Foreman-OpenSCAP

This plug-in enables automated vulnerability assessment and compliance audit of Foreman based infrastructure.

Current features:
- Centralized policy management
- Set-up organization defined targeting (connect set of system, a policy and time schedule)
- Set-up periodical audits
- Search for not audited systems
- Collect & achieve OpenSCAP audit results from your infrastructure
- Display audit results
- Search audit results
- Search for non-compliant systems
Future features:
- Comparison of audit results
- Waive known issues (one-time waivers, re-occurring, waivers)
- Ad-hoc audit of given machine
- Support for PreupgradeAssistant evaluation
- Vulnerability Assessment (processing OVAL CVE streams)
- E-mail notifications

Usage

Basic Concepts

There are three basic concepts (entities) in OpenSCAP plug-in: SCAP Contents, Compliance Policies and ARF Reports.

SCAP Content represents SCAP DataStream XML file as defined by SCAP 1.2 standard. Datastream file contains implementation of compliance, configuration or security baselines. Users are advised to acquire examplary baseline by installing scap-security-guide package. DataStream file usualy contains multiple XCCDF Profiles. Each for different security target. The content of Datastream file can be inspected by oscap tool from openscap-scanner package.

# yum install -y scap-security-guide openscap-scanner
# oscap info /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml
# oscap info /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

Compliance Policy is highlevel concept of a baseline applied to the infrastructure. Compliance Policy is defined by user on web interface. User may assign following information to the Policy:

SCAP Content
XCCDF Profile from particular SCAP Content
Host Groups that should comply with the policy
Schedule - the period in which the audit shall occur

ARF Report is XML output of single scan occurance per single host. Asset Reporting File format is defined by SCAP 1.2 standard. Foreman plug-in stores the ARF Reports in database for later inspections.

User Interface

The most of the Foreman-OpenSCAP controls are located in the Compliance section under the Host menu. The section contains three items as described in previous section: SCAP Contents, Compliance Policies, ARF Reports.

Prerequisites before the first use

Make sure that

smart_proxy_openscap and puppet-foreman_scap_client packages are installed on your proxies
proxies have Foreman uri defined

# echo ':foreman_url: https://foreman17.local.lan' >> /etc/foreman-proxy/settings.yml

foreman_scap_client puppet class is imported to your Foreman
Go to Configure -> Puppet classes page
Click Import button
Select foreman_scap_client

Setting-up first compliance policy

Log-in to Web Interface
Create new SCAP Content
Go to Hosts -> Compliance -> SCAP contents page
Upload DataSteam file
Create new Policy
Go to Hosts -> Compliance -> Policies page
Assign SCAP Content to Policy
Select Profile from your SCAP Content
Define periodic scan schedule
Assign Hostgroups to the policy (hosts you want to audit should be assigned with one of the hostgroups)
Select particular hosts for compliance audit
Go to Hosts -> All hosts page
Select hosts
Use Select Action -> Assign Compliance Policy button
Make sure the DataStream file is present on the clients' file system.

At the moment, Foreman infrastructure is not able to serve a file to the clients. Hence, users are required to distribute their DataStrem file to each client. The expected location is defined at Compliance Policy -> Edit dialogue.
Inspect the compliance results
Go to Hosts -> Compliance -> Reports page
Wait for ARF Reports to show-up
Go to Hosts -> Compliance -> Policies page
Click the policy link to view dashboard and trend

Installation

Follow the official guide on theforeman.org

Development setup

set up Foreman for development, preferably using forklift

clone this repo

  git clone https://github.com/theforeman/foreman_openscap.git

point foreman to your checkout

echo "gemspec :path => 'path/to/foreman_openscap'" >> foreman/bundler.d/Gemfile.local.rb

run bundler, migrations and seeds from foreman dir

cd foreman
bundle install
rake db:migrate
rake db:seed

start your Rails server, verify openscap plugin is present

Releasing

follow these steps:

Bump the version.rb to desired number
git commit -a -m "Version $number"
rake release

the commit gets tagged with what it find in version.rb

if you have commit permissions, the commit and the tag gets pushed to origin remote

if you're the gem owner, gem is built and uploaded to rubygems.org

Found a bug?

We use the issue tracker at http://projects.theforeman.org/projects/foreman_openscap/issues, it supports github SSO so it's straightforward to open new issues there. If you think you found a bug, please take search through existing issues and if you haven't found any, free free to open a new one. Thank you.

Copyright

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.

theforeman / foreman_openscap Goto Github PK