OpenSCAP (Security Content Automation Protocol)

• OpenSCAP
• OpenSCAP - сканер уязвимостей

Rocky Linux 9.3, apply security profile PCI DSS v3.1

# command apply security profile from /var/log/anaconda/anaconda.log

oscap xccdf generate fix
  --template=urn:redhat:anaconda:pre
  --profile=xccdf_org.ssgproject.content_profile_pci-dss
  --datastream-id=scap_org.open-scap_datastream_from_xccdf_ssg-rhel9-xccdf.xml
  --xccdf-id=scap_org.open-scap_cref_ssg-rhel9-xccdf.xml
  /usr/share/xml/scap/ssg/content/ssg-rl9-ds.xml


# здесь есть ansible playbook для наката текущего pci-dss профиля безопасности
/usr/share/scap-security-guide/ansible/rl9-playbook-pci-dss.yml

• Security hardening