OS security hardening guide

Learn how to use OpenSCAP to security harden the operating system in an Exasol deployment.

The OpenSCAP open-source project provides a toolkit for parsing and evaluating components of the Security Content Automation Protocol standard (SCAP).

This article explains how to use the NIST-certified command line scanner oscap provided by OpenSCAP to perform a CIS Level 2 Benchmark scan on an Exasol host system and generate a report.

The following example shows how to install and run oscap in Ubuntu 24.04 LTS. If the Exasol host is running a different Linux distribution, refer to the OpenSCAP documentation .

Prerequisites

• An Exasol host system running on Ubuntu 24.04 LTS

• An additional equivalent Exasol system for testing remediations (optional but strongly recommended)

Install oscap and run a scan

1. Download and install OpenSCAP and additional necessary tools:

   Copy

   apt-get update
   apt-get install -y \
     openscap-scanner \
     openscap-utils \
     git \
     wget \
     unzip \
     lsb-release

2. Get the latest SSG version number:

   Copy

   SSG_VERSION=$(git ls-remote --tags --refs --sort='v:refname' https://github.com/ComplianceAsCode/content.git | grep -Pio '(\d+(\.)){2}[\w\.-][\d+]' | tail -1)

3. Get the Ubuntu release number:

   Copy

   UBUNTU_RELEASE=$(lsb_release -r | grep -Pio '(\d+\.\d+)' | sed 's/\.//g')

4. Check to make sure the variables are not null:

   Copy

   echo "SSG Version: $SSG_VERSION"
   echo "Ubuntu Release: $UBUNTU_RELEASE"
   SSG Version: 0.1.82
   Ubuntu Release: 2404

5. Download the most recent security guide:

   Copy

   wget https://github.com/ComplianceAsCode/content/releases/download/v${SSG_VERSION}/scap-security-guide-${SSG_VERSION}.zip -O ssg.zip
   unzip -jo ssg.zip "scap-security-guide-${SSG_VERSION}/*" -d ssg

6. Scan using the CIS Level 2 compliance profile:

   Copy

   oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level2_server --results oscap-results.xml ssg/ssg-ubuntu${UBUNTU_RELEASE}-ds.xml

   Which compliance profiles are available depends on the operating system used. To review the available profiles, use oscap info.

7. Generate a HTML version of the scan report:

   Copy

   oscap xccdf generate report oscap-results.xml > oscap-results.html

8. Review the results in oscap-results.html.

9. Apply the available remediations:

   Do not apply remediations directly on a production Exasol host without first testing the impact on an equivalent system. The remediations can alter SSH, PAM, audit, firewall, password, service, and filesystem settings.

   Copy

   oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_cis_level2_server --results oscap-results-remediated.xml ssg/ssg-ubuntu${UBUNTU_RELEASE}-ds.xml

10. Generate a new scan report:

    Copy

    oscap xccdf generate report oscap-results-remediated.xml > oscap-results-remediated.html 

11. Review the remediation results in oscap-results-remediated.html.