Table of Contents
This is a SIMP module
This module is a component of the System Integrity Management Platform, a compliance-management framework built on Puppet.
If you find any issues, they can be submitted to our JIRA.
This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:
- When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
- In the future, all SIMP-managed security subsystems will be disabled by default and must be explicitly opted into by administrators. Please review simp/simp_options for details.
Module Description
This module sets up openscap and allows you to schedule and log openscap runs.
Setup
What simp openscap affects
simp/openscap will manage:
- openscap-utils and scap-security-guide packages
simp/openscap::schedule will manage:
- A cron job for openscap runs
- A logging directory for openscap (Default: /var/log/openscap)
Setup Requirements
The module can support logrotate if simp/logrotate is used. Otherwise, no additional setup is required.
Beginning with openscap
You can install openscap by:
include 'openscap'Usage
I want to install openscap with default logging
The following will run a cron job on Monday at 1:30 AM and log to /var/log/openscap:
class { 'openscap':
enable_schedule => true,
}OR
include 'openscap::schedule'I have a particular SCAP profile I want to use
class { 'openscap::schedule':
scap_profile => 'xccdf_org.ssgproject.content_profile_stig-rhel7-server-upstream',
}I want to log daily at a set time
class { 'openscap::schedule':
minute => 00,
hour => 22,
weekday => '*',
}I want to log on the first and fifteenth day of the month
class { 'openscap::schedule':
monthday => '1,15',
}I want to log to a different directory
class { 'openscap::schedule':
logdir => '/opt/scaplogs',
}Reference
Please see the REFERENCE.md.
Limitations
This module is designed to work in RHEL-compatible environments.
Development
Please read our Contribution Guide.
