8.5. Remediating the System to Align with a Specific Baseline Using the SSG Ansible Playbook
SCAP Security Guideproject. This example uses the Protection Profile for General Purpose Operating Systems (OSPP).
Remediateoption enabled might render the system non-functional. Red Hat does not provide any automated method to revert changes made by security-hardening remediations. Remediations are supported on RHEL systems in the default configuration. If your system has been altered after the installation, running remediation might not make it compliant with the required security profile.
- The scap-security-guide package is installed on your RHEL 7 system.
- The ansible package is installed. See the Ansible Installation Guide for more information.
- Remediate your system to align with OSPP using Ansible:
~]#ansible-playbook -i localhost, -c local /usr/share/scap-security-guide/ansible/ssg-rhel7-role-ospp.yml
- Restart the system.
- Evaluate compliance of the system with the OSPP profile, and save scan results in the
~]#oscap xccdf eval --profile ospp --report ospp_report.html /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml