In this lesson, you are going to learn about OpenSCAP.
OpenSCAP is a vulnerability scanner,
which can scan a system against certain security baselines.
Now, it has command line utilities,
and on RHEL 9,
it also had SCAP workbench.
They've removed it from RHEL 10 because Red Hat
wants you to use different utilities,
and that is why I'm showing you on RHEL 9.
It's an awesome utility, and let's go check it out.
Okay, let me start by doing a sudo dnf install,
SCAP workbench.
That's a graphical utility.
There's also a command line scan utility,
but SCAP workbench is so convenient,
so I want to go for this.
You can see that it's installing the important dependency,
the SCAP security guide.
The SCAP security guide has external security profiles
that have been provided,
and which you can use to easily and conveniently
scan your current systems.
So now that it has been installed,
let's start the SCAP workbench utility.
And there you can see that it's asking for content to load.
Well, I'm on RHEL 9, so I want to go for RHEL 9.
And next, I'm using load content,
and there you can see the different profiles
that are available.
So the important question is,
which profile do you want to use to scan your system?
Well, I want DISA stick with GUI for Red Hat Enterprise Linux.
And then you can see all the different rules,
and in all of these different rules,
it is going to see if you are compliant.
And that is the entire idea.
If you don't like the different settings,
you can also do your customization.
And in the customization, you get an entire tree
with all the different options that are available.
And here you can enable or disable specific options
that are provided.
I'm not going to do any of these.
Let's just use the default solution,
and then we are going to scan.
Now, in order to scan,
obviously you need administrator privileges.
So it's prompting for my sudo password,
and here it is generating the report
on my out-of-the-box RHEL 9 installation.
Depending on the size of your system,
this might take a couple of minutes.
So now it is done,
and I can have a look at the rules
and whether or not it was compliant.
So here we can see configure all the disk error action
on disk error with a description.
Just click it open,
and you can see what is going on.
Now, one of the nicest thing about this OpenSCAP utility
is that you can generate remediation roles,
and that would be either a shell script
or an Ansible playbook or a Puppet manifest.
So select whichever solution you want,
and here you can see it wants to generate remediation.sh.
Well, let me save remediation.sh
so that it can create the shell script.
So then once you are done,
you can close the utility,
and now it's closing the main window.
Once it is done and it has closed everything,
I can check out my shell script.
So the next step would be to use your remediation shell script
or your Ansible playbook or your Puppet manifest
to make sure that your system is compliant.