Lab: CIS self-audit on a host

This lab runs an OpenSCAP CIS self-audit on a host, reads the report, and produces a remediation plan. By the end you will have the discipline for ongoing CIS compliance.

Objective

By the end of this lab, you can:

Install and run OpenSCAP with the CIS Benchmark.
Read the scan report.
Prioritise remediations.
Apply selected fixes and re-scan.

Architecture

Any Linux host with:

OpenSCAP installed.
A SCAP content file (the CIS Benchmark for your distribution).
sudo access.

Tasks

Task 1: Install OpenSCAP

# Debian/Ubuntu
sudo apt install openscap-scanner openscap-security-guide ssg-base

# RHEL/Rocky/Alma
sudo dnf install openscap-scanner scap-security-guide

Task 2: Find the SCAP content

# Debian/Ubuntu
ls /usr/share/xml/scap/content/

# RHEL family
ls /usr/share/xml/scap/content/

The file name follows <distribution>-<version>-ds.xml.

Task 3: Run the scan

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results scan-results.xml \
  --report scan-report.html \
  /usr/share/xml/scap/content/ssg-ubuntu2204-ds.xml

The HTML report shows every check, the result (PASS / FAIL / NOT APPLICABLE), and the description of the fix.

Task 4: Read the report

Open scan-report.html in a browser. Note:

Total checks
PASS count
FAIL count
NOT APPLICABLE count

Identify the failures with the highest impact:

Authentication: failures in PAM, password policy, account lockout.
SSH: failures in sshd_config.
Network: failures in sysctl, firewall.
Audit: failures in auditd configuration.

Task 5: Prioritise

For each failure, decide:

Critical (apply now): authentication, SSH, sudo, firewall.
High (apply this week): auditd, sysctl, mount options.
Medium (apply this month): banners, /etc/issue, documentation.
Low (apply when convenient): cosmetic recommendations.

PRIORITISED REMEDIATIONS
=======================
Critical (today):
- 5.2.x: SSH PermitRootLogin no
- 5.4.x: SSH PasswordAuthentication no
- 1.5.x: /tmp mount options

High (this week):
- 4.x.x: firewall configuration
- 3.x.x: sysctl hardening
- 6.x.x: auditd configuration

Medium (this month):
- 1.7.x: banner files

Low (when convenient):
- 1.8.x: GDM settings (not applicable to servers)

Task 6: Apply safe remediations

For each Critical item:

Read the recommendation.
Test in a non-production environment.
Apply to production via configuration management.

Example for SSH:

# Edit /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no

# Test
sudo sshd -t

# Reload
sudo systemctl reload sshd

Verify from a known-good source:

ssh user@host    # publickey works
ssh root@host    # should fail

Task 7: Re-scan

After applying remediations:

sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results scan-results-after.xml \
  --report scan-report-after.html \
  /usr/share/xml/scap/content/ssg-ubuntu2204-ds.xml

Compare PASS counts:

grep -E '^\s*[0-9]+\s+pass\b' scan-results.xml scan-results-after.xml

A successful remediation increases the PASS count.

Task 8: Document exceptions

For remediations that cannot be applied:

EXCEPTION: CIS 5.2.18 - SSH MaxAuthTries 3
Application: legacy-batch-automation requires MaxAuthTries 6
Approved by: Security Team
Date: 2026-08-09
Review: quarterly

The exception is documented, reviewed, and auditable.

Validation

OpenSCAP runs successfully.
The report is HTML and readable.
A remediation plan exists.
Critical remediations are applied.
A re-scan shows reduced failures.

Cleanup

Revert any test changes that broke applications:

sudo systemctl reload sshd    # if a bad config was applied

What you learned

OpenSCAP scans the host against the CIS Benchmark.
The HTML report shows every check with PASS / FAIL.
Remediation priorities depend on impact and exploitability.
Re-scanning verifies the fixes worked.

Objectives

Prerequisites