Missing C2S Profile

[tkokev]

Description of problem:

While building a new AMI recently for our C2S environment, I noticed the xccdf_org.ssgproject.content_profile_C2S profile is no longer an option for ssg-centos7-ds.xml.

SCAP Security Guide Version:

scap-security-guide-0.1.40-13.el7.centos.noarch

Operating System Version:

 $ uname -a
Linux pf2hyperv 3.10.0-957.21.2.el7.x86_64 #1 SMP Wed Jun 5 14:26:44 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Steps to Reproduce:

$ rpm -qa|grep scap
openscap-1.2.17-2.el7.x86_64
perl-Pod-Escapes-1.04-294.el7_6.noarch
scap-security-guide-0.1.40-13.el7.centos.noarch
openscap-scanner-1.2.17-2.el7.x86_64
$ oscap info /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml|grep C2S
                        Title: C2S for Red Hat Enterprise Linux 7
                                Id: xccdf_org.ssgproject.content_profile_C2S
$ sudo yum update scap-security-guide-0.1.40-13.el7.centos.noarch
$ oscap info /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml|grep C2S
$

Is there an equivalent profile still available in some other form or was it discontinued for some reason?

[redhatrises]

The C2S profile is an "official" profile and was removed for non-official use in addition it is no longer being uses or developed going forward in later versions.

[shawndwells]

Extending that - the government let us know they no longer follow the historical CIS-inspired baseline and has since moved to the NIST National Checklist for RHEL7 and RHEL 8, e.g. https://nvd.nist.gov/ncp/checklist/909

(in the content, that would be the ospp profile)

[tkokev]

@redhatrises not sure what is meant by "official" but appreciate the update on the C2S profile.

I took a look at the link @shawndwells provided and see things are focused on ansible which is cool because we already use it on instances for other app specific setup just never on hardening related tasks. So are the days gone where we could launch an instance with this simple two liner in the userdata to come away with a hardened instance? Not quite sure how the newer approach maps to our previous process.

yum install scap-security-guide -y
oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_C2S --results /root/scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml

Or is it as simple as switching the above to oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_ospp --results /root/scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml?

[shawndwells]

@redhatrises not sure what is meant by "official" but appreciate the update on the C2S profile.

From AWS' webpage at https://aws.amazon.com/federal/us-intelligence-community/:

"C2S is the government program and contract vehicle that brings Amazon Web Services (AWS) “over the fence” and into the Intelligence Community (IC). This air-gapped AWS Region on the Top Secret fabric has been operating since 2014 and is exclusively available to the U.S. IC."

The C2S profile within ComplianceAsCode correlated to the security baseline the Government used for this environment. Because the Government now uses the NIST National Checklists for RHEL 8, there was no need for a specific C2S profile anymore.

[shawndwells]

I took a look at the link @shawndwells provided and see things are focused on ansible which is cool because we already use it on instances for other app specific setup just never on hardening related tasks. So are the days gone where we could launch an instance with this simple two liner in the userdata to come away with a hardened instance? Not quite sure how the newer approach maps to our previous process.

yum install scap-security-guide -y
oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_C2S --results /root/scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml

Or is it as simple as switching the above to oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_ospp --results /root/scan-xccdf-results.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml?

There are different rule selections between the profiles, but yes -- essentially you'd need to swap the --profile argument. To see a list of shipping profiles (looks like you're using downstream content in CentOS?), run oscap info on the datastream.