreman_scap_client 1
      \n[…]
      \nUploading results to https:\/\/katello.hl.local:9090\/compliance\/arf\/1<\/p>\n

      Reports can be found here: Hosts > Compliance > Reports<\/p>\n

      \"\"<\/p>\n

      SCAP Workbench and Tailoring Files<\/h3>\n

      Default SCAP policies may not suit your needs and can therefore be edited. SCAP Workbench is a graphical utility that offers an easy way of doing that.<\/p>\n

      Workbench allows you to modify an XCCDF profile in an easy way without changing the respective XCCDF file. The tool provides a graphical way to enable or disable XCCDF elements. Your changes can be stored as an XCCDF tailoring file.<\/p>\n

      References<\/h2>\n

      https:\/\/www.theforeman.org\/plugins\/foreman_openscap\/0.8\/index.html<\/a><\/p>\n

      https:\/\/www.open-scap.org\/tools\/scap-workbench\/<\/a><\/p>\n

      Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

      Working with Katello \u2013 part 6. We will configure OpenSCAP plugin to receive automated vulnerability assessment and security compliance audits from Foreman hosts. This article is part of the Homelab Project with KVM, Katello and Puppet series. Homelab We have Katello installed on a CentOS 7 server: katello.hl.local (10.11.1.4) \u2013 see here for installation instructions … <\/p>\n

      Continue reading “Katello: Security Compliance Management with OpenSCAP | Lisenet.com :: Linux | Security”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-221","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=221"}],"version-history":[{"count":0,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/221\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}