1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
.TH scap-security-guide 8 "26 Jan 2013" "version 1"
.SH NAME
SCAP-Security-Guide \- Delivers security guidance, baselines, and
associated validation mechanisms utilizing the Security Content
Automation Protocol (SCAP).
.SH DESCRIPTION
The project provides practical security hardening advice
and also links it to compliance requirements in order to ease deployment
activities, such as certification and accreditation. These include requirements
in the U.S. government (Federal, Defense, and Intelligence Community) as well
as of the financial services and health care industries. For example,
high-level and widely-accepted policies such as NIST 800-53 provides prose
stating that System Administrators must audit "privileged user actions," but do
not define what "privileged actions" are. The SSG bridges the gap between
generalized policy requirements and specific implementation guidance, in SCAP
formats to support automation whenever possible.
The projects homepage is located at:
https://www.open-scap.org/security-policies/scap-security-guide
{{% for product in products %}}
.SH Profiles in {{{ product.title }}}
Source data stream: \fI {{{ product.ds_filename }}} \fR
The {{{ product.title }}} is broken into 'profiles', groupings of security settings
that correlate to a known policy. Available profiles are:
{{% for profile in product.profiles %}}
.B {{{ profile.title }}}
.RS
Profile ID: \fI {{{ profile.profile_id }}} \fR
{{{ profile.description }}}
.RE
{{% endfor %}}
{{% endfor %}}
.SH EXAMPLES
To scan your system utilizing the OpenSCAP utility against the
ospp profile:
oscap xccdf eval --profile ospp \
--results-arf /tmp/`hostname`-ssg-results.xml \
--report /tmp/`hostname`-ssg-results.html \
{{{ install_prefix }}}/{{{ content_path }}}/ssg-{product}-xccdf.xml
.PP
Additional details can be found on the following websites:
https://www.github.com/ComplianceAsCode/content
.RS
The project's Github page.
.RE
https://complianceascode.readthedocs.io
.RS
The project's ReadTheDocs page.
.RE
https://app.gitter.im/#/room/#Compliance-As-Code-The_content:gitter.im
.RS
The project's Gitter IM space
.RE
.SH FILES
.I {{{ install_prefix }}}/{{{ content_path }}}
.RS
Houses SCAP content utilizing the following naming conventions:
.I SCAP Source data streams:
ssg-{product}-ds.xml
{{% if xccdf_oval_ocil_cpes -%}}
.I CPE Dictionaries:
ssg-{product}-cpe-dictionary.xml
.I CPE OVAL Content:
ssg-{product}-cpe-oval.xml
.I OVAL Content:
ssg-{product}-oval.xml
.I XCCDF Content:
ssg-{product}-xccdf.xml
{{%- endif %}}
.RE
{{% if guides_path -%}}
.I {{{ install_prefix }}}/{{{ guides_path }}}
.RS
HTML versions of SSG profiles.
.RE
{{%- endif %}}
{{% if ansible_profile_playbooks_path -%}}
.I {{{ install_prefix }}}/{{{ ansible_profile_playbooks_path }}}/
.RS
Contains Ansible Playbooks for SSG profiles.
.RE
{{%- endif %}}
{{% if ansible_playbooks_generated_for_all_rules_path -%}}
.I {{{ install_prefix }}}/{{{ ansible_playbooks_generated_for_all_rules_path }}}
.RS
Contains Ansible Playbooks for individual rules.
.RE
{{%- endif %}}
{{% if bash_profile_scripts_path -%}}
.I {{{ install_prefix }}}/{{{ bash_profile_scripts_path }}}/
.RS
Contains Bash remediation scripts for SSG profiles.
.RE
{{%- endif %}}
{{% if kickstarts_path -%}}
.I {{{ install_prefix }}}/{{{ kickstarts_path }}}/
.RS
Contains example kickstarts that install systems hardened against a particular profile.
.RE
{{%- endif %}}
{{% if tailoring_path -%}}
.I {{{ install_prefix }}}/{{{ tailoring_path }}}/
.RS
Contains tailoring files that enable rules that are not covered by third-party SCAP content and disables rules that are covered by the content shipped in scap-security-guide.
.RE
{{%- endif %}}
.SH SEE ALSO
.B oscap(8)
.SH AUTHOR
Please direct all questions to the SSG mailing list:
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
|
