Lesson 6.19: Continuous compliance: scheduled scans and drift
A clean scan is true on the day it runs. Installers, quick fixes and support tools change servers afterwards, and nobody re-runs the benchmark by hand. In the lab you schedule a nightly OpenSCAP scan with a systemd service and timer (and learn why oscap's exit code 2 needs SuccessExitStatus), run it once, and it immediately reports drift on a host that passed last month: a support tool's SSH drop-in that sorts before the hardening file. You find why it wins, remove it, and confirm the next scan passes.
17 min
You will learn to
- Run a compliance scan as a systemd oneshot service
- Treat a tool's 'findings' exit code with SuccessExitStatus
- Schedule it with a timer
- Read scan results from the journal
- Explain drop-in ordering and fix drift at its source
Key terms
- Drift
- A system moving away from its approved configuration over time.
- Oneshot service
- A systemd service that runs a command to completion and exits.
- SuccessExitStatus
- Extra exit codes systemd treats as success.
- Timer
- A .timer unit that starts a service on a schedule.
- Drop-in order
- sshd reads sshd_config.d/*.conf in name order and keeps the first value of each keyword.
← Shared-library hijacking · All lessons · Final mission: map and assess the Northwind office network →