RHEL 8 Security Guide

[MyNicePC]

Hello,

I just installed Openscap Workbench on my laptop. I have apways been able
to scan RHEL 6 and RHEL 7 servers using security guides provided within
OpenScap. Does anyone know if you support a security guide for RHEL 8?

Thank you,

JR

[Mark Thacker]

Hi there.

Perhaps you are missing the "scap-security-guide" package in RHEL 8.

Here is a link to the documentation in RHEL 8: 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm... 
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/scanning-the-system-for-configuration-compliance-and-vulnerabilities_security-hardening#configuration-compliance-scanning_scanning-the-system-for-configuration-compliance-and-vulnerabilities

On 4/27/21 2:27 PM, MyNicePC wrote:
> Hello,
>
> I just installed Openscap Workbench on my laptop. I have apways been 
> able to scan RHEL 6 and RHEL 7 servers using security guides provided 
> within OpenScap. Does anyone know if you support a security guide for 
> RHEL 8?
>
> Thank you,
>
> JR
>
> scap-security-guide mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Chris Bidwell - NOAA Federal]

Is there a way with the scap-workbench output to ansible format...To
exclude specific RHEL STIG ID's?

I've got rhel8-playbook-stig.yml that I'm using for applying my STIG's that
I've downloaded from:
https://github.com/RedHatGov/rhel8-stig-latest/blob/master/rhel8-playbook-st...

On Wed, Apr 28, 2021 at 3:20 PM Mark Thacker  wrote:
> Hi there.
>
> Perhaps you are missing the "scap-security-guide" package in RHEL 8.
>
> Here is a link to the documentation in RHEL 8:
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
> On 4/27/21 2:27 PM, MyNicePC wrote:
>
> Hello,
>
> I just installed Openscap Workbench on my laptop. I have apways been able
> to scan RHEL 6 and RHEL 7 servers using security guides provided within
> OpenScap. Does anyone know if you support a security guide for RHEL 8?
>
> Thank you,
>
> JR
>
> scap-security-guide mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
>
> --
>
> Mark Thacker
>
> He/Him
>
> Team Lead & Security Experience Product Manager, Red Hat Enterprise Linux
>
> Red Hat https://www.redhat.com
>
> [e-mail]
> M: [phone]     Twitter / IRC: @thackman
> https://www.redhat.com
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure

[Gabriel Gaspar Becker]

You have to customize the STIG profile first using scap-workbench, unselect
the rules you want to remove and then on the left bottom of
scap-workbench's main page you can generate the ansible playbook for this
customized profile.

This scap-workbench feature of exporting ansible using custom profile is
present on RHEL since 8.3.

Additionally, one quick way of avoiding rules straight from the vanilla
ansible playbook is to skip tasks by their tags. Something like:

ansible-playbook ... --skip-tags
DISA-STIG-RHEL-08-020290,DISA-STIG-RHEL-08-040135
rhel8-playbook-stig.yml

Regards.

On Thu, May 13, 2021 at 10:44 PM Chris Bidwell - NOAA Federal <
[e-mail]> wrote:
> Is there a way with the scap-workbench output to ansible format...To
> exclude specific RHEL STIG ID's?
>
> I've got rhel8-playbook-stig.yml that I'm using for applying my STIG's
> that I've downloaded from:
> https://github.com/RedHatGov/rhel8-stig-latest/blob/master/rhel8-playbook-st...
>
> On Wed, Apr 28, 2021 at 3:20 PM Mark Thacker  wrote:
> > Hi there.
> >
> > Perhaps you are missing the "scap-security-guide" package in RHEL 8.
> >
> > Here is a link to the documentation in RHEL 8:
> > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
> > On 4/27/21 2:27 PM, MyNicePC wrote:
> >
> > Hello,
> >
> > I just installed Openscap Workbench on my laptop. I have apways been able
> > to scan RHEL 6 and RHEL 7 servers using security guides provided within
> > OpenScap. Does anyone know if you support a security guide for RHEL 8?
> >
> > Thank you,
> >
> > JR
> >
> > scap-security-guide mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
> >
> > --
> >
> > Mark Thacker
> >
> > He/Him
> >
> > Team Lead & Security Experience Product Manager, Red Hat Enterprise Linux
> >
> > Red Hat https://www.redhat.com
> >
> > [e-mail]
> > M: [phone]     Twitter / IRC: @thackman
> > https://www.redhat.com
> > _______________________________________________
> > scap-security-guide mailing list --
> > [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> > Do not reply to spam on the list, report it:
> > https://pagure.io/fedora-infrastructure
>
> --
>
> Chris Bidwell, CISSP
> Space Weather Prediction Center
> National Oceanic Atmospheric Administration
> email: c [e-mail]
> office: 303-497-3204
> mobile: [phone]
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure