SCAP support in cockpit-project

Martin Preisler mpreisle at redhat.com
Wed Mar 5 11:49:10 UTC 2014


Hi,
I would like to follow up discussions from devconf.cz regarding SCAP cockpit integration.

For now I think we are better off starting with a very basic integration and building more on top in the future. There are talks about the future of SCAP results archival, diffing, etc. but right now we don't have anything ready to be used for this integration. Just scheduling a scan and getting a result file back is enough for this stage IMO.

The following form "fields" are needed to perform a single machine evaluation:

- Target machine
  - I assume this will be provided by the cockpit UI itself.

- Content file
  - By default scap-security-guide will be selected.
  - Allow option to upload any content in datastream form (a single file).

- Tailoring file
  - Optional - can be empty and ignored
  - Allow upload of a single xml file.
  - Can only be uploaded and processed after Content is uploaded.
  - Affects list of available profiles but can only add more profiles.

- Checklist
  - Which Benchmark from given datastream will be evaluated.
  - In most cases there is only one Benchmark.
  - Select the first checklist by default.

- Profile
  - There will be one or more profiles in any given benchmark.
  - Profile decides which rules are selected and which values are used for evaluation (password size, e.g.).
  - Select the first profile by default.

By default when the form loads it will be populated with usable values. Scan can be performed immediately without any manual changes.

After user submits the request to evaluation `oscap` will be run with parameters generated according to the form field values. Results can be collected as XCCDF results and displayed as HTML report (openscap provides tools to make HTML report from XCCDF result).

I don't think it makes sense to implement customization / tailoring in cockpit, as well as "Save as RPM" and several other features from scap-workbench. Users can tailor in a separate application and then just use the tailoring file.

Inspiration, prior work:
1) Spacewalk SCAP integration
   - http://isimluk.livejournal.com/1027.html
   - https://fedorahosted.org/spacewalk/wiki/Scap

2) scap-workbench
   - GUI application that allows people to scan local or remote machines.
   - install in Fedora : # yum install scap-workbench scap-security-guide
   - user manual: https://fedorahosted.org/scap-workbench/raw-attachment/wiki/UserManual/user_manual.html

My questions are:
1) Can cockpit schedule future actions? Does it have cron-like functionality?
2) Does cockpit have means to schedule "actions" on multiple machines at once? Or do we have to implement this specifically for the plugin to get the functionality?

Please let me know how to proceed. Should I make a graphical mockup of the GUI? I don't think I am the right person for that but I may try.

-- 
Martin Preisler


More information about the cockpit-devel mailing list