1oscap-ssh(8) System Administration Utilities oscap-ssh(8)
2
6 oscap-ssh - Tool for running oscap over SSH and collecting results.
7
9 oscap-ssh runs oscap tool on a remote system through SSH connection.
10 The input files are transfered to the target system and after the scan
11 finishes result files are transfered back. No temporary data remains on
12 the remote machine.
13 The tool requires bash, ssh, scp and mktemp to perform OVAL and XCCDF
15 evaluation of remote machines. The remote machine also has to have
16 oscap installed and in $PATH. This can be accomplished by installing
17 openscap-scanner.
18 Usage of the tool mimics usage and options of oscap(8) tool.
20
23 Evaluation of XCCDF content
24 $ oscap-ssh user@host 22 xccdf eval [options] INPUT_CONTENT
25 Only source datastreams are supported as INPUT_CONTENT!
27 Supported options are:
29 --profile
30 --tailoring-file
31 --tailoring-id
32 --cpe
33 --results
34 --results-arf
35 --report
36 --skip-valid
37 --fetch-remote-resources
38 --progress
39 --datastream-id
40 --xccdf-id
41 --benchmark-id
42 --remediate
43 Evaluation of OVAL content
46 $ oscap-ssh user@host 22 oval eval [options] INPUT_CONTENT
47 Supported options are:
49 --id
50 --variables
51 --directives
52 --results
53 --report
54 --skip-valid
55 --datastream-id
56 --oval-id
57 Collection of OVAL System Characteristic
60 $ oscap-ssh user@host 22 oval collect [options] INPUT_CONTENT
61 Supported options are:
63 --id
64 --syschar
65 --variables
66 --skip-valid
67 Specific option for oscap-ssh (must be first argument):
69 --sudo
70 Environment variables
73 oscap-ssh checks out the SSH_ADDITIONAL_OPTIONS environment variable,
74 and pastes its contents into the command-line of ssh to the location
75 where options are expected. Supply the variable in form of a string
76 that corresponds to a section of the ssh command-line and that consists
77 of options you want to pass.
78
81 Simple XCCDF evaluation
82 The following command evaluates a remote Fedora machine as root. HTML
83 report is written out as report.html on the local machine. Can be exe‐
84 cuted from any machine that has ssh, scp and bash. The local machine
85 does not need to have openscap installed. It also uses the SSH_ADDI‐
86 TIONAL_OPTIONS variable to configure ssh in such way that contents of
87 the known_hosts file are ignored.
88 $ export SSH_ADDITIONAL_OPTIONS="-o StrictHostKeyChecking=no -o User‐
90 KnownHostsFile=/dev/null" $ oscap-ssh root@192.168.1.13 22 xccdf eval
91 --profile xccdf_org.ssgproject.content_profile_common --report
92 report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml
93 XCCDF Evaluation with tailoring file
96 The following command uses a tailoring file and also copies back ARF
97 and XCCDF results. The tailoring file is automatically copied from
98 local machine to remote.
99 $ oscap-ssh --sudo oscap-user@192.168.1.13 22 xccdf eval --profile
101 xccdf_org.ssgproject.content_profile_common --report report.html
102 --results results.xml --results-arf arf.xml --tailoring-file ssg-
103 fedora-ds-tailoring.xml /usr/share/xml/scap/ssg/content/ssg-fedora-
104 ds.xml
105 Running remotely as root
108 Note that the openscap scanner is best run by the 'root' user as in the
109 first example above. To do this, the "PermitRootLogin" directive must
110 be enabled in /etc/ssh/sshd_config, which is itself a security viola‐
111 tion. A safer approach is to enable a non-privileged user ('oscap-user'
112 in the second example above) to run only the oscap binary as root (with
113 the '--sudo' flag) by updating the remote machine's 'sudoers' file or
114 adding a file like /etc/sudoers.d/99-oscap-user:
115 # allow oscap-user to run openscap scanner
116 Defaults!/usr/bin/oscap !requiretty
117 oscap-user ALL=(root) NOPASSWD: /usr/bin/oscap
118
121 Please report bugs using https://github.com/OpenSCAP/openscap/issues
122
125 Martin Preisler <mpreisle@redhat.com>
126 Šimon Lukašík <slukasik@redhat.com>
127Red Hat, Inc. January 2016 oscap-ssh(8)