Mastering OpenSCAP on Fedora: Vulnerability Scanning and PCI-DSS/STIG Security Auditing

When the security audit deadline knocks at 2 AM

Have you ever stayed up all night reviewing hundreds of lines of SSH configuration just because of an urgent PCI-DSS report request? Doing it manually is not only exhausting but also extremely error-prone. With a freshly deployed Fedora server cluster, manually checking every file permission or kernel parameter is an impossible mission if you want to get to bed early.

After using Fedora as my primary OS for two years, I’ve realized its true power lies in its built-in security ecosystem. Among those tools, OpenSCAP is the ultimate assistant. It’s not just a standard vulnerability scanner; it’s a framework that helps you automate system checks against strict standards like STIG, PCI-DSS, or HIPAA with just a few commands.

OpenSCAP: Standardizing and Replacing Manual Scripts

Instead of every SysAdmin writing their own Bash script to check /etc/passwd, the security world uses the SCAP (Security Content Automation Protocol) standard. OpenSCAP implements this standard, ensuring every security report speaks the same professional language and format.

This ecosystem consists of two core parts:

• oscap: The command-line tool that executes scans and evaluations.
• SCAP Security Guide (SSG): A repository containing hundreds of standardized “checklists” for each operating system.

The best part? OpenSCAP doesn’t just point out your errors. It also generates Bash scripts or Ansible playbooks to help you patch the system in an instant.

Practical Implementation on Fedora

1. Installation in a Flash

Installing on Fedora is incredibly fast via DNF. You just need to install the scanner and the accompanying security data:

sudo dnf install openscap-scanner scap-security-guide -y

To ensure everything is ready, check the Datastream file specific to Fedora:

ls /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

2. Choosing the Right Profile for Your Needs

A personal workstation doesn’t need security as tight as a server holding banking data. To see the list of available standards (profiles), run the command:

oscap info /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

You’ll see options like standard, pci-dss, or ospp. Choose the one that matches your project requirements. Here, I’ll use standard for demonstration.

3. Running the Scan and Generating Professional Reports

Instead of reading dry results on the terminal, we’ll export them to an HTML file to easily present to managers or partners.

sudo oscap xccdf eval \
--profile standard \
--results scan-results.xml \
--report report.html \
/usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

In the command above, the --results parameter saves raw data for machine reading, while --report creates a visual web interface. This process usually takes 1 to 3 minutes depending on the number of rules selected.

4. Interpreting the Results

Open the report.html file in your browser:

firefox report.html

The report clearly categorizes items as: Pass, Fail, or Other. Common issues on Fedora typically include: root password complexity not being high enough, legacy services like rsh not being disabled, or log file permissions being too loose. Every “Fail” item comes with extremely detailed remediation instructions.

Automating Remediation

Don’t panic if the list of errors is long. OpenSCAP can write the code to fix them for you. This is the feature that saves me 90% of my server configuration time.

To generate a Bash script to fix all errors based on scan results:

oscap xccdf generate remediation --fix-type bash \
--output fix-my-server.sh scan-results.xml

Warning: Never run this script directly on a production environment. Read the fix-my-server.sh file carefully first. Sometimes tightening SSH configurations can lock you out of the server if you haven’t prepared a backup key.

If you manage dozens of servers with Ansible, export a Playbook instead:

oscap xccdf generate remediation --fix-type ansible \
--output fix-my-server.yml scan-results.xml

Software Vulnerability Scanning (CVE Scanning)

Besides configuration checks, OpenSCAP can also scan for software vulnerabilities (CVEs) in packages. Fedora updates OVAL data constantly to identify the latest vulnerabilities.

# Quick scan for known software vulnerabilities
oscap oval eval --report vulnerability-report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

In practice, I usually combine OpenSCAP with dnf update every week. This ensures critical vulnerabilities are detected and patched as early as possible.

Lessons from the Field

After many last-minute rushes to prepare for audits, I’ve learned 3 valuable lessons:

1. Don’t obsess over a 100% Pass rate: Some STIG rules are so strict they might break your application. Be ready to justify why you chose to “Accept Risk” for those items.
2. Try SCAP Workbench: If you’re not a fan of the command line, install sudo dnf install scap-workbench. Its GUI makes selecting profiles and scanning very intuitive.
3. Integrate into CI/CD: If you build Fedora-based container images, run OpenSCAP directly in the pipeline. This ensures every image you ship is free of basic configuration flaws.

System security is a marathon, not a sprint. OpenSCAP won’t make you 100% secure, but it provides a clear roadmap so you don’t get lost in the jungle of security standards. Sleep well, and stop worrying about the next audit!