OpenSCAP Configuration for Linux Compliance: Audit, Remediation, CI/CD
When the requirement to "meet CIS Level 2" comes in, manually checking each server can take weeks. OpenSCAP solves this: one run produces a formal HTML/XML report with pass/fail for each rule, accepted by auditors as evidence. Over 5 years and 50+ compliance audits, we've learned to turn auditor reports into working processes.
OpenSCAP is an open-source framework for automated verification of Linux systems against security standards. It uses the SCAP Security Guide (SSG), a collection of profiles with thousands of rules. Without such a tool, compliance audits become a grind: engineers manually check dozens of settings, miss up to 30% of errors, and spend days compiling a single report.
We configure OpenSCAP for your stack: formal CIS, DISA STIG, and PCI DSS profiles, automatic remediation via Ansible, and CI/CD integration. The result is an automated gate that blocks non-compliant code or images.
How OpenSCAP Automates Compliance
OpenSCAP handles all the tedious work. After the first run, you get an HTML report sorted by category (criticality levels, pass percentage). The system generates remediation recommendations, down to ready-made Ansible playbooks. This slashes the time to check a single server from 2–3 hours to 2–5 minutes.
Time savings: With 50 servers in your infrastructure, manual checking takes about 2 hours each. OpenSCAP finishes in 2–3 minutes. At a DevOps engineer's hourly rate of ~$80–$100, you save over $4,000–$5,000 per audit cycle. And such checks are usually required quarterly.
Problems We Solve
Manual verification of 500+ rules. The CIS Benchmark for RHEL 9 contains over 500 rules. People miss 10–15% — that's a fact. OpenSCAP checks everything automatically.
Scattered reports. Without a unified tool, compliance status is spread across wikis, spreadsheets, and screenshots. OpenSCAP gives a single report in HTML and XML.
Non-idempotent remediation. Manual fix of violations leads to drift. OpenSCAP generates Ansible playbooks that can be reapplied.
Example tailoring file
<!-- custom-tailoring.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<Tailoring xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_custom_tailoring_001">
<Profile id="xccdf_custom_cis_tailored" extends="xccdf_org.ssgproject.content_profile_cis_server_l1">
<title>CIS L1 tailored for app servers</title>
<select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" selected="false"/>
<set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive">6</set-value>
</Profile>
</Tailoring>How We Do It: Stack and Configuration
We use current versions: OpenSCAP 1.3+, SCAP Security Guide 0.1.66+ (ComplianceAsCode), Ansible Core 2.15+. Example typical profile for RHEL 9:
yum install openscap-scanner scap-security-guide
oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml | grep "Profile"Info is up to date for SCAP Security Guide version 0.1.66+.
What We Deliver
| Component | Description |
|---|---|
| SCAP scanner | Installation and configuration of OpenSCAP on target servers |
| Tailoring file | Custom profile for your architecture with justification of exceptions |
| Ansible remediation playbook | Automatic fix of violations |
| CI/CD integration | Gates in Jenkins/GitLab CI/GitHub Actions |
| Documentation | Runbook, process description, audit evidence |
What Tailoring Profiles Gives You
A tailoring file lets you turn off irrelevant rules (e.g., NFS if absent) and adjust parameters (SSH timeout). Version it in Git — the auditor sees each item with justification. Without tailoring, you waste time analyzing rules that don't apply to your environment.
Benefits of OpenSCAP Over Manual Checks
OpenSCAP is 20+ times faster: a single server check takes 2–5 minutes instead of 2–3 hours. The formal report eliminates human error — each rule has an ID, description, and fix recommendation.
Step-by-Step: Setting Up OpenSCAP in 5 Steps
- Install packages:
yum install openscap-scanner scap-security-guide - Select a profile:
oscap info ... | grep Profileand choose the one you need (e.g., cis_server_l2) - Run a scan:
oscap xccdf eval --profile ... --results results.xml --report report.html - Generate remediation:
oscap xccdf generate fix --fix-type ansible ... > playbook.yml - Apply the playbook and re-check:
ansible-playbook playbook.yml; oscap xccdf eval ...
Running a Scan and Generating a Report
oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis_server_l2 \
--results /tmp/scan-results.xml \
--report /tmp/scan-report.html \
--oval-results \
/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xmlHow Remediation Works
OpenSCAP generates an Ansible playbook for automatic fixes. Tested on 50+ projects: pass rate jumps from 55% to 80–85%. Remaining failed rules are either structural (disk partitioning) or knowingly excluded.
oscap xccdf generate fix \
--profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
--fix-type ansible \
/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml \
> cis-remediation-playbook.yml
ansible-playbook -i test-server, cis-remediation-playbook.ymlTailoring: Customization for Your Environment
Repeating the tailoring example, but in the context of full customization. The tailoring file is versioned in Git, allowing the auditor to see each exception with justification.
<!-- custom-tailoring.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<Tailoring xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_custom_tailoring_001">
<Profile id="xccdf_custom_cis_tailored" extends="xccdf_org.ssgproject.content_profile_cis_server_l1">
<title>CIS L1 tailored for app servers</title>
<select idref="xccdf_org.ssgproject.content_rule_mount_option_nodev_nonroot_local_partitions" selected="false"/>
<set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive">6</set-value>
</Profile>
</Tailoring>CI/CD Integration: Checking Docker Images and AMIs
docker export $(docker create myapp:latest) > myapp-rootfs.tar
mkdir myapp-rootfs && tar -C myapp-rootfs -xf myapp-rootfs.tar
oscap-chroot myapp-rootfs xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
--report /tmp/container-report.html \
/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xmlTimelines and Cost
| Stage | Timeline |
|---|---|
| Audit and OpenSCAP installation, baseline report | 1–3 days |
| Tailoring + Ansible remediation | 3–5 days |
| CI/CD integration + automated reports | 1–2 weeks |
Cost is calculated individually after assessing your infrastructure. Savings from automation: One manual audit cycle of 50 servers costs ~$3,000–$5,000 in labor, and OpenSCAP setup pays for itself within 1–3 such cycles.
Contact us for a consultation: we will assess your project and propose the optimal configuration. SCAP Security Guide