Windows>> content>> 返回
项目作者： ComplianceAsCode

项目描述 ：
Security automation content in SCAP, OSCAL, Bash, Ansible, and other formats
高级语言： Python
项目地址: git://github.com/ComplianceAsCode/content.git
创建时间： 2014-04-29T14:32:02Z
项目社区：https://github.com/ComplianceAsCode/content
开源协议：Other
下载


Welcome!

Docs
Release
Nightly ZIP Status
Maintainability
Stats, Guides, Tables
Join the chat at https://gitter.im/Compliance-As-Code-The/content

The purpose of this project is to create security policy content for various
platforms — Red Hat Enterprise Linux, Fedora, Ubuntu, Debian, SUSE Linux Enterprise Server (SLES),… —
as well as products — Firefox, Chromium, …
We aim to make it as easy as possible to write new and maintain existing
security content in all the commonly used formats.

We build security content in various formats

NIST logo Ansible logo Bash logo

“SCAP content” refers to documents in the XCCDF, OVAL and
SCAP source data stream formats. These documents can be presented
in different forms and by different organizations to meet their security
automation and technical implementation needs. For general use, we
recommend SCAP source data streams because they contain all the data you
need to evaluate and put machines into compliance. The data streams are
part of our release ZIP archives.

“Ansible content” refers to Ansible playbooks generated from security
profiles. These can be used both in check-mode to evaluate compliance,
as well as run-mode to put machines into compliance. We publish these
on Ansible Galaxy as well as in release ZIP archives.

“Bash fix files” refers to Bash scripts generated from security
profiles. These are meant to be run on machines to put them into
compliance. We recommend using other formats but understand that for
some deployment scenarios bash is the only option.

Why?

We want multiple organizations to be able to efficiently develop security
content. By taking advantage of the powerful build system of this project,
we avoid as much redundancy as possible.

The build system combines the easy-to-edit YAML rule files with OVAL checks,
Ansible task snippets, Bash fixes, and other files. Templating is provided
at every step to avoid boilerplate. Security identifiers
(CCE, NIST ID, STIG, …) appear in all of our output formats but are all
sourced from the YAML rule files.

We understand that depending on your organization’s needs you may need
to use a specific security content format. We let you choose.

Build system schema

We use an OpenControl-inspired YAML rule format for input. Write once and
generate security content in XCCDF, Ansible, and others.

  1. title: 'Configure The Number of Allowed Simultaneous Requests'
  3. description: |-
  4.     The <tt>MaxKeepAliveRequests</tt> directive should be set and configured to
  5.     <sub idref="var_max_keepalive_requests" ></sub> or greater by setting the following
  6.     in <tt>/etc/httpd/conf/httpd.conf</tt>:
  7.     <pre>MaxKeepAliveRequests {{{ xccdf_value("var_max_keepalive_requests") }}}</pre>
  9. rationale: |-
  10.     Resource exhaustion can occur when an unlimited number of concurrent requests
  11.     are allowed on a web site, facilitating a denial of service attack. Mitigating
  12.     this kind of attack will include limiting the number of concurrent HTTP/HTTPS
  13.     requests per IP address and may include, where feasible, limiting parameter
  14.     values associated with keepalive, (i.e., a parameter used to limit the amount of
  15.     time a connection may be inactive).
  17. severity: medium
  19. identifiers:
  20.     cce: "80551-5"

Scan targets

Our security content can be used to scan bare-metal machines, virtual machines,
virtual machine images (qcow2 and others), containers (including Docker), and
container images.

We use platform checks to detect whether we should or should not evaluate some
of the rules. For example: separate partition checks make perfect sense on bare-metal
machines but go against recommended practices on containers.

Installation

From packages

The preferred method of installation is via the package manager of your
distribution. On Red Hat Enterprise Linux and Fedora you can use:

  1. yum install scap-security-guide

On Debian (sid), you can use:

  1. apt install ssg-debian  # for Debian guides
  2. apt install ssg-debderived  # for Debian-based distributions (e.g. Ubuntu) guides
  3. apt install ssg-nondebian  # for other distributions guides (RHEL, Fedora, etc.)
  4. apt install ssg-applications  # for application-oriented guides (Firefox, JBoss, etc.)

From release ZIP files

Download pre-built SSG zip archive from
the release page.
Each zip file is an archive with ready-made SCAP source data streams.

From source

If ComplianceAsCode is not packaged in your distribution (it may be present there as scap-security-guide package), or if the
version that is packaged is too old, you need to build the content yourself
and install it via make install. Please see the Developer Guide
document for more info. We also recommend opening an issue on that distributions
bug tracker to voice interest.

Usage

We assume you have installed ComplianceAsCode system-wide into a
standard location from current upstream sources as instructed in the previous section.

There are several ways to consume ComplianceAsCode content, we will only
go through a few of them here.

oscap tool

The oscap tool is a low-level command line interface that comes from
the OpenSCAP project. It can be used to scan the local machine.

  1. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_ospp --results-arf arf.xml --report report.html --oval-results /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Evaluation report sample

After evaluation, the arf.xml file will contain all results in a reusable
result data stream (ARF) format, report.html will contain a human-readable
report that can be opened in a browser.

Replace the profile with other profile of your choice, you can display
all possible choices using:

  1. oscap info /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Please see the OpenSCAP website for more information.

SCAP Workbench

The SCAP Workbench is a graphical user interface for SCAP evaluation and
customization. It is suitable for scanning a single machine, either local
or remote (via SSH). New versions of SCAP Workbench have SSG integration
and will automatically offer it when the application is started.

Please see the SCAP Workbench website for more information.

oscap-ssh tool

oscap-ssh comes bundled with OpenSCAP 1.2.3 and later. It allows scanning
a remote machine via SSH with an interface resembling the oscap tool.

The following command evaluates a machine with IP 192.168.1.123 with content
stored on the local machine. Keep in mind that oscap has to be installed on the
remote machine but the SSG content doesn’t need to be.

  1. oscap-ssh root@192.168.1.123 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --results-arf arf.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

Ansible

To see a list of available Ansible Playbooks, run:

  1. ls /usr/share/scap-security-guide/ansible/

These Ansible Playbooks are generated from SCAP profiles available for the products.

To apply the playbook on your local machine run:
(THIS WILL CHANGE CONFIGURATION OF THE MACHINE!)

  1. ansible-playbook -i "localhost," -c local /usr/share/scap-security-guide/ansible/rhel9-playbook-ospp.yml

Each of the Ansible Playbooks contains instructions on how to deploy them. Here
is a snippet of the instructions:

  1. ...
  2. # This file was generated by OpenSCAP 1.2.16 using:
  3. #   $ oscap xccdf generate fix --profile rht-ccp --fix-type ansible sds.xml
  4. #
  5. # This script is generated from an OpenSCAP profile without preliminary evaluation.
  6. # It attempts to fix every selected rule, even if the system is already compliant.
  7. #
  8. # How to apply this remediation role:
  9. # $ ansible-playbook -i "192.168.1.155," playbook.yml
  10. # $ ansible-playbook -i inventory.ini playbook.yml
  11. ...

Bash

To see a list of available Bash scripts, run:

  1. # ls /usr/share/scap-security-guide/bash/
  2. ...
  3. rhel8-script-hipaa.sh
  4. rhel8-script-ospp.sh
  5. rhel8-script-pci-dss.sh
  6. ...

These Bash scripts are generated from SCAP profiles available for the products.
Similar to Ansible Playbooks, each of the Bash scripts contain instructions on how to deploy them.

Support

The SSG mailing list can be found at https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide.

If you encounter issues with OpenSCAP or SCAP Workbench, use https://www.redhat.com/mailman/listinfo/open-scap-list

If you prefer more interactive contact with the community, you can join us on Gitter and IRC:

A little bit of history

This project started in 2011 as a collaboration between United States Government agencies and commercial operating system vendors.
The original name was SCAP Security Guide, commonly abbreviated as SSG.
The original scope was to create SCAP data streams. Over time, it grew into the
biggest open-source beyond-SCAP content project.

The next few years saw the introduction of not just government-specific security
profiles but also commercial, such as PCI-DSS and CIS.

Later, the industry starts moving towards different security content formats,
such as Ansible, Puppet, and Chef InSpec. The community reacted by evolving the
tooling and helped transform SSG into a more general-purpose security content
project. This change happened over time in 2017 and 2018. In September 2018, we
decided to change the name of the project to ComplianceAsCode, in order to avoid confusion.

We envision that the future will be format-agnostic. That’s why opted for an
abstraction instead of using XCCDF for the input format.

Contributors

This project is welcome to new contributors. We are continually trying to remove the complexities to make contributions easier and more enjoyable for everyone. This is a nice project and a friendly community.

There are many ways to contribute. Check the documentation for more details:
https://complianceascode.readthedocs.io/en/latest/manual/developer/01_introduction.html

Check the updated list of Contributors.