#openscap — Public Fediverse posts

Automate OpenSCAP remediation on RHEL 9: run `oscap xccdf eval --results arf.xml`, then `oscap xccdf generate fix --fix-type ansible` to produce a playbook that applies all failed rule fixes, like file permissions. Save time, ensure consistency. #openscap #ansible #remediation

https://www.valtersit.com/vault/remediate-openscap-findings-automatically-with-ansible-playb-9a1f18/

Automate compliance fixes: use OpenSCAP's generate-fix to create a Bash remediation script from XCCDF scan results. Maps failed rules to benchmark fixes for RHEL 8/9, CentOS 8, Fedora 36+. #remediation #snippet #openscap

https://www.valtersit.com/vault/remediation-script-generation-from-scan-results-911c2d/

SCAP drift detection via timestamp-based differential scanning: compare current scan start-time to baseline ARF using oscap info. If delta > 24h, full scan; else quick OVAL delta check. Works on RHEL 8, Ubuntu 22.04, Debian 12. #openscap #snippet #drift

https://www.valtersit.com/vault/scap-timestampbased-differential-scanning-for-drift-detectio-8dbf83/

Zum aktuellen Linux-Magazin 04/26 durfte ich neben dem zweiten Artikel über Patch-Management mit #Uyuni (https://www.linux-magazin.de/ausgaben/2026/04/patch-me-if-you-can/) auch Informationen zum Thema #OpenSCAP beitragen.

👉🏻 https://www.linux-magazin.de/ausgaben/2026/04/openscap/

In diesem Artikel werden die Grundlagen des Frameworks erklärt - anhand von Praxisbeispielen wird das Auditieren und automatische Abhärten geschildert.

#Linux #Security

So. one of the things that I am busy with, is part of a lab that will be used at conferences and events around RHEL Image mode (bootc), on building compliance and hardening into the base image. Pretty neat stuff.

You can use OpenSCAP in the Containerfile, and harden the OS before it ever hits hardware. On the other side of it, you get an immutable OS, thats configured to your compliance profile. Pretty cool.

But its due tomorrow, which is what makes it stressful. :P

#redhat #rhel #bootc #linux #openscap #compliance

I found out that hardening #AlpineLinux with use of industry standard tools (to make high-level #production #security) is quite different like #OpenSCAP doesn't work as expected and I'm figuring it out. I know #RHEL-based #Linux would be better for this purpose, but I'm taking the challenge. :blobcatwitch:

Cómo instalar y usar OpenSCAP para mejorar la seguridad de Rocky Linux #RockyLinux #Linux #OpenSCAP

https://algoentremanos.com/como-instalar-usar-openscap-rocky-linux/

Strengthening #Linux Security by Auditing with #OpenSCAP

http://lxer.com/module/newswire/ext_link.php?rid=340247

@zhenech First thought you were talking about #OpenSCAP and became a little worried.

Oh! It's been a while since I commented on #RedHat #ImageBuilder / #osbuild :D Let's correct that.

It's absolute awesome how you can set an #OpenSCAP profile directly in the blueprint. It's also completely useless :) It always performs both an evaluation and remediation step, with no option to turn the remediation off, or to supply a tailored profile with added or excluded tests.

I can't imagine many images being built that don't have some form of post-processing, so running remediation beforehand is either just unwanted or worse, changes things that shouldn't be changed.

Now, I do really mean that the intention is awesome. I just think there weren't too many actual users offering input :) So, this is mine - please take it as constructive criticism.

Nouvelle version 6.1 disponible ! Nous avons amélioré nos plugins de sécurité, comme le plugin de gestion des vulnérabilités, et bien d'autres fonctionnalités ! #CVE #CIS #openscap & variables hiérarchisées
👉 Découvrez les toutes : https://www.rudder.io/fr/open-source/telecharger/

If you look for a hardening guide for your linux system, I can recommend "The practical linux hardening Guide" by trimstray.

https://trimstray.github.io/the-practical-linux-hardening-guide/

Why?

1. It's based on SCAP policies.
2. It uses standards
3. It provides you with references and rationals, not just actions

This will allow you to consider whenever or not you should apply this configuration to your setup.

#linux #security #infosec #OpenSCAP #hardening #centos #Fedora #RHEL