Section 8 · System administration
scap-security-guide.8
Package: scap-security-guide
scap-security-guide
NAME
DESCRIPTION
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 10
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 10
EXAMPLES
FILES
SEE ALSO
AUTHOR
NAME
SCAP-Security-Guide − Delivers security guidance, baselines, and associated validation mechanisms utilizing the Security Content Automation Protocol (SCAP).
DESCRIPTION
The project provides practical security hardening advice and also links it to compliance requirements in order to ease deployment activities, such as certification and accreditation. These include requirements in the U.S. government (Federal, Defense, and Intelligence Community) as well as of the financial services and health care industries. For example, high-level and widely-accepted policies such as NIST 800-53 provides prose stating that System Administrators must audit “privileged user actions,” but do not define what “privileged actions” are. The SSG bridges the gap between generalized policy requirements and specific implementation guidance, in SCAP formats to support automation whenever possible.
The projects homepage is located at: https://www.open-scap.org/security-policies/scap-security-guide
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 10
Source data stream: ssg-rhel10-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 10 is broken into ’profiles’, groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_server_l1
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l1
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l2
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
Australian Cyber Security Centre (ACSC) Essential Eight
Profile ID: xccdf_org.ssgproject.content_profile_e8
This is a draft profile for experimental purposes.
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA)
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
This is a draft profile for experimental purposes.
The HIPAA Security Rule establishes U.S. national standards to protect individuals’s electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This draft profile configures Red Hat Enterprise Linux 10 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
Australian Cyber Security Centre (ACSC) ISM Official - Base
Profile ID: xccdf_org.ssgproject.content_profile_ism_o
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation’s security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Australian Cyber Security Centre (ACSC) ISM Official - Secret
Profile ID: xccdf_org.ssgproject.content_profile_ism_o_secret
This is a draft profile for experimental purposes.
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation’s security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Australian Cyber Security Centre (ACSC) ISM Official - Top Secret
Profile ID: xccdf_org.ssgproject.content_profile_ism_o_top_secret
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation’s security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 10
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
This is a draft profile for experimental purposes.
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
This draft profile ensures Red Hat Enterprise Linux 10 is configured in alignment with PCI-DSS v4.0.1 requirements.
Red Hat STIG for Red Hat Enterprise Linux 10
Profile ID: xccdf_org.ssgproject.content_profile_stig
This is a profile based on what is expected in the RHEL 10 STIG. It is not based on the DISA STIG for RHEL 10, because it was not available at time of the release.
In addition to being applicable to Red Hat Enterprise Linux 10, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10.
Red Hat STIG for Red Hat Enterprise Linux 10
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This is a profile based on what is expected in the RHEL 10 STIG.: It is not based on the DISA STIG for RHEL 10, because it was not available at time of the release.
In addition to being applicable to Red Hat Enterprise Linux 10, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10.
Profiles in Guide to the Secure Configuration of Red Hat Enterprise Linux 10
Source data stream: ssg-rl10-ds.xml
The Guide to the Secure Configuration of Red Hat Enterprise Linux 10 is broken into ’profiles’, groupings of security settings that correlate to a known policy. Available profiles are:
ANSSI-BP-028 (enhanced)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the enhanced hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (high)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_high
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the high hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (intermediary)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the intermediary hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
ANSSI-BP-028 (minimal)
Profile ID: xccdf_org.ssgproject.content_profile_anssi_bp28_minimal
This is a draft profile for experimental purposes. This draft profile contains configurations that align to ANSSI-BP-028 v2.0 at the minimal hardening level.
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d’information. ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems.
A copy of the ANSSI-BP-028 can be found at the ANSSI website: https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/
An English version of the ANSSI-BP-028 can also be found at the ANSSI website: https://cyber.gouv.fr/publications/configuration-recommendations-gnulinux-system
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server
Profile ID: xccdf_org.ssgproject.content_profile_cis_server_l1
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l1
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation
Profile ID: xccdf_org.ssgproject.content_profile_cis_workstation_l2
This is a draft profile for experimental purposes. It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn’t yet exist at time of the release.
Australian Cyber Security Centre (ACSC) Essential Eight
Profile ID: xccdf_org.ssgproject.content_profile_e8
This is a draft profile for experimental purposes.
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Essential Eight.
A copy of the Essential Eight in Linux Environments guide can be found at the ACSC website:
https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers
Health Insurance Portability and Accountability Act (HIPAA)
Profile ID: xccdf_org.ssgproject.content_profile_hipaa
This is a draft profile for experimental purposes.
The HIPAA Security Rule establishes U.S. national standards to protect individuals’s electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
This draft profile configures Red Hat Enterprise Linux 10 to the HIPAA Security Rule identified for securing of electronic protected health information. Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s).
Australian Cyber Security Centre (ACSC) ISM Official - Base
Profile ID: xccdf_org.ssgproject.content_profile_ism_o
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation’s security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Australian Cyber Security Centre (ACSC) ISM Official - Secret
Profile ID: xccdf_org.ssgproject.content_profile_ism_o_secret
This is a draft profile for experimental purposes.
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation’s security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
Australian Cyber Security Centre (ACSC) ISM Official - Top Secret
Profile ID: xccdf_org.ssgproject.content_profile_ism_o_top_secret
This draft profile contains configuration checks for Red Hat Enterprise Linux 10 that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM).
The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning Red Hat Enterprise Linux security controls with the ISM, which can be used to select controls specific to an organisation’s security posture and risk profile.
A copy of the ISM can be found at the ACSC website:
PCI-DSS v4.0.1 Control Baseline for Red Hat Enterprise Linux 10
Profile ID: xccdf_org.ssgproject.content_profile_pci-dss
This is a draft profile for experimental purposes.
Payment Card Industry - Data Security Standard (PCI-DSS) is a set of security standards designed to ensure the secure handling of payment card data, with the goal of preventing data breaches and protecting sensitive financial information.
This draft profile ensures Red Hat Enterprise Linux 10 is configured in alignment with PCI-DSS v4.0.1 requirements.
Red Hat STIG for Red Hat Enterprise Linux 10
Profile ID: xccdf_org.ssgproject.content_profile_stig
This is a profile based on what is expected in the RHEL 10 STIG. It is not based on the DISA STIG for RHEL 10, because it was not available at time of the release.
In addition to being applicable to Red Hat Enterprise Linux 10, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10.
Red Hat STIG for Red Hat Enterprise Linux 10
Profile ID: xccdf_org.ssgproject.content_profile_stig_gui
This is a profile based on what is expected in the RHEL 10 STIG.: It is not based on the DISA STIG for RHEL 10, because it was not available at time of the release.
In addition to being applicable to Red Hat Enterprise Linux 10, this configuration baseline is applicable to the operating system tier of Red Hat technologies that are based on Red Hat Enterprise Linux 10.
EXAMPLES
To scan your system utilizing the OpenSCAP utility against the ospp profile:
oscap xccdf eval —profile ospp —results-arf /tmp/‘hostname‘-ssg-results.xml —report /tmp/‘hostname‘-ssg-results.html /usr/share/xml/scap/ssg/content/ssg-{product}-xccdf.xml
Additional details can be found on the following websites:
https://www.github.com/ComplianceAsCode/content
The project’s Github page.
https://complianceascode.readthedocs.io
The project’s ReadTheDocs page.
https://app.gitter.im/#/room/#Compliance-As-Code-The_content:gitter.im
The project’s Gitter IM space
FILES
/usr/share/xml/scap/ssg/content
Houses SCAP content utilizing the following naming conventions:
SCAP Source data streams: ssg-{product}-ds.xml
/usr/share/scap-security-guide/ansible/
Contains Ansible Playbooks for SSG profiles.
/usr/share/scap-security-guide/kickstart/
Contains example kickstarts that install systems hardened against a particular profile.
/usr/share/scap-security-guide/tailoring/
Contains tailoring files that enable rules that are not covered by third-party SCAP content and disables rules that are covered by the content shipped in scap-security-guide.
SEE ALSO
oscap(8)
AUTHOR
Please direct all questions to the SSG mailing list: https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide