Lesson 6.18: Scanning against a benchmark with OpenSCAP
'Hardened' means nothing until it's measured. A benchmark such as CIS turns good practice into numbered checks, and OpenSCAP evaluates a machine against them using the SCAP Security Guide content: each rule passes or fails, and the results file is evidence an auditor can read. In the lab you scan a web server against a CIS Level 1 server profile, read the five failures, fix them the way the rules expect (drop-ins and sysctl.d files, not edits of vendor files), re-check one rule, and produce a clean report.
18 min
You will learn to
- Explain benchmarks, profiles and rules
- Run oscap xccdf eval with a profile
- Read Title / Rule / Result output and the results file
- Remediate with drop-ins and sysctl.d files
- Re-check a single rule and produce a report
Key terms
- Benchmark
- A published set of configuration checks, e.g. CIS Ubuntu Linux 24.04.
- Profile
- A selection of rules for a purpose (CIS Level 1 server, STIG, ...).
- SCAP Security Guide
- Open content (ComplianceAsCode) with rules and checks per distribution, shipped as a data stream (…-ds.xml).
- oscap xccdf eval
- Evaluates a machine against a profile; exit 2 means some rule failed.
- Results file
- XCCDF XML with one rule-result per rule; the evidence.
← APT repository trust and pinning · All lessons · Firewalls and segmentation: deciding which traffic may pass →