Skip to content

Commit 8447f0c

Browse files
slange-devslange-dev
authored
Create evaluate_scap_0.1.76.sh
- Update to v0.1.76
1 parent 6162bde commit 8447f0c

File tree

1 file changed

+184
-0
lines changed

1 file changed

+184
-0
lines changed

‎evaluate_scap_0.1.76.sh

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
#!/usr/bin/env bash
2+
########################################################################################
3+
## This script evaluates the SCAP profile rules from the scap-security-guide v0.1.76, ##
4+
## downloaded from github (https://github.com/ComplianceAsCode/content) ##
5+
## The script generates a "remediation" script and guide for each profile ##
6+
## ##
7+
## Usage: ./evaluate_scap_0.1.76.sh >> scap_0.1.76.log 2>> scap_0.1.76.log & ##
8+
########################################################################################
9+
10+
## Scap-security-guide version
11+
VERSION=0.1.76
12+
13+
## OS Version
14+
# Rocky Linux 9 (missed in v0.1.73)
15+
#OS=rl9
16+
17+
# Redhat Linux 9
18+
OS=rhel9
19+
20+
# Create directory
21+
##
22+
TARGETDIR=/root/openscap_data
23+
24+
if [ ! -d "$TARGETDIR" ]; then
25+
##
26+
mkdir -p $TARGETDIR
27+
fi
28+
29+
## Hostname
30+
HOST=$(hostname)
31+
32+
## Date
33+
DATE=$(date +%F)
34+
35+
#######################################
36+
## Download profile from remote site ##
37+
#######################################
38+
39+
## Use content from download
40+
CONTENT=${TARGETDIR}/scap-security-guide-${VERSION}
41+
42+
## Check if wget is installed
43+
if [ -x "$(command -v wget)" ]; then
44+
45+
## Download scap-security-guide with wget
46+
wget https://github.com/ComplianceAsCode/content/releases/download/v${VERSION}/scap-security-guide-${VERSION}.zip -P ${TARGETDIR}
47+
48+
## Set
49+
CURL=0
50+
else
51+
52+
## Set
53+
CURL=1
54+
55+
fi
56+
57+
## Check if cURL is installed
58+
if [ -x "$(command -v curl)" ] && [ $CURL -eq 1 ]; then
59+
60+
## Download scap-security-guide with cURL
61+
curl -o ${TARGETDIR}/scap-security-guide-${VERSION}.zip -L https://github.com/ComplianceAsCode/content/releases/download/v${VERSION}/scap-security-guide-${VERSION}.zip
62+
else
63+
64+
##
65+
sudo dnf install curl -y
66+
67+
## Download scap-security-guide with cURL
68+
curl -o ${TARGETDIR}/scap-security-guide-${VERSION}.zip -L https://github.com/ComplianceAsCode/content/releases/download/v${VERSION}/scap-security-guide-${VERSION}.zip
69+
fi
70+
71+
## Check if unzip is installed
72+
if [ -x "$(command -v unzip)" ]; then
73+
74+
## Unzip scap-security-guide
75+
unzip -o ${TARGETDIR}/scap-security-guide-${VERSION}.zip -d ${TARGETDIR}
76+
else
77+
78+
## Install unzip
79+
sudo dnf install unzip -y
80+
81+
## Unzip scap-security-guide
82+
unzip -o ${TARGETDIR}/scap-security-guide-${VERSION}.zip -d ${TARGETDIR}
83+
fi
84+
85+
## To extract the list of profiles
86+
oscap info --fetch-remote-resources ${CONTENT}/ssg-${OS}-ds.xml | grep profile | sed 's+.*profile_++'
87+
88+
## The following array processes all available profiles, comment out the ones that are not needed
89+
PARRAY=(
90+
#################
91+
## rhel9 / rl9 ##
92+
#################
93+
# oscap info "/usr/share/xml/scap/ssg/content/ssg-rl9-ds.xml"
94+
# oscap info "/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml"
95+
96+
## Generated: 2024-04-08
97+
98+
# ANSSI-BP-028 (enhanced)
99+
#anssi_bp28_enhanced
100+
101+
# ANSSI-BP-028 (high)
102+
#anssi_bp28_high
103+
104+
# ANSSI-BP-028 (intermediary)
105+
#anssi_bp28_intermediary
106+
107+
# ANSSI-BP-028 (minimal)
108+
#anssi_bp28_minimal
109+
110+
# CCN Red Hat Enterprise Linux 9 - Advanced
111+
#ccn_advanced
112+
113+
# CCN Red Hat Enterprise Linux 9 - Basic
114+
#ccn_basic
115+
116+
# CCN Red Hat Enterprise Linux 9 - Intermediate
117+
#ccn_intermediate
118+
119+
# CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
120+
#cis
121+
122+
# CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Server
123+
#cis_server_l1
124+
125+
# CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Workstation
126+
#cis_workstation_l1
127+
128+
# CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Workstation
129+
#cis_workstation_l2
130+
131+
# DRAFT - Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
132+
## Committee on National Security Systems Instruction (CNSSI) No. 1253, Security
133+
## Categorization and Control Selection for National Security Systems on security
134+
## controls to meet low confidentiality, low integrity, and low assurance.
135+
#cui
136+
137+
# Australian Cyber Security Centre (ACSC) Essential Eight
138+
#e8
139+
140+
# Health Insurance Portability and Accountability Act (HIPAA)
141+
#hipaa
142+
143+
# Australian Cyber Security Centre (ACSC) ISM Official
144+
#ism_o
145+
146+
# Protection Profile for General Purpose Operating Systems
147+
#ospp
148+
149+
# PCI-DSS v4.0 Control Baseline for Red Hat Enterprise Linux 9
150+
#pci-dss
151+
152+
# DISA STIG for Red Hat Enterprise Linux 9
153+
#stig
154+
155+
# DISA STIG with GUI for Red Hat Enterprise Linux 9
156+
stig_gui
157+
)
158+
159+
##
160+
for PROFILE in "${PARRAY[@]}"; do
161+
162+
## Display the profile
163+
printf "\n#### %s ####\n\n" "${PROFILE}"
164+
165+
## Evaluate each profile against oval downloaded from RedHat
166+
oscap xccdf eval --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_"${PROFILE}" \
167+
--results "${TARGETDIR}"/"${HOST}"-"${DATE}"-"${PROFILE}".xml \
168+
--report "${TARGETDIR}"/"${HOST}"-"${DATE}"-"${PROFILE}".html \
169+
"${CONTENT}"/ssg-"${OS}"-ds.xml
170+
171+
## Generate remediation script for each profile
172+
oscap xccdf generate fix --template urn:xccdf:fix:script:sh \
173+
--profile xccdf_org.ssgproject.content_profile_"${PROFILE}" \
174+
--output "${TARGETDIR}"/remediation-"${HOST}"-"${DATE}"-"${PROFILE}".sh \
175+
"${CONTENT}"/ssg-${OS}-ds.xml
176+
177+
## Generate Guide for each profile
178+
oscap xccdf generate guide --profile xccdf_org.ssgproject.content_profile_"${PROFILE}" \
179+
--output "${TARGETDIR}"/scap-security-guide-"${VERSION}"-"${HOST}"-"${DATE}"-"${PROFILE}".html \
180+
"${CONTENT}"/ssg-${OS}-ds.xml
181+
done
182+
183+
## Create tar with all results, scripts, guides, etc.
184+
tar -cvzf "${HOST}"-"${DATE}"-scap_"${VERSION}".tar.gz "${TARGETDIR}"/"${HOST}"/"${HOST}"-"${DATE}"-*.xml "${TARGETDIR}"/"${HOST}"/"${HOST}"-"${DATE}"-*.html "${TARGETDIR}"/"${HOST}"/remediation-"${HOST}"-"${DATE}"-*.sh "${TARGETDIR}"/"${HOST}"/scap-security-guide-"${VERSION}"-"${HOST}"-"${DATE}"-*.html

0 commit comments

Comments
 (0)