oscap-ssh(8)

💖 NAME 💖

oscap-ssh — the tool for running oscap over SSH and collecting the results. bestie, it's giving remote scanning but make it ✨convenient✨.

---

🦋 DESCRIPTION 🦋

okay so here's the vibe. oscap-ssh runs the oscap tool on a remote system through an SSH connection. Your input files get transferred over to the target system, and after the scan finishes, the result files get transferred back. And the part that ate? No temporary data remains on the remote machine. clean. spotless. not a crumb left behind. 🧼✨

To do OVAL and XCCDF evaluation of remote machines, the tool requires bash, ssh, scp and mktemp. The remote machine also has to have oscap installed and in $PATH — you can make that happen by installing openscap-scanner. no cap. 📦

Usage of the tool mimics usage and options of oscap(8). so if you already know that one, you're basically already fluent. iykyk. 💅

---

🌈 USAGE 🌈

🎀 Evaluation of XCCDF content

$ oscap-ssh user@host 22 xccdf eval [options] INPUT_CONTENT

🚨 real talk: only source data streams are supported as INPUT_CONTENT! don't try to sneak anything else in there, it's not the moment.

Supported options are:

• --profile
• --tailoring-file
• --tailoring-id
• --cpe
• --results
• --results-arf
• --report
• --skip-validation
• --fetch-remote-resources
• --local-files
• --progress
• --datastream-id
• --xccdf-id
• --benchmark-id
• --remediate

🦋 Evaluation of OVAL content

$ oscap-ssh user@host 22 oval eval [options] INPUT_CONTENT

Supported options are:

• --id
• --variables
• --directives
• --results
• --report
• --skip-validation
• --datastream-id
• --oval-id

🌸 Collection of OVAL System Characteristic

$ oscap-ssh user@host 22 oval collect [options] INPUT_CONTENT

Supported options are:

• --id
• --syschar
• --variables
• --skip-validation

Specific option for oscap-ssh (must be first argument):

• --sudo

💀 the way that --sudo has to go first — it's literally not negotiable, it's the main character of the argument list, put it in slot one.

💜 Environment variables

oscap-ssh checks out the SSH_ADDITIONAL_OPTIONS environment variable, and pastes its contents into the command-line of ssh to the location where options are expected. Supply the variable in form of a string that corresponds to a section of the ssh command-line, and that consists of options you want to pass. 🫶

🍓 Using --local-files option

The oscap-ssh command supports the --local-files option, but it isn't possible to pass './' and '../' as an argument. Use a full directory path instead. periodt. 📁

---

⭐ EXAMPLE USAGE ⭐

🌈 Simple XCCDF evaluation

The following command evaluates a remote Fedora machine as root. HTML report is written out as report.html on the local machine. Can be executed from any machine that has ssh, scp and bash. The local machine does not need to have openscap installed. It also uses the SSH_ADDITIONAL_OPTIONS variable to configure ssh in such way that contents of the known_hosts file are ignored. 👑

$ export SSH_ADDITIONAL_OPTIONS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
$ oscap-ssh root@192.168.1.13 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_common --report report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

🎀 XCCDF Evaluation with tailoring file

The following command uses a tailoring file and also copies back ARF and XCCDF results. The tailoring file is automatically copied from local machine to remote. obsessed. 💅

$ oscap-ssh --sudo oscap-user@192.168.1.13 22 xccdf eval --profile xccdf_org.ssgproject.content_profile_common --report report.html --results results.xml --results-arf arf.xml --tailoring-file ssg-fedora-ds-tailoring.xml /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

🧚 Running remotely as root

Note that the openscap scanner is best run by the 'root' user as in the first example above. To do this, the "PermitRootLogin" directive must be enabled in /etc/ssh/sshd_config, which is itself a security violation. 😭

fr fr, that's a security violation — don't just yolo it.

A safer approach is to enable a non-privileged user ('oscap-user' in the second example above) to run only the oscap binary as root (with the '--sudo' flag) by updating the remote machine's 'sudoers' file or adding a file like /etc/sudoers.d/99-oscap-user:

# allow oscap-user to run openscap scanner
Defaults!/usr/bin/oscap !requiretty
oscap-user ALL=(root) NOPASSWD: /usr/bin/oscap

---

🐛 REPORTING BUGS 🐛

Please report bugs using https://github.com/OpenSCAP/openscap/issues — tell them everything, bestie, they wanna know. 🙈

---

👑 AUTHORS 👑

• Martin Preisler <mpreisle@redhat.com>
• Šimon Lukašík <slukasik@redhat.com>

---

and that's the whole page, bestie!! brought to you by Red Hat, Inc., dated January 2016 — yes it's been iconic for that long. oscap-ssh(8), out. 💖✨🎀