Using as a base for organizational profile for compliance scanning

[jbouse]

Looking to see if it would be possible to extend existing content as a base to generate a custom internal organizational profile based on existing standard profiles but with unique values based on requirements set down by internal security & compliance. I realize I can accomplish some of this via tailoring files to scan but that did not appear to properly generate the Ansible playbooks or base scripts as it does with existing content.

My goal is to obviously develop a repeatable and reliable method by which to maintain the requirements set forth by the organization that extends and expands on the already existing profiles but I also don't wish to do so from scratch so would like to leverage as much existing base material as possible so as not to reinvent the wheel.

[marcusburghardt]

Hi @jbouse , I believe you can achieve at least part of your goal via OpenSCAP tools. Once you already have a tailored file but not the Ansible playbooks, you can try to generate them with oscap:
https://static.open-scap.org/openscap-1.3/oscap_user_manual.html#_generating_ansible_playbooks

Does it help you?

[jbouse]

Hi @marcusburghardt, thanks for responding. So assumably I just provide the --tailoring-file option to the oscap xccdf generate fix command to generate the ansible playbook just as I would call oscap xccdf eval command to scan? This would cover that aspect then.

Looking into creating the tailored file using the SCAP Workbench I've seen I can modify the values for the various tests. I'm just working now to try and generate the file with the values provided by the organization. One interesting case is the contents of the system warning banner verbiage. Obviously, they have their own format different from STIG or other profiles. Are you aware of any tools to help in generating the format for that validation?

[marcusburghardt]

Correct. This should solve your demand.

The project has a file where the predefined options are set:
https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/accounts/accounts-banners/login_banner_text.var#L5

During the build time, these values are converted to regex format. For example, the line
Authorized uses only. All activity may be monitored and reported.

appears in SCAP Workbench like this:
^Authorized[\s\n]+uses[\s\n]+only\.[\s\n]+All[\s\n]+activity[\s\n]+may[\s\n]+be[\s\n]+monitored[\s\n]+and[\s\n]+reported\.$

I am not used to external tools to do this "conversion" but I found many straightforward web tools that could be helpful for ad-hoc tasks. For example:
http://www.regexlab.com/wild2regex

If you want to test your regex, I particularly like to use the tools available at https://regex101.com/.