logo

scap-workbench is a tool that can open XCCDF [1] or SDS [2] files and allows the user to evaluate either local or remote machine using the content in the opened file.

Feature Highlights

intro screenshot

  • XCCDF 1.1 and 1.2 support

  • Source DataStream 1.2 support

  • XCCDF 1.2 Tailoring file support

  • Evaluation of local machine

  • Evaluation of remote machine (using SSH)

  • Limited tailoring support - selection and unselection

  • Saving results as XCCDF 1.1 or 1.2 (depending on input) or ARF 1.1

  • Loading content bundle from RPM

  • Exporting content bundle as RPM or into a folder

Requirements

Build Dependencies

  • cmake >= 2.6

  • Qt4 (Core, GUI, XmlPatterns)

  • openscap >= 1.0.9

  • cmake-gui [optional]

Runtime Dependencies (workbench machine)

  • setsid

  • nice

  • ssh and scp (if you want remote scanning)

Runtime Dependencies (evaluated machine)

  • oscap >= 0.8.0

Installation

From package repository (YUM)

# yum install scap-workbench

From package repository (APT)

# apt-get install scap-workbench

From source

  1. $ mkdir build ; cd build

  2. $ cmake ../

  3. $ make

  4. # make install

From source (custom options)

  1. $ mkdir build ; cd build

  2. $ cmake-gui ../

  3. (select appropriate options in cmake-gui)

  4. $ make

  5. # make install

Typical Use Case

Let us go over a common use case. Any section marked (optional) can be skipped if you do not need the feature explained in it.

Obtain SCAP content

Even before we start the workbench we need to find content to open. Probably the best choice right now is scap-security-guide [3].

From the package repository (YUM)

# yum install scap-security-guide

From the package repository (APT)

# apt-get install scap-security-guide

From upstream source (for advanced users or content developers)

  1. $ git clone https://git.fedorahosted.org/git/scap-security-guide.git ; cd scap-security-guide

  2. $ make

Alternative SCAP content (optional)

Start scap-workbench

After installation a new application entry for scap-workbench should appear in your desktop environments application menu.

starting scap workbench
Figure 1. scap-workbench application entry in GNOME 3

In case you cannot find any scap-workbench application icon / entry to click, press Alt+F2 to bring up the run command dialog (works in Gnome 3 and KDE 4), type 'scap-workbench' and confirm.

scap-workbench should start and if you installed scap-security-guide from your package repository, workbench will immediately open it without any interaction being necessary.

default content opened
Figure 2. Default content opened in workbench

Open Different Content (optional)

Choosing the Open content action from the File menu (top of the main window) will enable you to change opened content. Keep in mind that workbench only supports opening XCCDF, Source DataStream or SCAP RPM files. Everything else will result in an error dialog being shown.

If your content provider ships both XCCDF and Source DataStream files you are better off using Source DataStream. Especially if you want to perform remote scans where workbench only supports datastreams so far.

SCAP RPM will usually contain a tailoring file, as well as input file in the form of XCCDF or Source DataStream.

Only one content file can be opened by a single scap-workbench instance. Opening a different content file will DESTROY all your tailoring changes and you will also LOSE profile selection.

The one content file however can contain multiple checklists if it is a datastream. Changing the checklist will CHANGE profile selection and MAY make your tailoring unusable / not applicable to the newly selected checklist.

As a general rule, make sure you have the right file and right checklist selected before proceeding to tailoring and/or profile selection.

To prevent workbench from opening default content when it starts you can either uninstall the content or pass a different path via command line.

scap-workbench PATH_TO_SCAP_CONTENT

See alternative contents for more content choices.

If you pass a path that is invalid or points to a file that is not valid XCCDF or SDS, workbench will show an error dialog and open default content automatically.

Load a Ready-Made Tailoring File (optional)

In case you have prepared or were given a tailoring file for your specific evaluation use-case, you can load by clicking on the Tailoring file combobox and selecting the (open tailoring file…​) option. This will bring up a file open dialog where you can select your tailoring file.

Loading a tailoring file will DESTROY all your tailoring changes that you have done either by customizing profiles or loaded from another tailoring file.

Only XCCDF 1.2 supports tailoring officially. The openscap project has an extension that allows tailoring files to be used with XCCDF 1.1 so scap-workbench supports that as well. The details are out of scope of this document but keep in mind that tailoring of an XCCDF 1.1 file might not work with scanners other than openscap.

opening tailoring file
Figure 3. Opening a tailoring file

Choose a Profile

XCCDF profiles are in essence configurations of the content for a particular evaluation scenario. XCCDF profiles decide which rules are selected and which values they use - e.g.: one profile may enforce password length to be at least 10 characters, a different one may be more lenient and enforce password length of at least 6 characters.

For more details refer to the XCCDF specification.

This section mentions (default) profile a lot. The word 'default' is not a very fortunate choice considering what the profile does. This profile is empty, it has no select or refine-value elements.

Whenever we talk about this special profile we use '(default)' with braces to avoid confusion. As a contrast, 'default profile' means the profile selected by default.

All SCAP content has at least one profile - the (default) profile which is an empty profile that does not change selection of any rules and does not affect values passed to any of the checks. Only rules with the selection attribute equal to "true" and all their ancestor xccdf:Group selection attribute also being "true" are evaluated in a (default) profile.

It depends on the content, but the (default) profile is unlikely to be the choice you want. scap-workbench will only choose it implicitly if there are no other profiles. The first profile that is not the (default) profile will be chosen.

Use the Profile combobox to change which profile will be used for subsequent evaluation. When scap-workbench is not evaluating, it previews selected rules of the current profile. This list will refresh every time you customize a profile or select a different one.

Customize the Selected Profile (optional)

After you have selected the profile suitable for your desired evaluation, you still may want to make slight alterations to it. Most commonly, it would be unselecting that one undesirable rule that makes no sense on this particular machine.

Make sure your desired profile is selected and click Customize.

In case the tailoring action will create a new profile you will be presented with a dialog that lets you choose an ID for that new profile. Choose the ID wisely, you may need it later.

customizing ssg profile
Figure 4. Customizing scap-security-guide’s "common" profile

A new modal window will be shown, you cannot interact with the rest of the application until you either confirm or discard your tailoring changes.

In the example case, we do not care about minimum and maximum age for passwords and do not want the rules failing for our configuration. Let us expand the tree until we find the offending rules and unselect them both.