Deployment guide

OpenSCAP

This image ships OpenSCAP 1.3.9 on Ubuntu 24.04 LTS, paired with SCAP Security Guide content release 0.1.81, ready to audit from the first boot of every deployed virtual machine. The scanner is installed unmodified from Ubuntu's own archive, so it stays patchable through the normal apt path for the life of the release.

OpenSCAP is the reference open source implementation of the SCAP standard, the machine readable format governments and auditors use to express security policy. It evaluates a system against a published benchmark and reports exactly which rules pass, which fail, and why.

What this appliance does and does not do

OpenSCAP is a compliance scanner, not a compliance programme. Read this section before you deploy, so you know exactly what the appliance does and does not do.

OpenSCAP's core mechanism works as designed on Azure. Parsing a datastream and evaluating rules against live system state is unaffected by virtual networking or hypervisors. A real evaluation with real pass and fail counts confirmed this on the image, and you can reproduce it yourself in section 5.

This image does not include, and OpenSCAP itself is not:

A web console or dashboard of any kind
A fleet inventory or central management server
A historical trending or reporting database
A ticketing or workflow integration

It measures and reports. It does not make anything compliant. Scanning a machine changes nothing about that machine. Four deployment patterns follow from that:

Audit this machine against a CIS or DISA STIG benchmark, producing an HTML report and machine-readable results. This works with no configuration and has already run once by the time you sign in. Covered in sections 4 and 5.
Detect configuration drift on a schedule, so a system hardened in January is proven still hardened in June. Covered in section 6.
Audit other machines over SSH from this one, so a single appliance can cover a small estate. Covered in section 7.
Generate remediation as shell scripts or Ansible playbooks, scoped to the rules that failed, for an engineer to review and apply deliberately. Covered in section 8.

If you need a compliance platform with a dashboard across a fleet, this image is not that, and no configuration makes it that.

What makes this image different

The content can audit this operating system. Ubuntu 24.04 ships SCAP Security Guide content at version 0.1.71, which predates upstream's Ubuntu 24.04 benchmark. Those packages contain datastreams for Ubuntu 16.04, 18.04, 20.04 and 22.04, and no Ubuntu 24.04 datastream at all.

A scanner installed from the distribution archive alone therefore cannot audit the operating system it runs on. It installs cleanly and answers oscap --version, but it is useless for the one job you deployed it to do. This image ships the current upstream content release instead, verified against its published checksum. All five Ubuntu 24.04 profiles are available the moment you sign in.

A baseline report is already waiting. Every virtual machine deployed from this image runs a CIS Level 1 Server evaluation of itself on first boot and leaves the report on disk. The appliance arrives having already proved that it works.

The image fails closed on content integrity. For a compliance tool, the worst outcome is a confident wrong answer: a scan that runs against missing or corrupt policy content produces a clean-looking report that you then file as evidence. Two independent safeguards check the content on every scheduled run, not only the first. If the datastream has been altered, they refuse to produce a report at all.

Nothing remediates automatically. OpenSCAP can apply fixes directly, but this image never does, whether at build time, at first boot or on a schedule. Remediation is destructive, so it is always a deliberate act. See section 8.

There is no login and no password. OpenSCAP has no user database, no daemon and no web interface, so there is nothing to rotate and nothing to leak. You administer the appliance over SSH with your own key.

1. Deploy the virtual machine

Deploy the image from the Azure Marketplace. This guide assumes the following settings:

Size: Standard_B2s (2 vCPU, 4 GB) is sufficient and is what this image is validated on. A full CIS Level 1 Server evaluation completes in about a minute on this size.
Inbound ports: SSH (22) only. The appliance runs no daemon and binds no port of its own, so nothing else needs to be open.
Authentication: your own SSH public key.

2. Connect to the virtual machine

Connect to the VM over SSH with your own key:

ssh azureuser@<vm-ip>

3. Confirm the scanner and its content

Check the scanner version and the packages behind it:

oscap --version | head -3 dpkg-query -W -f='${Package} ${Version}\n' openscap-scanner openscap-common libopenscap25t64

Expected output:

OpenSCAP command line tool (oscap) 1.3.9 Copyright 2009--2023 Red Hat Inc., Durham, North Carolina. libopenscap25t64 1.3.9+dfsg-1.1ubuntu2 openscap-common 1.3.9+dfsg-1.1ubuntu2 openscap-scanner 1.3.9+dfsg-1.1ubuntu2

Confirm which content release is installed and where:

cat /usr/share/sac/openscap/CONTENT-VERSION.txt

Expected output:

SCAP Security Guide (ComplianceAsCode) content release: 0.1.81 Source: https://github.com/ComplianceAsCode/content/releases/download/v0.1.81/scap-security-guide-0.1.81.tar.gz Published sha512 (archive): b5b54150e1ae0cdf2777c41c4e1cd0234aea2ce3a2079f4b0701e93edfc30cab58852655a90bd140b99f9804f36f4ab63811b138709a3ab00373ecb99c02aada Installed datastream: /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml Datastream sha256: 1e0a80f096a0c4ae86bbc6374b5897c33d303c585c681ae6fbc1f760d9c08742 Licence: BSD-3-Clause (see /usr/share/doc/sac/SSG-BSD-3-CLAUSE-LICENSE.txt)

Confirm that the datastream is a valid SCAP source datastream. The appliance runs the same check before every scheduled scan:

sudo oscap ds sds-validate /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml && echo "datastream valid"

Expected output:

datastream valid

4. See which benchmarks you can audit against

List every profile the installed content provides:

oscap info --profiles /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

Expected output:

xccdf_org.ssgproject.content_profile_cis_level1_server:CIS Ubuntu Linux 24.04 LTS Benchmark for Level 1 - Server xccdf_org.ssgproject.content_profile_cis_level1_workstation:CIS Ubuntu Linux 24.04 LTS Benchmark for Level 1 - Workstation xccdf_org.ssgproject.content_profile_cis_level2_server:CIS Ubuntu Linux 24.04 LTS Benchmark for Level 2 - Server xccdf_org.ssgproject.content_profile_cis_level2_workstation:CIS Ubuntu Linux 24.04 LTS Benchmark for Level 2 - Workstation xccdf_org.ssgproject.content_profile_stig:Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (STIG) V1R1

Choose between the profiles as follows:

CIS Level 1 Server is the sensible default and what the appliance uses. It covers widely agreed hardening that rarely breaks a working system.
CIS Level 2 Server adds defence in depth for higher-security environments. It is materially stricter and more likely to affect running services.
STIG is the US Department of Defense benchmark. Use it when you are specifically required to.
The workstation variants apply to desktop systems and are usually the wrong choice for a server.

5. Read the baseline report, and run your own scan

Your machine scanned itself on first boot. Read the instance note to see the result:

sudo cat /root/openscap-instance.txt

List the stored reports:

sudo ls -lh /var/lib/sac/data/openscap/reports/

The directory holds an HTML report and a matching XML results file. The HTML is for people. The XML is machine-readable ARF data for whatever consumes your evidence.

Now run an evaluation yourself, so that you see it work end to end. This takes about a minute:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results /tmp/my-results.xml \
  --report /tmp/my-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml > /tmp/eval.log 2>&1; echo "oscap exit code: $?"

Expected output:

oscap exit code: 2

Exit code 2 is the correct and expected result. OpenSCAP uses three exit codes:

Code Meaning

0 Every rule passed

1 A genuine error: bad profile, unreadable content, scanner failure

2 The scan ran correctly and one or more rules failed

A CIS benchmark scan of a general-purpose server image is expected to report failures. Exit code 2 means the scanner did its job, and only exit code 1 indicates a real problem. If you wire the scan into automation, treat 0 and 2 as successful runs and 1 as a failure. Otherwise your pipeline reports red forever.

Count what the scan found:

echo "passed: $(grep -c '<result>pass</result>' /tmp/my-results.xml)"
echo "failed: $(grep -c '<result>fail</result>' /tmp/my-results.xml)"

Expected output, with figures in this range:

passed: 230 failed: 115

These numbers are real rule outcomes on a stock Ubuntu 24.04 server. They are not a problem to fix before you use the machine. They are the gap between a general-purpose cloud image and a hardened one, which is exactly what you deployed a scanner to measure.

To read the report, copy it to your workstation and open it in a browser. Run this command from your own machine, not from the virtual machine:

scp azureuser@<vm-ip>:/tmp/my-report.html ./openscap-report.html

Back on the virtual machine, clean up the files you created:

sudo rm -f /tmp/my-results.xml /tmp/my-report.html /tmp/eval.log && echo "cleaned up"

6. Scheduled drift detection

The appliance re-runs the evaluation on a schedule and keeps dated reports, so you can show that a machine hardened months ago is still hardened. Check the schedule:

systemctl list-timers openscap-scan.timer --no-pager

Expected output:

NEXT LEFT LAST PASSED UNIT ACTIVATES Mon 2026-07-20 00:02:32 UTC 1 day 8h Sat 2026-07-18 15:06:58 UTC - openscap-scan.timer openscap-scan.service

The scan runs weekly by default, with a randomised delay so that a fleet launched from this image does not all scan at the same instant. View the scan configuration:

cat /etc/sac/openscap-scan.conf

The three settings are the profile to evaluate, whether the scheduled scan is enabled at all, and how many dated reports to retain. To change the profile, edit the file and set SCAN_PROFILE to any profile ID from section 4:

sudo nano /etc/sac/openscap-scan.conf

Check the status and the most recent run:

systemctl status openscap-scan.service --no-pager 2>&1 | head -12 sudo journalctl -u openscap-scan.service --no-pager -n 20

The fail-closed safeguard. Before every scheduled scan, the appliance verifies three things: the policy content is present, its checksum still matches the one recorded when the image was built, and it still validates as a SCAP datastream. If any check fails, the scan refuses to run rather than produce a report from content it cannot vouch for. Run the check yourself:

sudo /usr/local/sbin/openscap-preflight && echo "content integrity verified"

Expected output:

content integrity verified

7. Audit other machines over SSH

One appliance can audit a small estate. oscap-ssh connects to a target host, evaluates it and writes the report back here. The target needs the OpenSCAP scanner installed, and you need SSH access to it with an account that can sudo.

Nothing listens on this machine for this to work. The connection is outbound only, from this appliance to the target, using your own key. Run:

oscap-ssh --sudo ubuntu@<target-host> 22 xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --report /var/lib/sac/data/openscap/reports/target-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

You evaluate the target against a benchmark for its own operating system. The datastream on this image is the Ubuntu 24.04 benchmark, so it is the right content for Ubuntu 24.04 targets. To audit a different distribution, supply the datastream that matches it.

8. Generate remediation, and review it before you apply it

Read this before you run anything in this section. OpenSCAP can apply fixes automatically. This image never does, and you should be just as deliberate. CIS Level 2 and STIG remediation on Ubuntu disables services, tightens SSH configuration and sets restrictive mount options. Applied without review to a machine you reach over SSH, it can lock you out of that machine. There is no undo.

The safe workflow is to generate remediation scoped to what failed on your system, read it, and apply it deliberately in a change window with console access available.

Generate a remediation script from your own scan results:

sudo oscap xccdf generate fix \
  --fix-type bash \
  --result-id "" \
  /tmp/my-results.xml > /tmp/remediate.sh

The image also ships upstream's complete remediation content for all five profiles, as both shell scripts and Ansible playbooks. This content is reference material. It is installed non-executable by design, so nothing can invoke it by accident. List it:

ls -1 /usr/share/sac/openscap/remediation/bash/
ls -1 /usr/share/sac/openscap/remediation/ansible/

Expected output:

ubuntu2404-script-cis_level1_server.sh ubuntu2404-script-cis_level1_workstation.sh ubuntu2404-script-cis_level2_server.sh ubuntu2404-script-cis_level2_workstation.sh ubuntu2404-script-stig.sh ubuntu2404-playbook-cis_level1_server.yml ubuntu2404-playbook-cis_level1_workstation.yml ubuntu2404-playbook-cis_level2_server.yml ubuntu2404-playbook-cis_level2_workstation.yml ubuntu2404-playbook-stig.yml

The Ansible playbooks are usually the better route for anything beyond a single machine, because they are idempotent and you can run them in check mode first.

Upstream also ships human-readable HTML guides that describe every rule in each benchmark. Read them before you harden anything:

ls -1 /usr/share/doc/sac/openscap-guides/

9. Keeping the content current

The scanner is patched through the normal apt path along with the rest of the operating system, and unattended upgrades are enabled on this image.

The SCAP content is a pinned release. A compliance benchmark is a fixed reference point rather than a rolling target, and you generally want it to hold still between audits. To move to a newer benchmark, replace the datastream and update the recorded checksum so that the integrity check keeps working:

SSG_VER=0.1.82 cd /var/tmp curl -fsSLO https://github.com/ComplianceAsCode/content/releases/download/v${SSG_VER}/scap-security-guide-${SSG_VER}.tar.gz curl -fsSLO https://github.com/ComplianceAsCode/content/releases/download/v${SSG_VER}/scap-security-guide-${SSG_VER}.tar.gz.sha512 sha512sum -c scap-security-guide-${SSG_VER}.tar.gz.sha512 tar -xzf scap-security-guide-${SSG_VER}.tar.gz --wildcards "scap-security-guide-${SSG_VER}/ssg-ubuntu2404-ds.xml"
sudo install -m 0644 scap-security-guide-${SSG_VER}/ssg-ubuntu2404-ds.xml \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
sudo sha256sum /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml | awk '{print $1}' \
  | sudo tee /usr/share/sac/openscap/datastream.sha256

Verify the checksum against upstream's published value before you trust new content, as the commands above do. Skipping this step defeats the integrity safeguard entirely.

10. Scanning scope and authorisation

Scanning a machine you do not own or operate may be unlawful and is generally a breach of your cloud provider's acceptable use policy. Audit only systems you are authorised to audit.

Within Azure, evaluating your own virtual machines is a normal administrative activity and needs no special permission from Microsoft.

11. Logs and troubleshooting

The first-boot baseline scan logs to the journal. Read the log:

sudo journalctl -u openscap-firstboot.service --no-pager -n 30

If the first-boot scan did not complete, the appliance tells you rather than hiding it. The scheduled scan refuses to run, because it requires first boot to have succeeded. Check the unit state:

systemctl is-enabled openscap-firstboot.service
systemctl is-active openscap-scan.timer

Expected output:

enabled active

Common situations and their fixes:

oscap exits 2 and you expected 0. This is a successful scan that reports rule failures. See the table in section 5.
oscap exits 1. This is a genuine error. Check the log you redirected the run into, and confirm that the profile ID is spelled correctly against section 4. A misspelled profile is by far the most common cause.
The scheduled scan refuses to run. The content integrity check failed. Run sudo /usr/local/sbin/openscap-preflight to see which check failed. If you replaced the datastream without updating the recorded checksum, see section 9.
A scan seems slow. A full profile evaluation reads a great deal of system state. About a minute on a Standard_B2s is normal.

12. Licence

OpenSCAP is licensed under the GNU Lesser General Public License, version 2.1 or later. The scanner is installed unmodified from Ubuntu's archive. The license text is at /usr/share/doc/openscap-scanner/copyright, and a written offer for the corresponding source is at /usr/share/doc/sac/OPENSCAP-LGPL-2.1-WRITTEN-OFFER.txt.

The SCAP Security Guide content is licensed under the BSD 3-Clause License, Copyright (c) 2012-2017 Red Hat, Inc. and the ComplianceAsCode contributors. The license text is retained on the image at /usr/share/doc/sac/SSG-BSD-3-CLAUSE-LICENSE.txt, as that license requires.

ls -1 /usr/share/doc/sac/ | head -6

SecureAnyCloud is not affiliated with, endorsed by, or sponsored by Red Hat, Inc. or the ComplianceAsCode project. CIS and DISA STIG are the marks of the Center for Internet Security and the US Defense Information Systems Agency respectively. The profiles on this image are the ComplianceAsCode community implementations of those benchmarks. They are not certified by or affiliated with either body, and a passing scan is not a certification of compliance.

Support

Every SecureAnyCloud image comes with 24/7 support. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on Azure

Launch OpenSCAP on Ubuntu 24.04 LTS by SecureAnyCloud with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

OpenSCAP is the reference open-source implementation of the Security Content Automation Protocol (SCAP). It parses a SCAP datastream, evaluates the policy rules against the live state of the system, and produces a human-readable HTML report and a machine-readable ARF (Asset Reporting Format) results file.

This AMI pairs the oscap scanner with the upstream SCAP Security Guide content, so the appliance can audit the operating system it runs on against real CIS and DISA STIG benchmarks the moment it boots. OpenSCAP is a compliance scanner, not a compliance suite. It measures and reports, and it never makes a machine compliant on its own.

What you get:

A single-node audit and drift-detection appliance that shows where a machine stands against a chosen policy profile and gives you evidence you can keep, including CIS and STIG evidence
No web console, no fleet inventory and no historical dashboard
No login and no credential of any kind. OpenSCAP has no web interface, no daemon and no user database. You operate it from the command line over SSH with your own key, so there is nothing to rotate and nothing to leak
Fail-closed behaviour. For a compliance product, the worst outcome is a confident wrong answer. The appliance verifies the integrity of its policy content before every scheduled scan: the datastream must be present, unaltered against its recorded checksum, and accepted by the scanner. A failed first boot stops the scheduled scan rather than reporting a clean result from missing content

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from the networks you administer from
The AWS CLI version 2 installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for OpenSCAP. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger as a balanced default. A full CIS evaluation parses a large datastream into memory and runs many checks, so give the instance at least 4 GB of RAM.

Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that allows inbound port 22 from the networks you administer from. OpenSCAP binds no network port of its own, so only port 22 is required.

Select Launch instance. On first boot, the appliance runs a baseline compliance scan of the instance automatically. The scan takes a couple of minutes after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud OpenSCAP Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens port 22 from the networks you administer from.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openscap}]'

Connect to your instance over SSH

Connect to the instance over SSH as the default login user for the operating system variant you launched. Replace the key path and instance address with your own.

ssh -i /path/to/your-key.pem <login-user>@<vm-ip>

The login user differs by variant:

Operating system variant SSH login user

Ubuntu 24.04 LTS ubuntu

Read the first-boot baseline summary

On the first boot of every deployed instance, the appliance runs a baseline compliance scan and writes a short summary to a root-only note. Read the note to confirm that the scan ran and to see the headline pass and fail counts for this instance:

sudo cat /root/openscap-instance.txt

A CIS scan of a general-purpose server image is expected to report failures. The report shows what a hardening programme would need to address. It does not mean that anything is wrong with the instance.

The full baseline HTML report and ARF results are written under /var/lib/sac/data/openscap/reports/.

Confirm the scanner and its version

Check the installed scanner and the SCAP specifications it supports:

oscap --version

List the available compliance profiles

The image ships the upstream SCAP Security Guide content with the full set of profiles for this operating system. List every profile you can scan against:

oscap info --profiles /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

The list includes the CIS Level 1 and Level 2 benchmarks for both server and workstation, and the DISA STIG profile. The appliance audits against xccdf_org.ssgproject.content_profile_cis_level1_server by default, which is the right choice for a general-purpose server.

Run an on-demand scan

Run a compliance evaluation on demand against any shipped profile. The commands below evaluate the CIS Level 1 Server profile, write a timestamped HTML report and ARF results into a temporary directory, print the pass and fail counts, and then clean up.

On an unhardened image, oscap exits with code 2 when one or more rules do not pass. This is the correct and expected outcome, so the commands tolerate it and inspect the results file instead:

DS=/usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
WORK=$(mktemp -d) sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results "$WORK/results.xml" \
  --report "$WORK/report.html" \
  "$DS" > "$WORK/eval.log" 2>&1 || true
PASS=$(grep -c '<result>pass</result>' "$WORK/results.xml" 2>/dev/null || echo 0)
NONCONFORMANT=$(grep -c '<result>fail</result>' "$WORK/results.xml" 2>/dev/null || echo 0)
echo "rule results: pass=$PASS nonconformant=$NONCONFORMANT" ls -l "$WORK/report.html" "$WORK/results.xml"
sudo rm -rf "$WORK" echo "on-demand scan complete"

To keep a report, point --report and --results at a durable path such as /var/lib/sac/data/openscap/reports/. Then download the HTML file with scp and review it in a browser.

Schedule drift detection

The image ships a systemd timer that re-runs your chosen profile on a schedule and keeps the most recent dated reports, so you can track how the instance's compliance posture drifts over time. Inspect the timer:

systemctl list-timers openscap-scan.timer --no-pager

The scheduled scan is audit only and never applies a fix. To change the profile it evaluates or how many reports it retains, edit the scan configuration. No restart is required, because the next run picks up the change:

sudo nano /etc/sac/openscap-scan.conf

The configuration sets SCAN_PROFILE, SCAN_ENABLED (set to no to make the scheduled scan a no-op without touching systemd), and SCAN_KEEP_REPORTS. Reports are written to /var/lib/sac/data/openscap/reports/.

Scan remote hosts over SSH

With oscap-ssh and your own SSH key, one appliance can evaluate other Linux hosts over the network from this instance. All remote scanning is outbound, and nothing listens on this instance.

Replace the target user, host and port with your own. The target must have the openscap-scanner package and a matching datastream available, or you can push the local content. The command below connects to a host you provide, so it is not run automatically:

oscap-ssh <remote-user>@<remote-host> 22 \
  xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --report /tmp/remote-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

Generate remediation for review

When a scan reports failures, OpenSCAP can generate remediation scoped to your own results. Remediation is destructive. CIS Level 2 and STIG hardening can disable services, tighten the SSH daemon and lock an instance down, so always review remediation before you apply it. This image never applies a fix automatically.

Generate a remediation script from a results file for review (not run automatically):

sudo oscap xccdf generate fix \
  --fix-type bash \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --output /tmp/remediation.sh \
  /var/lib/sac/data/openscap/reports/openscap-baseline-<timestamp>.xml

The upstream remediation scripts and Ansible playbooks for every shipped profile are installed for reference under /usr/share/sac/openscap/remediation/ (non-executable by design). Review any remediation carefully, test it on a non-production instance and apply it deliberately.

Upgrade the SCAP Security Guide content

The SCAP policy content is a version-pinned upstream release. A newer SCAP Security Guide release adds and updates rules. The content is declarative XML policy rather than executable code, so upgrading it is a choice about how current your compliance baseline is, not a security patch.

To move to a newer release:

Download the prebuilt content archive from the ComplianceAsCode project.
Verify the archive against its published checksum.
Replace the datastream at /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml.
Update the recorded checksum manifest at /usr/share/sac/openscap/datastream.sha256, so that the fail-closed preflight accepts the new content.

The following commands show the procedure (not run automatically):

VER=<new-version> cd /var/tmp curl -fLO https://github.com/ComplianceAsCode/content/releases/download/v${VER}/scap-security-guide-${VER}.tar.gz curl -fLO https://github.com/ComplianceAsCode/content/releases/download/v${VER}/scap-security-guide-${VER}.tar.gz.sha512 sha512sum -c scap-security-guide-${VER}.tar.gz.sha512 tar -xzf scap-security-guide-${VER}.tar.gz scap-security-guide-${VER}/ssg-ubuntu2404-ds.xml
sudo install -m 0644 scap-security-guide-${VER}/ssg-ubuntu2404-ds.xml /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
sudo sha256sum /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml | awk '{print $1}' | sudo tee /usr/share/sac/openscap/datastream.sha256

Patching and Updates

The OpenSCAP scanner is installed from the Ubuntu archive. The operating system's standard unattended-upgrades keep it current, so the only executable attack surface on the appliance receives security updates automatically.

You manage the SCAP content with the upgrade procedure above. The appliance itself introduces no listening network service.

Support

SecureAnyCloud provides 24/7 technical support for this product by email at sales@secureanycloud.com and by live chat. Support covers profile selection, scheduled scanning, scanning remote hosts, reviewing generated remediation, and upgrading the SCAP Security Guide content.

OpenSCAP and the SCAP Security Guide are projects of Red Hat, Inc. and their contributors. Their names are used here nominatively to identify the software this image packages. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by Red Hat, Inc. or the ComplianceAsCode project. CIS and DISA STIG are the marks of the Center for Internet Security and the US Defense Information Systems Agency respectively. The profiles on this image are the ComplianceAsCode community implementations of those benchmarks, and a passing scan is not a certification of compliance.

Deploy on AWS

Launch OpenSCAP on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS