Managing Security Compliance

Security compliance management

Security compliance management is the ongoing process of defining security policies, auditing systems for compliance with those policies, and resolving instances of non-compliance. Any non-compliance is managed according to the organization’s configuration management policies. Security policies range in scope from host-specific to industry-wide, therefore, flexibility in their definition is required.

With orcharhino, you can schedule compliance auditing and reporting on all registered hosts.

You can use OpenSCAP to perform security scans on managed hosts. Every orcharhino Client contains the necessary SCAP client for managed hosts.

On managed hosts running AlmaLinux, Amazon Linux, CentOS, Oracle Linux, Red Hat Enterprise Linux, Rocky Linux, or SUSE Linux Enterprise Server, install rubygem-foreman_scap_client. On managed hosts running Debian or Ubuntu, install ruby-foreman-scap-client.

Security content automation protocol

orcharhino uses the Security Content Automation Protocol (SCAP) standard to define security policies.

SCAP is a framework of several specifications based on XML, such as checklists described in the Extensible Checklist Configuration Description Format (XCCDF) and vulnerabilities described in the Open Vulnerability and Assessment Language (OVAL). These specifications are encapsulated as data stream files.

Checklist items in XCCDF, also known as rules, express the desired configuration of a system item. For example, a rule may specify that no one can log in to a host over SSH using the root user account. Rules can be grouped into one or more XCCDF profiles, which allows multiple profiles to share a rule.

The OpenSCAP scanner tool evaluates system items on a host against the rules and generates a report in the Asset Reporting Format (ARF), which is then returned to orcharhino for monitoring and analysis.

Table 1. Specifications in the SCAP framework 1.3 supported by the OpenSCAP scanner

Title

Description

Version

SCAP

Security Content Automation Protocol

1.3

XCCDF

Extensible Configuration Checklist Description Format

1.2

OVAL

Open Vulnerability and Assessment Language

5.11

-

Asset Identification

1.1

ARF

Asset Reporting Format

1.1

CCE

Common Configuration Enumeration

5.0

CPE

Common Platform Enumeration

2.3

CVE

Common Vulnerabilities and Exposures

2.0

CVSS

Common Vulnerability Scoring System

2.0
Additional resources

SCAP content in orcharhino

SCAP content is a SCAP data-stream file that contains implementation of compliance, configuration, or security baselines. A single data stream usually includes multiple XCCDF profiles. An XCCDF profile defines an industry standard or custom security standard against which you can evaluate compliance of host configuration in orcharhino, such as Protection Profile for General Purpose Operating Systems (OSPP), Health Insurance Portability and Accountability Act (HIPAA), and PCI-DSS v3.2.1 Control Baseline for Enterprise Linux 9. You can adapt existing XCCDF profiles according to your requirements using tailoring files.

In orcharhino, you use an XCCDF profile from SCAP content and, eventually, a tailoring file, to define a compliance policy. orcharhino includes default SCAP contents from SCAP Security Guide provided by the OpenSCAP project.

Supported SCAP versions

orcharhino supports content of SCAP versions 1.2 and 1.3.

Compliance policy deployment options

You can use one of the following methods to deploy compliance policies:

Ansible deployment

You use an Ansible role to configure hosts for compliance scans.

Puppet deployment

You use a Puppet class and the Puppet agent to configure hosts for compliance scans.

Manual deployment

You manually configure hosts for compliance scans.

Installing the OpenSCAP plugin

You can install and enable the OpenSCAP plugin to generate SCAP compliance reports. The OpenSCAP plugin consists of the OpenSCAP orcharhino plugin, the OpenSCAP Hammer CLI plugin, the OpenSCAP orcharhino Proxy plugin, and modules for policy deployment.

Procedure

  1. Install the OpenSCAP plugin on your orcharhino Server:

    $ orcharhino-installer \
--enable-foreman-plugin-openscap \
--enable-foreman-cli-openscap \
--enable-foreman-proxy-plugin-openscap \
--foreman-proxy-plugin-openscap-ansible-module true \
--foreman-proxy-plugin-openscap-puppet-module true

  2. Optional: Install the OpenSCAP plugin on any orcharhino Proxy Servers:

    $ orcharhino-installer \
--enable-foreman-proxy-plugin-openscap \
--foreman-proxy-plugin-openscap-ansible-module true \
--foreman-proxy-plugin-openscap-puppet-module true

Configuring compliance policy deployment methods

Use one the following procedures to configure orcharhino for the method that you have selected to deploy compliance policies. You will select one of these methods when you later create a compliance policy.

Procedure for Ansible deployment

  1. Import the theforeman.foreman_scap_client Ansible role.

    For more information, see Managing Hosts using Ansible.

  2. Assign the created policy and the theforeman.foreman_scap_client Ansible role to a host or host group.

  3. To trigger the deployment, run the Ansible role on the host or host group either manually, or set up a recurring job by using remote execution for regular policy updates.

    For more information, see Configuring and Setting Up Remote Jobs in Managing Hosts.

Procedure for Puppet deployment

  1. Ensure Puppet is enabled.

  2. Ensure the Puppet agent is installed on hosts.

  3. Import the Puppet environment that contains the foreman_scap_client Puppet module.

    For more information, see Configuring Hosts Using Puppet.

  4. Assign the created policy and the foreman_scap_client Puppet class to a host or host group.

    Puppet triggers the deployment on the next regular run or you can run Puppet manually. Puppet runs every 30 minutes by default.

Procedure for manual deployment

  • For the manual deployment method, no additional orcharhino configuration is required.

Listing available SCAP contents

Use this procedure to view what SCAP contents are already loaded in orcharhino. To use the CLI instead of the orcharhino management UI, see the CLI procedure.

Prerequisites

  • Your user account has a role assigned that has the view_scap_contents permission.

Procedure

  • In the orcharhino management UI, navigate to Hosts > Compliance > SCAP contents.

CLI procedure

  • Run the following Hammer command on orcharhino Server:

    $ hammer scap-content list \
--location "My_Location" \
--organization "My_Organization"

Configuring SCAP contents

You can upload SCAP data streams and tailoring files to define compliance policies.

Loading the default SCAP contents

By loading the default SCAP contents on orcharhino Server, you ensure that the data streams from the SCAP Security Guide (SSG) are loaded and assigned to all organizations and locations.

SSG is provided by the operating system of orcharhino Server and installed in /usr/share/xml/scap/ssg/content/. Note that the available data streams depend on the operating system version on which orcharhino runs.

Prerequisites

  • Your user account has a role assigned that has the create_scap_contents permission.

Procedure

  • Use the following Hammer command on orcharhino Server:

    $ hammer scap-content bulk-upload --type default

Getting supported SCAP contents for RHEL

You can get the latest SCAP Security Guide (SSG) for Enterprise Linux on the Red Hat Customer Portal. You have to get a version of SSG that is designated for the minor RHEL version of your hosts.

Procedure

  1. Access the SCAP Security Guide in the package browser.

  2. From the Version menu, select the latest SSG version for the minor version of RHEL that your hosts are running. For example, for RHEL 8.6, select a version named *.el8_6.

  3. Download the package RPM.

  4. Extract the data-stream file (*-ds.xml) from the RPM. For example:

    $ rpm2cpio scap-security-guide-0.1.69-3.el8_6.noarch.rpm \
| cpio -iv --to-stdout ./usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
> ssg-rhel-8.6-ds.xml

  5. Upload the data stream to orcharhino. For more information, see Uploading Additional SCAP Content.

Additional resources

Uploading additional SCAP content

You can upload additional SCAP content into orcharhino Server, either content created by yourself or obtained elsewhere. For example, you can get the latest OpenSCAP contents for additional systems from the SSG GitHub repository. To use the CLI instead of the orcharhino management UI, see the CLI procedure.

Prerequisites

  • Your user account has a role assigned that has the create_scap_contents permission.

  • You have acquired a SCAP data-stream file.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > SCAP contents.

  2. Click Upload New SCAP Content.

  3. Enter a title in the Title text box, such as My SCAP Content.

  4. In Scap File, click Choose file, navigate to the location containing a SCAP data-stream file and click Open.

  5. On the Locations tab, select locations.

  6. On the Organizations tab, select organizations.

  7. Click Submit.

If the SCAP content file is loaded successfully, a message similar to Successfully created My SCAP Content is displayed.

CLI procedure

  1. Place the SCAP data-stream file to a directory on your orcharhino Server, such as /usr/share/xml/scap/my_content/.

  2. Run the following Hammer command on orcharhino Server:

    $ hammer scap-content bulk-upload --type directory \
--directory /usr/share/xml/scap/my_content/ \
--location "My_Location" \
--organization "My_Organization"
Verification

Tailoring XCCDF profiles

You can customize existing XCCDF profiles using tailoring files without editing the original SCAP content. A single tailoring file can contain customizations of multiple XCCDF profiles.

You can create a tailoring file using the SCAP Workbench tool. For more information on using the SCAP Workbench tool, see Customizing SCAP Security Guide for your use case.

Then you can assign a tailoring file to a compliance policy to customize an XCCDF profile in the policy.

Uploading a tailoring file

After uploading a tailoring file, you can apply it in a compliance policy to customize an XCCDF profile.

Prerequisites

  • Your user account has a role assigned that has the create_tailoring_files permission.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Tailoring Files and click New Tailoring File.

  2. Enter a name in the Name text box.

  3. Click Choose File, navigate to the location containing the tailoring file and select Open.

  4. Click Submit to upload the chosen tailoring file.

Managing compliance policies

A compliance policy is a scheduled audit that checks the specified hosts for compliance against a specific XCCDF profile from a SCAP content.

You specify the schedule for scans on orcharhino Server and the scans are performed on hosts. When a scan completes, a report in ARF format is generated and uploaded to orcharhino Server. The compliance policy makes no changes to the scanned host.

A compliance policy defines a SCAP client configuration and a cron schedule. The policy is then deployed together with the SCAP client on hosts to which the policy is assigned.

Creating a compliance policy

By creating a compliance policy, you can define and plan your security compliance requirements, and ensure that your hosts remain compliant to your security policies.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Policies.

  2. Click New Policy or New Compliance Policy.

  3. Select the deployment method: Ansible, Puppet, or Manual. Then click Next.

  4. Enter a name for this policy, a description (optional), then click Next.

  5. Select the SCAP Content and XCCDF Profile to be applied, then click Next.

    Note that orcharhino does not detect whether the selected XCCDF profile contains any rules. An empty XCCDF profile, such as the Default XCCDF Profile, will return empty reports.

  6. Optional: To customize the XCCDF profile, select a Tailoring File and a XCCDF Profile in Tailoring File, then click Next.

  7. Specify the scheduled time when the policy is to be applied. Select Weekly, Monthly, or Custom from the Period list. The Custom option allows for greater flexibility in the policy’s schedule.

    • If you select Weekly, also select the desired day of the week from the Weekday list.

    • If you select Monthly, also specify the desired day of the month in the Day of month field.

    • If you select Custom, enter a valid Cron expression in the Cron line field.

  8. Select the locations to which to apply the policy, then click Next.

  9. Select the organizations to which to apply the policy, then click Next.

  10. Optional: Select the host groups to which to assign the policy.

  11. Click Submit.

Viewing a compliance policy

You can preview the rules which will be applied by specific OpenSCAP content and profile combination. This is useful when you plan policies.

Prerequisites

  • Your user account has a role assigned that has the view_policies permission.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Policies.

  2. In the Actions column of the required policy, click Show Guide or select it from the list.

Editing a compliance policy

In the orcharhino management UI, you can edit compliance policies.

Puppet agent applies an edited policy to the host on the next run. By default, this occurs every 30 minutes. If you use Ansible, you must run the Ansible role manually again or have configured a recurring remote execution job that runs the Ansible role on hosts.

Prerequisites

  • Your user account has a role assigned that has the view_policies and edit_policies permissions.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Policies.

  2. Click the name of the required policy.

  3. Edit the necessary attributes.

  4. Click Submit.

Deleting a compliance policy

In the orcharhino management UI, you can delete existing compliance policies.

Prerequisites

  • Your user account has a role assigned that has the view_policies and destroy_policies permissions.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Policies.

  2. In the Actions column of the required policy, select Delete from the list.

  3. Click OK in the confirmation message.

Deploying compliance policies

To deploy a compliance policy, you must install the SCAP client, update the cron schedule file, and upload the SCAP content selected in the policy onto a host.

Inclusion of remote SCAP resources

SCAP data streams can reference remote resources, such as OVAL files, that the SCAP client fetches over the internet when it runs on hosts. If a data stream requires a remote resource, you can see a warning from the OpenSCAP Scanner tool on your orcharhino Server, such as:

$ oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml | grep "WARNING"
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2'
points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'.
Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file
which is referenced from datastream

By default, the SCAP client is configured to ignore the remote resources and skip the XCCDF rules that rely on the resources. The skipped rules then result in the notchecked status.

For hosts with internet access, you can enable the download of remote resources on hosts in orcharhino. For information about applying remote SCAP resources to hosts that cannot access the internet, see applying remote scap resources in a disconnected environment.

Using the Ansible deployment method

Override the following Ansible variable:

  • Name: foreman_scap_client_fetch_remote_resources

  • Type: boolean

  • Value: true

For more information, see Overriding Ansible Variables in orcharhino in Managing Hosts using Ansible.

Using the Puppet deployment method

Configure the following Puppet Smart Class Parameter:

  • Name: fetch_remote_resources

  • Type: boolean

  • Value: true

For more information, see Configuring Puppet Smart Class Parameters in Configuring Hosts Using Puppet.

Applying remote SCAP resources in a disconnected environment

SCAP data streams can contain remote resources, such as OVAL files, that the SCAP client can fetch over the internet when it runs on hosts. If your hosts do not have internet access, you must download remote SCAP resources and distribute them from orcharhino Server to your hosts as local files by downloading the files on hosts from a file type repository.

Prerequisites

  • You have registered your host to orcharhino with remote execution enabled.

  • Fetching remote resources must be disabled, which is the default. For more information, see inclusion of remote scap resources.

Procedure

  1. On your orcharhino Server, examine the data stream you use in your compliance policy to find out which missing resource you must download:

    $ oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml | grep "WARNING"
WARNING: Datastream component 'scap_org.open-scap_cref_security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2'
points out to the remote 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2'.
Use '--fetch-remote-resources' option to download it.
WARNING: Skipping 'https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2' file
which is referenced from datastream

  2. Examine the name of the local file that is referenced by the data stream:

    $ oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml
...
		Referenced check files:
			ssg-rhel8-oval.xml
				system: http://oval.mitre.org/XMLSchema/oval-definitions-5
			ssg-rhel8-ocil.xml
				system: http://scap.nist.gov/schema/ocil/2
			security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2
				system: http://oval.mitre.org/XMLSchema/oval-definitions-5
...

  3. On an online machine, download the missing resource:

    $ curl -o security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2

    Ensure that the name of the downloaded file matches the name the data stream references.

  4. Add the file as new file type content into your orcharhino Server. For more information, see Managing file type content in Managing Content.

    Note the URL on which your repository is published, such as http://orcharhino.example.com/pulp/content/My_Organization_Label/Library/custom/My_Product_Label/My_Repo_Label/.

  5. Schedule a remote job to upload the file to the home directory of root on your host. For example, use the Run Command - Script Default job template and enter the following command:

    $ curl -o /root/security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2 http://orcharhino.example.com/pulp/content/My_Organization_Label/Library/custom/My_Product_Label/My_Repo_Label/security-data-oval-com.redhat.rhsa-RHEL8.xml.bz2

    For more information about running remote jobs, see Executing a Remote Job in Managing Hosts.

  6. Continue with deploying your compliance policy.

Deploying a policy in a host group using Ansible

After you deploy a compliance policy in a host group using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the hosts according to the selected compliance policy.

The SCAP content in the compliance policy might require remote resources. For more information, see inclusion of remote scap resources.

Prerequisites

  • You have enabled OpenSCAP on your orcharhino Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on orcharhino Server and enabled on the host.

  • Repositories that provide the openscap-scanner package and its dependencies:

    • Enterprise Linux 9: BaseOS and AppStream repositories

    • Enterprise Linux 8: BaseOS and AppStream repositories

    • Enterprise Linux 7: Server and Extras repositories

    • For Debian 12 "Bookworm": Suite bookworm and component main

    • For Ubuntu 24.04 "Noble": Suite noble and components main universe

  • orcharhino Client repository for the operating system version of the host is synchronized on orcharhino Server, available in the content view and the lifecycle environment of the host, and enabled for the host. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Ansible deployment option and assigned the host group.

Procedure

  1. In the orcharhino management UI, navigate to Configure > Host Groups.

  2. Click the host group that you want to configure for OpenSCAP reporting.

  3. From the OpenSCAP orcharhino Proxy list, select the orcharhino Proxy with OpenSCAP enabled that you want to use.

  4. On the Ansible Roles tab, assign the theforeman.foreman_scap_client Ansible role.

  5. Optional: On the Parameters tab, configure any Ansible variables of the role.

  6. Click Submit to save your changes.

  7. In the row of the required host group, navigate to the Actions column and select Run all Ansible roles.

Deploying a policy on a host using Ansible

After you deploy a compliance policy on a host using Ansible, the Ansible role installs the SCAP client and configures OpenSCAP scans on the host according to the selected compliance policy.

The SCAP content in the compliance policy might require remote resources. For more information, see inclusion of remote scap resources.

Prerequisites

  • You have enabled OpenSCAP on your orcharhino Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on orcharhino Server and enabled on the host.

  • Repositories that provide the openscap-scanner package and its dependencies:

    • Enterprise Linux 9: BaseOS and AppStream repositories

    • Enterprise Linux 8: BaseOS and AppStream repositories

    • Enterprise Linux 7: Server and Extras repositories

    • For Debian 12 "Bookworm": Suite bookworm and component main

    • For Ubuntu 24.04 "Noble": Suite noble and components main universe

  • orcharhino Client repository for the operating system version of the host is synchronized on orcharhino Server, available in the content view and the lifecycle environment of the host, and enabled for the host. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Ansible deployment option.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

  2. From the OpenSCAP orcharhino Proxy list, select the orcharhino Proxy with OpenSCAP enabled that you want to use.

  3. On the Ansible Roles tab, add the theforeman.foreman_scap_client Ansible role.

  4. Optional: On the Parameters tab, configure any Ansible variables of the role.

  5. Click Submit to save your changes.

  6. Click the Hosts breadcrumbs link to navigate back to the host index page.

  7. Select the host or hosts to which you want to add the policy.

  8. Click Select Action.

  9. Select Assign Compliance Policy from the list.

  10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

  11. Select the required policy from the list of available policies and click Submit.

  12. Click Select Action.

  13. Select Run all Ansible roles from the list.

Deploying a policy in a host group using Puppet

After you deploy a compliance policy in a host group using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the hosts on the next Puppet run according to the selected compliance policy.

The SCAP content in your compliance policy might require remote resources. For more information, see inclusion of remote scap resources.

Prerequisites

  • You have enabled OpenSCAP on your orcharhino Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on orcharhino Server and enabled on the host.

  • Repositories that provide the openscap-scanner package and its dependencies:

    • Enterprise Linux 9: BaseOS and AppStream repositories

    • Enterprise Linux 8: BaseOS and AppStream repositories

    • Enterprise Linux 7: Server and Extras repositories

    • For Debian 12 "Bookworm": Suite bookworm and component main

    • For Ubuntu 24.04 "Noble": Suite noble and components main universe

  • orcharhino Client repository for the operating system version of the host is synchronized on orcharhino Server, available in the content view and the lifecycle environment of the host, and enabled for the host. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Puppet deployment option and assigned the host group.

Procedure

  1. In the orcharhino management UI, navigate to Configure > Host Groups.

  2. Click the host group that you want to configure for OpenSCAP reporting.

  3. In the Environment list, select the Puppet environment that contains the foreman_scap_client* Puppet classes.

  4. In the OpenSCAP orcharhino Proxy list, select the orcharhino Proxy with OpenSCAP enabled that you want to use.

  5. On the Puppet ENC tab, add the foreman_scap_client Puppet class.

  6. Optional: Configure any Puppet Class Parameters.

  7. Click Submit to save your changes.

Deploying a policy on a host using Puppet

After you deploy a compliance policy on a host using Puppet, the Puppet agent installs the SCAP client and configures OpenSCAP scans on the host on the next Puppet run according to the selected compliance policy.

The SCAP content in your compliance policy might require remote resources. For more information, see inclusion of remote scap resources.

Prerequisites

  • You have enabled OpenSCAP on your orcharhino Proxy. For more information, see Installing the OpenSCAP plugin.

  • Repositories for the operating system version of the host are synchronized on orcharhino Server and enabled on the host.

  • Repositories that provide the openscap-scanner package and its dependencies:

    • Enterprise Linux 9: BaseOS and AppStream repositories

    • Enterprise Linux 8: BaseOS and AppStream repositories

    • Enterprise Linux 7: Server and Extras repositories

    • For Debian 12 "Bookworm": Suite bookworm and component main

    • For Ubuntu 24.04 "Noble": Suite noble and components main universe

  • orcharhino Client repository for the operating system version of the host is synchronized on orcharhino Server, available in the content view and the lifecycle environment of the host, and enabled for the host. This repository is required for installing the SCAP client.

  • You have created a compliance policy with the Puppet deployment option.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > All Hosts, and select Edit on the host you want to configure for OpenSCAP reporting.

  2. From the Environment list, select the Puppet environment that contains the foreman_scap_client and foreman_scap_client::params Puppet classes.

  3. From the OpenSCAP orcharhino Proxy list, select the orcharhino Proxy with OpenSCAP enabled that you want to use.

  4. On the Puppet ENC tab, add the foreman_scap_client Puppet class.

  5. Optional: Configure any Puppet Class Parameters.

  6. Click the Hosts breadcrumbs link to navigate back to the host index page.

  7. Select the host or hosts to which you want to add the policy.

  8. Click Select Action.

  9. Select Assign Compliance Policy from the list.

  10. In the Assign Compliance Policy window, select Remember hosts selection for the next bulk action.

  11. Select the required policy from the list of available policies and click Submit.

Running a security compliance scan on demand

Hosts perform OpenSCAP scans regularly by the CRON schedule defined in the compliance policies assigned to hosts. However, you can also run a scan on a host for all configured compliance policies manually at any time.

Prerequisites

  • Your user account has a role assigned that has the view_hosts, create_job_invocations, and view_job_invocations permissions.

  • You have created a compliance policy and deployed it on the host.

Procedure

  1. Navigate to Hosts > All Hosts.

  2. Click the hostname of the required host.

  3. On the host details page, expand the Schedule a job dropdown menu.

  4. Select Run OpenSCAP scan.

Verification

  1. In the host details overview, locate the Recent jobs card.

  2. Select the Running tab. Unless the job has already finished, the table shows a job called Run scan for all OpenSCAP policies.

  3. On the Recent jobs card, select the Finished tab.

  4. If the job has finished successfully, you should see the succeeded status in the row of the job.

  5. Optional: Click the job name to review invocation details.

Monitoring compliance

With orcharhino, you can centralize compliance monitoring and management. A compliance dashboard provides an overview of compliance of hosts and the ability to view details for each host within the scope of that policy. Compliance reports provide a detailed analysis of compliance of each host with the applicable policy. With this information, you can evaluate the risks presented by each host and manage the resources required to bring hosts into compliance. By monitoring compliance with SCAP, you can verify policy compliance and detect changes in compliance.

Searching compliance reports

Use the Compliance Reports search field to filter the list of available reports on any subset of hosts.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Reports.

  2. Optional: To see a list of available search parameters, click the empty Search field.

  3. Enter the search query in the Search field and click Search. The search query is case insensitive.

Search query examples
Find all compliance reports for which more than five rules failed
failed > 5
Find all compliance reports created after January 1, 2023, for hosts with hostnames that contain prod-
host ~ prod- AND date > "Jan 1, 2023"
Find all reports generated by the rhel7_audit compliance policy from an hour ago
"1 hour ago" AND compliance_policy = date = "1 hour ago" AND compliance_policy = rhel7_audit
Find reports that pass an XCCDF rule
xccdf_rule_passed = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Find reports that fail an XCCDF rule
xccdf_rule_failed = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Find reports that have a result different than fail or pass for an XCCDF rule
xccdf_rule_othered = xccdf_org.ssgproject.content_rule_firefox_preferences-auto-download_actions
Additional information

  • You can create complex queries with the following logical operators: and, not and has. For more information about logical operators, see Supported Operators for Granular Search in Administering orcharhino.

  • You cannot use regular expressions in a search query. However, you can use multiple fields in a single search expression. For more information about all available search operators, see Supported Operators for Granular Search in Administering orcharhino.

  • You can bookmark a search to reuse the same search query. For more information, see Creating Bookmarks in Administering orcharhino.

Compliance email notifications

orcharhino Server sends an OpenSCAP Summary email to all users who subscribe to the Compliance policy summary email notifications. For more information on subscribing to email notifications, see Configuring Email Notification Preferences in Administering orcharhino.

Each time a policy is run, orcharhino checks the results against the previous run, noting any changes between them. The email is sent according to the frequency requested by each subscriber, providing a summary of each policy and its most recent result.

Viewing compliance policy statistics

You can view a compliance policy dashboard to verify compliance reports of a particular policy. The compliance policy dashboard provides a statistical summary of compliance of hosts and the ability to view report details for each host within the scope of that policy.

Consider prioritizing the following hosts when viewing compliance reports:

  • Hosts which were evaluated as Failed

  • Hosts labelled as Never audited because their status is unknown

Prerequisites

  • Your user account has a role assigned that has the view_policies permission.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Policies.

  2. In the row of the required policy, navigate to the Actions column and click Dashboard.

Remediating compliance failures

With orcharhino, you can examine compliance reports and, in some cases, remediate cases of non-compliance. You can remediate compliance failures by using a remediation wizard or by applying remediation snippets manually.

Always test the recommended remedial actions or scripts in a non-production environment before implementing them in production. Remediation might render the system non-functional.
Prerequisites

  • Your user account has a role assigned that has the following permissions: view_arf_reports, view_hosts, create_job_invocations

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Reports.

  2. In the Reported At column, click the time link of the report you want to examine. orcharhino displays a list of log messages describing the results of the scan.

  3. Locate a log message that describes a failed compliance check. In the Actions column, select Remediation to open the compliance remediation wizard. Follow the wizard to remediate the compliance failure.

    The remediation wizard might not be available for all compliance failures.
Additional resources

Deleting a compliance report

You can delete compliance reports on your orcharhino.

Prerequisites

  • Your user account has a role assigned that has the view_arf_reports and destroy_arf_reports permissions.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Reports.

  2. In the Compliance Reports window, identify the policy that you want to delete and, on the right of the policy’s name, select Delete.

  3. Click OK.

Deleting multiple compliance reports

You can delete multiple compliance policies simultaneously. However, in the orcharhino management UI, compliance policies are paginated, so you must delete one page of reports at a time.

Prerequisites

  • Your user account has a role assigned that has the view_arf_reports and destroy_arf_reports permissions.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Compliance > Reports.

  2. In the Compliance Reports window, select the compliance reports that you want to delete.

  3. In the upper right of the list, select Delete reports.

  4. Repeat these steps for as many pages as you want to delete.

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").