Red Hat Training

A Red Hat training course is available for Red Hat Satellite

Chapter 6. Managing Security Compliance

Security compliance management is the ongoing process of defining security policies, auditing for compliance with those policies and resolving instances of non-compliance. Any non-compliance is managed according to the organization’s configuration management policies. Security policies range in scope from host-specific to industry-wide, therefore, flexibility in their definition is required.

6.1. Security Content Automation Protocol

Satellite 6 uses the Security Content Automation Protocol (SCAP) to define security configuration policies. For example, a security policy might specify that for hosts running Red Hat Enterprise Linux, login via SSH is not permitted for the root account. With Satellite 6 you can schedule compliance auditing and reporting on all hosts under management. For more information about SCAP, see the Red Hat Enterprise Linux 7 Security Guide.

6.1.1. SCAP Content

SCAP content is a datastream format containing the configuration and security baseline against which hosts are checked. Checklists are described in the extensible checklist configuration description format (XCCDF) and vulnerabilities in the open vulnerability and assessment language (OVAL). Checklist items, also known as rules express the desired configuration of a system item. For example, you may specify that no one can log in to a host over SSH using the root user account. Rules can be grouped into one or more profiles, allowing multiple profiles to share a rule. SCAP content consists of both rules and profiles.

You can either create SCAP content or obtain it from a vendor. Supported profiles are provided for Red Hat Enterprise Linux in the scap-security-guide package. The creation of SCAP content is outside the scope of this guide, but see the Red Hat Enterprise Linux 7 Security Guide or Red Hat Enterprise Linux 6 Security Guide for information on how to download, deploy, modify, and create your own content. The SCAP content provided with Red Hat Enterprise Linux is compliant with SCAP specification 1.2.

The default SCAP content provided with the OpenSCAP components of Satellite 6 depends on the version of Red Hat Enterprise Linux:

  • On Red Hat Enterprise Linux 6, content for Red Hat Enterprise Linux 6 is installed.
  • On Red Hat Enterprise Linux 7, content for both Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7 is installed.

6.1.2. XCCDF Profile

An XCCDF profile is a checklist against which a host or host group is evaluated. Profiles are created to verify compliance with an industry standard or custom standard.

The profiles provided with Satellite 6 are obtained from the OpenSCAP project.

To list available XCCDF profiles, open the Satellite web UI and navigate to Hosts > SCAP contents.

6.2. Configuring SCAP Content

6.2.1. Importing OpenSCAP Puppet Modules

To import the OpenSCAP content into a Puppet environment, you must associate each host that you want to audit with the Puppet environment:

  1. Navigate to Configure > Environments.
  2. Click Import environments from satellite.example.com.

  3. Select the Puppet environment check box associated with the host you want to audit.

    If no Puppet environment exists, select the production environment check box.

  4. Click Update.

6.2.2. Uploading Extra SCAP Content

You can upload extra SCAP content into the Satellite Server, either content created by yourself or obtained elsewhere. SCAP content must be imported into the Satellite Server before being applied in a policy. For example, the scap-security-guide RPM package available in the Red Hat Enterprise Linux 7.2 repositories includes a profile for the Payment Card Industry Data Security Standard (PCI-DSS) version 3. You can upload this content into a Satellite Server even if it is not running Red Hat Enterprise Linux 7.2 as the content is not specific to an operating system version.

To Load the Default OpenSCAP Content:

  • Load the OpenSCAP content on the Satellite Server using the following command: 

    # foreman-rake foreman_openscap:bulk_upload:default

To Upload Extra SCAP Content:

  1. Log in to the Satellite web UI.
  2. Navigate to Hosts > SCAP contents and click New SCAP Content.
  3. Enter a title in the Title text box. For example: RHEL 7.2 SCAP Content.
  4. Click Choose file, navigate to the location containing the SCAP content file and select Open.
  5. Click Submit.

If the SCAP content file is loaded successfully, a message similar to Successfully created RHEL 7.2 SCAP Content is shown and the list of SCAP Contents includes the new title.

6.3. Managing Compliance Policies

6.3.1. Compliance Policy

A scheduled audit, also known as a compliance policy, is a scheduled task that checks the specified hosts for compliance against an XCCDF profile. The schedule for scans is specified by the Satellite Server and the scans are performed on the host. When a scan completes, an Asset Reporting File (ARF) is generated in XML format and uploaded to the Satellite Server. You can see the results of the scan in the compliance policy dashboard. No changes are made to the scanned host by the compliance policy. The SCAP content includes several profiles with associated rules but policies are not included by default.

6.3.2. Creating a Policy

Follow these steps to create a compliance policy, which specifies the SCAP content and profile to be applied to a location and either a host or host group at a specified time.

To Create a Policy:

  1. In the Satellite web UI, navigate to Hosts > Policies, click New Policy and follow the wizard’s steps.
  2. Enter a name for this policy, a description (optional), then click Next.
  3. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

  4. Specify the scheduled time when the policy is to be applied, then click Next.

    Select Weekly, Monthly, or Custom from the Period drop-down list.

    • If you select Weekly, also select the desired day of the week from the Weekday drop-down list.
    • If you select Monthly, also specify the desired day of the month in the Day of month field.

    • If you select Custom, enter a valid Cron expression in the Cron line field.

      The Custom option allows for greater flexibility in the policy’s schedule than either the Weekly or Monthly options.

  5. Select the locations to which the policy is to be applied, then click Next.
  6. Select the organizations to which the policy is to be applied, then click Next.
  7. Select the host groups to which the policy is to be applied, then click Submit.

When the Puppet agent runs on the hosts which belong to the selected host group, or hosts to which the policy has been applied, the OpenSCAP client will be installed and a Cron job added with the policy’s specified schedule. The SCAP Content tab provides the name of the SCAP content file which will be distributed to the directory /var/lib/openscap/content/ on all target hosts.

6.3.3. Viewing a Policy

Follow these steps to preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when planning policies.

To View a Policy:

  1. In the Satellite web UI, navigate to Hosts > Policies.
  2. Click Show Guide.

6.3.4. Editing a Policy

Follow these steps to edit a policy. An edited policy is applied to the host when its Puppet agent next checks with the Satellite Server for updates. By default this occurs every 30 minutes.

To Edit a Policy:

  1. In the Satellite web UI, navigate to Hosts > Policies.
  2. From the drop-down list to the right of the policy’s name, select Edit.
  3. Edit the necessary attributes.
  4. Click Submit.

An edited policy is applied to the host when its Puppet agent next checks with the Satellite Server for updates. By default this occurs every 30 minutes.

6.3.5. Deleting a Policy

Follow these steps to delete an existing policy.

  1. In the Satellite web UI, navigate to Hosts > Policies.
  2. From the drop-down list to the right of the policy’s name, select Delete.
  3. Click OK in the confirmation message.

6.3.6. Adding a Policy to a Host

Follow these steps to add a policy to one or more hosts.

  1. In the Satellite web UI, navigate to Hosts > All hosts.
  2. Select the host or hosts to which you want to add the policy.
  3. Click Select Action.
  4. Select Assign Compliance Policy from the list.
  5. In the new panel that opens, select the appropriate policy from the list of available policies and click Submit.

6.4. Tailoring Files

Tailoring Files allow existing OpenSCAP policies to be customised without forking or rewriting the policy. You can assign a Tailoring File to a policy when creating or updating a policy.

6.4.1. Creating a Tailoring File

You can create a Tailoring File using the SCAP Workbench. For more information on using the SCAP Workbench tool, see Customizing SCAP Security Guide for your use-case.

6.4.2. Uploading a Tailoring File

The following steps show how to upload a Tailoring File:

To Upload a Tailoring File:

  1. Log in to the Satellite web UI.
  2. Navigate to Hosts > Compliance - Tailoring Files and click New Tailoring File.
  3. Enter a name in the Name text box.
  4. Click Choose File, navigate to the location containing the SCAP DataStream Tailoring File and select Open.
  5. Click Submit to upload the chosen Tailoring File.

6.4.3. Assigning a Tailoring File to a Policy

The following steps show how to assign a Tailoring File to a Policy:

To Assign a Tailoring File to a Policy:

  1. Log in to the Satellite web UI.
  2. Navigate to Hosts > Compliance - Policies.
  3. Click New Policy, or New Compliance Policy if there are existing Compliance Policies.
  4. Enter a name in the Name text box, and click Next.
  5. Select a Scap content from the dropdown menu.
  6. Select a XCCDF Profile from the dropdown menu.
  7. Select a Tailoring File from the dropdown menu.

  8. Select a XCCDF Profile in Tailoring File from the dropdown menu.

    It is important to select the XCCDF Profile because Tailoring Files are able to contain multiple XCCDF Profiles.

  9. Click Next.
  10. Select a Period from the dropdown menu.
  11. Select a Weekday from the dropdown menu, and click Next.
  12. Select a Location to move it to the Selected Items window, and click Next.
  13. Select an Organization to move it to the Selected Items window, and click Next.
  14. Select a Hostgroup to move it to the Selected Items window, and click Submit.

6.5. Monitoring Compliance

Monitoring compliance is an ongoing task of ensuring that audits are conducted and that non-compliance is identified. Red Hat Satellite 6 enables centralized compliance monitoring and management. Hosts under Satellite management are checked for compliance according to your custom schedule and details are collated by the Satellite Server. A compliance dashboard provides an overview of hosts' compliance and the ability to view details for each host within the scope of that policy. Compliance reports provide a detailed analysis of each host’s compliance with the applicable policy. With this information you can evaluate the risks presented by each host and better manage the resources required to bring hosts into compliance.

Common objectives when monitoring compliance using SCAP include the following:

  • Verifying policy compliance.
  • Detecting changes in compliance.

The Satellite web UI provides all the necessary information to achieve these objectives. Verify policy compliance with the compliance policy dashboard. Detect changes in policy compliance by either viewing a compliance report’s history or subscribing to notification of changes by email.

6.5.1. Compliance Policy Dashboard

The compliance policy dashboard provides an overview of hosts' compliance with a policy. To view a compliance policy’s dashboard, open the Satellite web UI and navigate to Hosts > Policies, then click the policy’s name. The dashboard provides the following information:

  • A ring chart illustrating a high-level view of hosts' compliance with the policy.
  • A statistical breakdown of hosts' compliance with the policy, in tabular format.
  • Links to the policy’s latest report for each host.

The dashboard view provides a statistical summary of hosts' compliance and is a good starting point for compliance management. For all hosts which were evaluated as non-compliant, the Failed statistic provides a useful metric for prioritizing compliance effort. Those hosts detected as Never audited should also be a priority, since their status is unknown.

Compliance Policy Dashboard

6.5.2. Compliance Reports Overview

A compliance report is the output of a policy run against a host. To list all compliance reports, open the Satellite web UI and navigate to Hosts > Reports. Each report includes the total number of rules passed or failed per policy. By default, reports are listed in descending date order. To change the sort order, click on the label of the column by which you want it sorted. Click on the same label again to change to either descending or ascending order. To view an individual report, click View Report. To view all reports for a host, or a subset of hosts, use the Search field. To delete a compliance report, click the arrow beside View Report and select Delete.

When managing the policy compliance of hosts, it is useful to monitor compliance changes over time. You can use the Search field to narrow the list of reports to one or more hosts and evaluate the changes manually. Alternatively, you can configure notification emails.

6.5.3. Searching Compliance Reports

The Compliance Reports search field allows you to narrow the list of reports. Narrowing your attention on a subset of hosts allows you to focus resources where they are most needed. To apply a filter, enter search criteria in the Search field and either press Enter or click Search. The search performed is case-insensitive. Click on the empty Search field to see a list of available search parameters.

See Table 5.3, “Supported Operators for Granular Search” for details of all available search operators. You can create complex queries with the logical operators: and, not and has. Regular expressions are not valid search criteria, however multiple fields can be used in a single search expression.

Logical Operators

  • not: Negates an expression.
  • has: Object must have a specified property.
  • and: Combines search criteria.

Search Use Cases

The following search criteria finds all compliance reports for which more than five rules failed. 

failed > 5

The following search criteria finds all compliance reports created after November 5, 2015, for hosts whose host name contains the string prod-. 

host ~ prod- AND date > "Nov 5, 2015"

The following search criteria finds all reports generated by the compliance_policy rhel7_audit from an hour ago. 

"1 hour ago" AND compliance_policy = date = "1 hour ago" AND compliance_policy = rhel7_audit

To again list all available compliance reports, delete the Search criteria and press Enter or click Search.

You can bookmark a search, allowing you to apply the same search criteria again.

To Bookmark a Search:

  1. Apply your search criteria.
  2. From the Search list select Bookmark this search.

  3. Complete the Name field.

    If you want the bookmark available to other users of this Satellite instance, select the Public check box.

  4. Click Submit.

To use a bookmark, navigate to Hosts > Reports, click the drop-down item beside the Search button and click the bookmark.

6.5.4. Viewing a Compliance Report

Navigate to Hosts > Reports and click View Report in the row of the specific host.

A compliance report consists of the following sections:

  • Introduction
  • Evaluation Characteristics
  • Compliance and Scoring
  • Rule Overview

6.5.4.1. Evaluation Characteristics

This section provides details about an evaluation against a specific profile, including the host that was evaluated, the profile used in the evaluation, and when the evaluation started and finished. For reference, the IPv4, IPv6, and MAC addresses of the host are also listed.

Evaluation Characteristics

Target machine
The fully-qualified domain name (FQDN) of the evaluated host. Example: test-system.example.com.
Benchmark URL
The URL of the SCAP content against which the host was evaluated. Example: /var/lib/openscap/content/1fbdc87d24db51ca184419a2b6f.
Benchmark ID
The identifier of the benchmark against which the host was evaluated. A benchmark is a set of profiles. Example: xccdf_org.ssgproject.content_benchmark_RHEL_7.
Profile ID
The identifier of the profile against which the host was evaluated. Example: xccdf_org.ssgproject_content_profile_rht-ccp.
Started at
The date and time at which the evaluation started, in ISO 8601 format. Example: 2015-09-12T14:40:02.
Finished at
The date and time at which the evaluation finished, in ISO 8601 format. Example: 2015-09-12T14:40:05.
Performed by
The local account name under which the evaluation was performed on the host. Example: root.

6.5.4.2. Compliance and Scoring

This section provides an overview of whether or not the host is in compliance with the profile’s rules, a breakdown of compliance failures by severity, and an overall compliance score as a percentage. If compliance with a rule was not checked, this is categorized in the Rule results as Other.

6.5.4.3. Rule Overview

This section provides details of every rule and the compliance result, with the rules presented in a hierarchical layout.

Select or clear the check boxes to narrow the list of rules included in the compliance report. For example, if the focus of your review is any non-compliance, clear the pass and informational check boxes.

To search all rules, enter a criterion in the Search field. The search is dynamically applied as you type. The Search field only accepts a single plain-text search term and it is applied as a case-insensitive search. When you perform a search, only those rules whose descriptions match the search criterion will be listed. To remove the search filter, delete the search criterion.

For an explanation of each result, hover the cursor over the status shown in the Result column.

6.5.4.4. Examining Rule Results

To determine why a host failed compliance on a rule, click on the rule’s title. The window which then opens provides further details, including: a description of the rule (with instructions for bringing the host into compliance if available), the rationale for the rule, and in some cases a remediation script.

Warning

Do not implement any of the recommended remedial actions or scripts without first testing them in a non-production environment.

6.5.5. Compliance Email Notifications

The Satellite Server sends an OpenSCAP Summary email to all users who subscribe to the Openscap policy summary email notifications. For more information on subscribing to email notifications see Section 5.1.6, “Configuring Email Notifications”. Each time a policy is run, Satellite checks the results against the previous run, noting any changes between them. The email is sent according to the frequency requested by each subscriber, providing a summary of each policy and its most recent result.

An OpenSCAP Summary email message contains the following information:

  • Details of the time period it covers.
  • Totals for all hosts by status: changed, compliant, and noncompliant.
  • A tabular breakdown of each host and the result of its latest policy, including totals of the rules that passed, failed, changed, or where results were unknown.

6.6. Specifications Supported by OpenSCAP

The following specifications are supported by OpenSCAP:

TitleDescriptionVersion

XCCDF

The Extensible Configuration Checklist Description Format

1.2

OVAL

Open Vulnerability and Assessment Language

5.11

-

Asset Identification

1.1

ARF

Asset Reporting Format

1.1

CCE

Common Configuration Enumeration

5.0

CPE

Common Platform Enumeration

2.3

CVE

Common Vulnerabilities and Exposures

-

CVSS

Common Vulnerability Scoring System

2.0