SCAP Instructions

This document explains how to install and configure the SCAP tool. It briefly describes how to run a scan and how to analyze results.

Get new tool and benchmark content

• Go to site: public.cyber.mil

• Go under STIGS tab and then Automation -> SCAP: https://public.cyber.mil/stigs/scap/

• Download the content files and the SCAP tool

• Red Hat Enterprise Linux 7 STIG Benchmark - Ver 3, Rel 13

  • You may need to search for it by looking through the latest entries of table SCAP 1.2 Content

  • This is the latest version as of 11/13/2023

• SCC 5.8 RHEL 7/Oracle Linux/SLES12/SLES15 x8664

• Copy files to a preferred directory

• Unzip files

Install

• Install SCAP tool, no internet is required to install dependencies

• sudo yum --nogpgcheck install <scc 5.8 …>

  • spawarscc will be installed

• Using rpm

  • rpm -ivh /path/to/scc-5.8_rhel7_sles12-15_oracle-linux7_x86_64_bundle/scc-5.8_rhel7_x86_64/scc-5.8.rhel7.x86_64.rpm

Configure Tool

Basic Configuration

• Go to the installs folder: /opt/scc/cscc

• Run configuration menu: sudo /opt/scc/cscc --config

• First time running this, you will receive a message on the configuration, click ‘Enter’

• Re-do the configuration every time you update the content or the tool

Update content (benchmarks)

• Run configuration menu: /opt/scc/cscc --config

• Delete SCAP contents

• In the configuration menu, select option 3. Delete SCAP content

  • You will have a list of all the available SCAP content, delete all scans present

    • You can do it individually: select ‘1’ and then type ‘yes’

    • You can do it all at once: type ‘all’ and then ‘yes’

  • This is done because it selects all contents that it thinks are applicable (even though it may not be at all)

• Go back to the main menu screen: 0

• Save and exit: 7 - Exit and save Changes

  • Changes will be saved to /opt/scc/options.xml

• Load new contents

• Copy unzipped content file (xml) into the Content directory:

  • cp /path/to/xml_contents_file /opt/scc/Resources/Content/SCAP12_Content/

  • If you look at the Available SCAP content in the configuration menu, this will be the only entry now.

• Run configuration menu: /opt/scc/cscc --config
• Select "Configure SCAP content": 1
  • Select RHEL_7_STIG: 1
  • Go back to the main menu screen: 0
  • Save and exit: 7 - Exit and save Changes

Overall tool configuration

• Edit tool configurations

• Start configuration options: sudo /opt/scc/cscc --config

  • This will now launch a new message requesting funding. Skip this message in the future: S

• 1 - Configure SCAP Content

  • Type: ‘show all’

  • Select ‘RHEL_7_STIG’

• 2 - Configure SCAP Profiles

  • No changes

• 4 - Configure OVAL content

  • Take out OVAL content if selected, otherwise no changes

• 6 - Configure Options

  • 1 - Scanning Options

    • Select: 1,2,3,6,10,11,13

      • 1 and 3 are optional

  • 2 - Content options

    • Select: 2,8,7 (defaults)

  • 3 - Reporting Options

    • Select: 1,3,5,6,7,8,9,12,14,17,21

      • 5,6 options are good for having a user friendly report on HTML and text

  • 4 - Logging options - optional

    • Leave defaults (nothing selected)

  • 5 - Output Options

    • Select: 2,3,4,5,6,7,8,9,10, 14,16,17,18,19

      • 3 and 4 choose the paths for the logs and reports, otherwise it goes to home

  • 6 - SFTP File Transfer Options

    • defaults

  • 7 - Update Options

    • defaults

    • Ignore this since most of the time the tool is not able to update itself since code is pulled from Git and it is not the latest version

• Return to main menu: 0

• Exit and save changes with option 7

Run a Scan

• Recommended to leave running as a background service overnight: nohup /opt/scc/cscc >/root/cscc.out 2>&1 & disown

• Follow output: tail -f /root/cscc.out

Results

Read Scan Reports

• Go to directory: ll /opt/scc/Sessions/<date_of_scan>/

• All reports are on this directory

• If unsure of location, look at the end of the cscc.out file

• We are most interested on the ‘Non-compliance’ reports since it shows what we are missing to fix

• We may be requested to send a report in the future and that will be the ‘XCCDF’ file

Interpret Results

• Rsync files to the correct directory to pull the newest reports

• Open HTML or text file

• Results

• Green: 90+

• We are required to correct all CAT 1 findings. However, if we have easily fixable CAT 3 (lower value) or CAT 2, it may improve our score

• Report:

• Description section: may be wrong

• Fix section: useful to give you an idea on how to fix it, but Google is recommended

• Test section: useful to see the specific file that failed

Weekly Scan

Every week on Wednesdays at 5:00 PM MT, an script is launched by a cron job to run a SCAP scan on server-1..2, bg-mds-1..2, bg-ss-1..7.

• The script to run the SCAP scan is called runscap.sh located under the /root/ directory.

In order to gather all the results, I manually run the script called /root/tar_scap_results.sh.

• This script grabs all the results from the other servers and copies them in the latest SCAP results directory which is under /opt/scc/Sessions/<day-of-the-scan>/all_results

• The results are also compiled and zipped under /opt/scc/Sessions/<day-of-the-scan>/

Notes

• How often do we need to check updates to the scanner? Ideally every time that we will scan (every week)

• How often should we scan? Every week

• Do patching on Tuesday

• Scan on Wednesday

• USNO scans on Wednesday at midnight (cron job)

• We are planning to install the tool in every machine, is there a way to only install the tool on one of the machines?

• There is a plugin to do remote scans: UNIX_Remote_Scanning_Plugin

  • It may be possible to instigate scans from a single ssh instance if they connect through ssh directly

  • Server 1 and sever 2 may be able to work since we connect directly to each other

• TIP: Write everything that is done in server1 and then printf to replicate steps on the other servers