{"action":"created","comment":{"url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments/44017641","id":44017641,"diff_hunk":"@@ -0,0 +1,220 @@\n+---\n+layout: plugin\n+title: Foreman OpenSCAP manual\n+images: /plugins/foreman_openscap/0.5\n+version: 0.4.1\n+---\n+\n+# 1. {{ page.title }}\n+\n+This plugin enables Foreman to receive automated vulnerability assessment and security compliance audits from Foreman hosts.\n+You can upload SCAP compliance contents, create compliance policies out of them and assign the policies to hosts or hostgroups.\n+foreman_openscap plugin provides three default SCAP contents, so you could start testing security compliance on RHEL6/7 and Fedora.\n+\n+OpenSCAP reports (aka ARF reports) will help you find vulnerabilities on your hosts and also suggest remediation plan to fix those vulnerabilities.\n+![OpenScap report]({{page.images}}/report_info_details.png)\n+\n+Foreman OpenSCAP plugin is made of 5 components:\n+\n+* [foreman_openscap](https://github.com/theforeman/foreman_openscap) - Foreman plugin which creates and persists SCAP content, compliance policy and ARF report objects.\n+* [smart_proxy_openscap](https://github.com/theforeman/smart_proxy_openscap) - Smart-Proxy plugin which validates SCAP content from Foreman, distributes SCAP content to clients and posts ARF reports from client hosts to Foreman\n+* [foreman_scap_client](https://github.com/theforeman/foreman_scap_client) - A client script which runs OpenSCAP scan and uploads the scan report to the Smart-Proxy\n+* [puppet-foreman_scap_client](https://github.com/theforeman/puppet-foreman_scap_client) - A puppet module which configures foreman_scap_client\n+\n+## 1.1 OpenSCAP basic concepts\n+\n+There are three basic concepts (entities) in OpenSCAP plug-in: SCAP Contents, Compliance Policies and ARF Reports.\n+\n+__SCAP Content__ represents SCAP DataStream XML file as defined by SCAP 1.2 standard. DataStream file contains implementation of compliance,\n+configuration or security baselines. Users are advised to acquire examplary baseline by installing scap-security-guide package.\n+DataStream file usualy contains multiple XCCDF Profiles. Each for different security target. The content of DataStream file can be inspected by oscap tool from openscap-scanner package.\n+(XCCDF = Extensible Configuration Checklist Description Format, XCCDF profile = A checklist which audit specific security target)\n+\n+__Compliance Policy__ is high level concept of a baseline applied to the infrastructure. Compliance policy is defined by user on web interface. Users may assign following information to the policy:\n+\n+* SCAP Content\n+* XCCDF Profile from particular SCAP Content\n+* Hostgroups that should comply with the policy\n+* Schedule - the period in which the audit shall occur\n+\n+__ARF Report__ is XML output of single scan occurrence per single host. Asset Reporting File format is defined by SCAP 1.2 standard. Foreman plug-in stores the ARF Reports in database for later inspections.\n+\n+\n+## 1.2 Release notes\n+foreman_openscap has two versions: 0.4.x for 1.8+, 0.5.x for 1.11+\n+\n+Both versions' functionality is the same, the changes only affect to the way it communicates with Foreman and Smart-Proxy APIs\n+\n+<table class=\"table table-bordered table-condensed\">\n+  <tr>\n+    <th>Foreman version</th>\n+    <th>Plugin version</th>\n+    <th>Proxy version</th>\n+    <th>Client version</th>\n+  </tr>\n+  <tr>\n+    <td>= 1.7</td>\n+    <td>0.3.4</td>\n+    <td>0.3.1</td>\n+    <td>0.1.1</td>\n+  </tr>\n+  <tr>\n+    <td>>= 1.8</td>\n+    <td>0.4.1</td>\n+    <td>0.4.0</td>\n+    <td>0.1.1</td>\n+  </tr>\n+  <tr>\n+    <td>>= 1.11</td>\n+    <td>0.5.0</td>\n+    <td>0.5.0</td>\n+    <td>0.1.2</td>\n+  </tr>\n+</table>\n+\n+# 2. Installation\n+\n+There are a few components to install:\n+\n+Foreman OpenSCAP (foreman_openscap), Smart Proxy OpenSCAP (smart_proxy_openscap), foreman_scap_client and puppet-foreman_scap_client.\n+\n+### 2.1 Installing foreman_openscap\n+\n+On the Foreman server:\n+\n+\t> yum install ruby193-rubygem-foreman_openscap\n+\t> service httpd reload\n+\n+Please refer the Foreman plugin [manual](http://theforeman.org/manuals/latest/index.html#6.1InstallaPlugin) for more information about installing Foreman plugins.\n+\n+### 2.2 Installing smart_proxy_openscap\n+\n+On the Smart-Proxy server:\n+\n+\n+    > yum install rubygem-smart_proxy_openscap\n+\n+Edit ```openscap.yml``` with the appropriate settings\n+\n+    ---\n+    :enabled: true\n+    :reportsdir: /path/to/saved/arf_reports/\n+    :spooldir: /path/to/arf_reports/which/failed/to/post/to/foreman\n+\n+\n+### 2.3 Installing puppet-foreman_scap_client\n+\n+    puppet module install isimluk-foreman_scap_client\n+\n+This puppet module will automatically install foreman_scap_client (if not installed) and will configure the client's ```/etc/foreman_scap_client/config.yaml``` with parameters which are needed for the operation of foreman_scap_client.\n+foreman_scap_client to run scans and upload results to the Smart Proxy.\n+\n+# 4. Usage\n+\n+This chapter covers features that you can use in terms of Foreman and OpenSCAP\n+integration. Everything described below assumes you've sucessfully installed\n+foreman_openscap, smart_proxy_openscap and puppet-foreman_scap_client is available on your puppetmaster and Foreman.\n+\n+*__Please note:__ smart_proxy_openscap is __required__ for the norman operation of foreman_openscap*\n+\n+You would usually start with uploading SCAP contents, then create policies of those SCAP contents and assign the policy to hosts or hostgroups.\n+The puppet module will install ```foreman_scap_client``` and configure it with the needed policy information. The puppet module also adds a cron line,\n+which runs the scap client at the schedule select when creating the policy.","path":"plugins/foreman_openscap/0.5/index.md","position":122,"original_position":122,"commit_id":"9cae2fa821fab4cdcb8535d1ad3bec0d37eaf475","original_commit_id":"9cae2fa821fab4cdcb8535d1ad3bec0d37eaf475","user":{"login":"dLobatog","id":598891,"avatar_url":"https://avatars.githubusercontent.com/u/598891?v=3","gravatar_id":"","url":"https://api.github.com/users/dLobatog","html_url":"https://github.com/dLobatog","followers_url":"https://api.github.com/users/dLobatog/followers","following_url":"https://api.github.com/users/dLobatog/following{/other_user}","gists_url":"https://api.github.com/users/dLobatog/gists{/gist_id}","starred_url":"https://api.github.com/users/dLobatog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dLobatog/subscriptions","organizations_url":"https://api.github.com/users/dLobatog/orgs","repos_url":"https://api.github.com/users/dLobatog/repos","events_url":"https://api.github.com/users/dLobatog/events{/privacy}","received_events_url":"https://api.github.com/users/dLobatog/received_events","type":"User","site_admin":false},"body":"SCAP, uppercase","created_at":"2015-11-05T14:37:25Z","updated_at":"2015-11-05T14:37:25Z","html_url":"https://github.com/theforeman/theforeman.org/pull/462#discussion_r44017641","pull_request_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462","_links":{"self":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments/44017641"},"html":{"href":"https://github.com/theforeman/theforeman.org/pull/462#discussion_r44017641"},"pull_request":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462"}}},"pull_request":{"url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462","id":48765359,"html_url":"https://github.com/theforeman/theforeman.org/pull/462","diff_url":"https://github.com/theforeman/theforeman.org/pull/462.diff","patch_url":"https://github.com/theforeman/theforeman.org/pull/462.patch","issue_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/462","number":462,"state":"open","locked":false,"title":"[review only] Openscap 0.5","user":{"login":"shlomizadok","id":433583,"avatar_url":"https://avatars.githubusercontent.com/u/433583?v=3","gravatar_id":"","url":"https://api.github.com/users/shlomizadok","html_url":"https://github.com/shlomizadok","followers_url":"https://api.github.com/users/shlomizadok/followers","following_url":"https://api.github.com/users/shlomizadok/following{/other_user}","gists_url":"https://api.github.com/users/shlomizadok/gists{/gist_id}","starred_url":"https://api.github.com/users/shlomizadok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlomizadok/subscriptions","organizations_url":"https://api.github.com/users/shlomizadok/orgs","repos_url":"https://api.github.com/users/shlomizadok/repos","events_url":"https://api.github.com/users/shlomizadok/events{/privacy}","received_events_url":"https://api.github.com/users/shlomizadok/received_events","type":"User","site_admin":false},"body":"Please do not merge yet - pending https://github.com/theforeman/foreman/pull/2750 and https://github.com/theforeman/foreman_openscap/pull/135 \r\n\r\n@ares - would love if you could review.","created_at":"2015-10-26T16:48:57Z","updated_at":"2015-11-05T14:37:25Z","closed_at":null,"merged_at":null,"merge_commit_sha":"08a72318d39c1e2d2ef6ce2cc4816d85d79fe6b4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462/commits","review_comments_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462/comments","review_comment_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments{/number}","comments_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/462/comments","statuses_url":"https://api.github.com/repos/theforeman/theforeman.org/statuses/9cae2fa821fab4cdcb8535d1ad3bec0d37eaf475","head":{"label":"shlomizadok:openscap_0.5","ref":"openscap_0.5","sha":"9cae2fa821fab4cdcb8535d1ad3bec0d37eaf475","user":{"login":"shlomizadok","id":433583,"avatar_url":"https://avatars.githubusercontent.com/u/433583?v=3","gravatar_id":"","url":"https://api.github.com/users/shlomizadok","html_url":"https://github.com/shlomizadok","followers_url":"https://api.github.com/users/shlomizadok/followers","following_url":"https://api.github.com/users/shlomizadok/following{/other_user}","gists_url":"https://api.github.com/users/shlomizadok/gists{/gist_id}","starred_url":"https://api.github.com/users/shlomizadok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlomizadok/subscriptions","organizations_url":"https://api.github.com/users/shlomizadok/orgs","repos_url":"https://api.github.com/users/shlomizadok/repos","events_url":"https://api.github.com/users/shlomizadok/events{/privacy}","received_events_url":"https://api.github.com/users/shlomizadok/received_events","type":"User","site_admin":false},"repo":{"id":23576782,"name":"theforeman.org","full_name":"shlomizadok/theforeman.org","owner":{"login":"shlomizadok","id":433583,"avatar_url":"https://avatars.githubusercontent.com/u/433583?v=3","gravatar_id":"","url":"https://api.github.com/users/shlomizadok","html_url":"https://github.com/shlomizadok","followers_url":"https://api.github.com/users/shlomizadok/followers","following_url":"https://api.github.com/users/shlomizadok/following{/other_user}","gists_url":"https://api.github.com/users/shlomizadok/gists{/gist_id}","starred_url":"https://api.github.com/users/shlomizadok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlomizadok/subscriptions","organizations_url":"https://api.github.com/users/shlomizadok/orgs","repos_url":"https://api.github.com/users/shlomizadok/repos","events_url":"https://api.github.com/users/shlomizadok/events{/privacy}","received_events_url":"https://api.github.com/users/shlomizadok/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/shlomizadok/theforeman.org","description":"The new and improved Foreman website.","fork":true,"url":"https://api.github.com/repos/shlomizadok/theforeman.org","forks_url":"https://api.github.com/repos/shlomizadok/theforeman.org/forks","keys_url":"https://api.github.com/repos/shlomizadok/theforeman.org/keys{/key_id}","collaborators_url":"https://api.github.com/repos/shlomizadok/theforeman.org/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/shlomizadok/theforeman.org/teams","hooks_url":"https://api.github.com/repos/shlomizadok/theforeman.org/hooks","issue_events_url":"https://api.github.com/repos/shlomizadok/theforeman.org/issues/events{/number}","events_url":"https://api.github.com/repos/shlomizadok/theforeman.org/events","assignees_url":"https://api.github.com/repos/shlomizadok/theforeman.org/assignees{/user}","branches_url":"https://api.github.com/repos/shlomizadok/theforeman.org/branches{/branch}","tags_url":"https://api.github.com/repos/shlomizadok/theforeman.org/tags","blobs_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/refs{/sha}","trees_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/trees{/sha}","statuses_url":"https://api.github.com/repos/shlomizadok/theforeman.org/statuses/{sha}","languages_url":"https://api.github.com/repos/shlomizadok/theforeman.org/languages","stargazers_url":"https://api.github.com/repos/shlomizadok/theforeman.org/stargazers","contributors_url":"https://api.github.com/repos/shlomizadok/theforeman.org/contributors","subscribers_url":"https://api.github.com/repos/shlomizadok/theforeman.org/subscribers","subscription_url":"https://api.github.com/repos/shlomizadok/theforeman.org/subscription","commits_url":"https://api.github.com/repos/shlomizadok/theforeman.org/commits{/sha}","git_commits_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/commits{/sha}","comments_url":"https://api.github.com/repos/shlomizadok/theforeman.org/comments{/number}","issue_comment_url":"https://api.github.com/repos/shlomizadok/theforeman.org/issues/comments{/number}","contents_url":"https://api.github.com/repos/shlomizadok/theforeman.org/contents/{+path}","compare_url":"https://api.github.com/repos/shlomizadok/theforeman.org/compare/{base}...{head}","merges_url":"https://api.github.com/repos/shlomizadok/theforeman.org/merges","archive_url":"https://api.github.com/repos/shlomizadok/theforeman.org/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/shlomizadok/theforeman.org/downloads","issues_url":"https://api.github.com/repos/shlomizadok/theforeman.org/issues{/number}","pulls_url":"https://api.github.com/repos/shlomizadok/theforeman.org/pulls{/number}","milestones_url":"https://api.github.com/repos/shlomizadok/theforeman.org/milestones{/number}","notifications_url":"https://api.github.com/repos/shlomizadok/theforeman.org/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/shlomizadok/theforeman.org/labels{/name}","releases_url":"https://api.github.com/repos/shlomizadok/theforeman.org/releases{/id}","created_at":"2014-09-02T11:53:34Z","updated_at":"2015-05-12T10:02:27Z","pushed_at":"2015-10-26T16:46:19Z","git_url":"git://github.com/shlomizadok/theforeman.org.git","ssh_url":"git@github.com:shlomizadok/theforeman.org.git","clone_url":"https://github.com/shlomizadok/theforeman.org.git","svn_url":"https://github.com/shlomizadok/theforeman.org","homepage":null,"size":20326,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"gh-pages"}},"base":{"label":"theforeman:gh-pages","ref":"gh-pages","sha":"3dece9450e937d474ed275148295cb639682415c","user":{"login":"theforeman","id":1439844,"avatar_url":"https://avatars.githubusercontent.com/u/1439844?v=3","gravatar_id":"","url":"https://api.github.com/users/theforeman","html_url":"https://github.com/theforeman","followers_url":"https://api.github.com/users/theforeman/followers","following_url":"https://api.github.com/users/theforeman/following{/other_user}","gists_url":"https://api.github.com/users/theforeman/gists{/gist_id}","starred_url":"https://api.github.com/users/theforeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theforeman/subscriptions","organizations_url":"https://api.github.com/users/theforeman/orgs","repos_url":"https://api.github.com/users/theforeman/repos","events_url":"https://api.github.com/users/theforeman/events{/privacy}","received_events_url":"https://api.github.com/users/theforeman/received_events","type":"Organization","site_admin":false},"repo":{"id":5928690,"name":"theforeman.org","full_name":"theforeman/theforeman.org","owner":{"login":"theforeman","id":1439844,"avatar_url":"https://avatars.githubusercontent.com/u/1439844?v=3","gravatar_id":"","url":"https://api.github.com/users/theforeman","html_url":"https://github.com/theforeman","followers_url":"https://api.github.com/users/theforeman/followers","following_url":"https://api.github.com/users/theforeman/following{/other_user}","gists_url":"https://api.github.com/users/theforeman/gists{/gist_id}","starred_url":"https://api.github.com/users/theforeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theforeman/subscriptions","organizations_url":"https://api.github.com/users/theforeman/orgs","repos_url":"https://api.github.com/users/theforeman/repos","events_url":"https://api.github.com/users/theforeman/events{/privacy}","received_events_url":"https://api.github.com/users/theforeman/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/theforeman/theforeman.org","description":"The new and improved Foreman website.","fork":false,"url":"https://api.github.com/repos/theforeman/theforeman.org","forks_url":"https://api.github.com/repos/theforeman/theforeman.org/forks","keys_url":"https://api.github.com/repos/theforeman/theforeman.org/keys{/key_id}","collaborators_url":"https://api.github.com/repos/theforeman/theforeman.org/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/theforeman/theforeman.org/teams","hooks_url":"https://api.github.com/repos/theforeman/theforeman.org/hooks","issue_events_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/events{/number}","events_url":"https://api.github.com/repos/theforeman/theforeman.org/events","assignees_url":"https://api.github.com/repos/theforeman/theforeman.org/assignees{/user}","branches_url":"https://api.github.com/repos/theforeman/theforeman.org/branches{/branch}","tags_url":"https://api.github.com/repos/theforeman/theforeman.org/tags","blobs_url":"https://api.github.com/repos/theforeman/theforeman.org/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/theforeman/theforeman.org/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/theforeman/theforeman.org/git/refs{/sha}","trees_url":"https://api.github.com/repos/theforeman/theforeman.org/git/trees{/sha}","statuses_url":"https://api.github.com/repos/theforeman/theforeman.org/statuses/{sha}","languages_url":"https://api.github.com/repos/theforeman/theforeman.org/languages","stargazers_url":"https://api.github.com/repos/theforeman/theforeman.org/stargazers","contributors_url":"https://api.github.com/repos/theforeman/theforeman.org/contributors","subscribers_url":"https://api.github.com/repos/theforeman/theforeman.org/subscribers","subscription_url":"https://api.github.com/repos/theforeman/theforeman.org/subscription","commits_url":"https://api.github.com/repos/theforeman/theforeman.org/commits{/sha}","git_commits_url":"https://api.github.com/repos/theforeman/theforeman.org/git/commits{/sha}","comments_url":"https://api.github.com/repos/theforeman/theforeman.org/comments{/number}","issue_comment_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/comments{/number}","contents_url":"https://api.github.com/repos/theforeman/theforeman.org/contents/{+path}","compare_url":"https://api.github.com/repos/theforeman/theforeman.org/compare/{base}...{head}","merges_url":"https://api.github.com/repos/theforeman/theforeman.org/merges","archive_url":"https://api.github.com/repos/theforeman/theforeman.org/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/theforeman/theforeman.org/downloads","issues_url":"https://api.github.com/repos/theforeman/theforeman.org/issues{/number}","pulls_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls{/number}","milestones_url":"https://api.github.com/repos/theforeman/theforeman.org/milestones{/number}","notifications_url":"https://api.github.com/repos/theforeman/theforeman.org/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/theforeman/theforeman.org/labels{/name}","releases_url":"https://api.github.com/repos/theforeman/theforeman.org/releases{/id}","created_at":"2012-09-24T02:36:57Z","updated_at":"2015-10-20T21:11:34Z","pushed_at":"2015-11-05T14:21:12Z","git_url":"git://github.com/theforeman/theforeman.org.git","ssh_url":"git@github.com:theforeman/theforeman.org.git","clone_url":"https://github.com/theforeman/theforeman.org.git","svn_url":"https://github.com/theforeman/theforeman.org","homepage":null,"size":26467,"stargazers_count":39,"watchers_count":39,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":114,"mirror_url":null,"open_issues_count":25,"forks":114,"open_issues":25,"watchers":39,"default_branch":"gh-pages"}},"_links":{"self":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462"},"html":{"href":"https://github.com/theforeman/theforeman.org/pull/462"},"issue":{"href":"https://api.github.com/repos/theforeman/theforeman.org/issues/462"},"comments":{"href":"https://api.github.com/repos/theforeman/theforeman.org/issues/462/comments"},"review_comments":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462/comments"},"review_comment":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/462/commits"},"statuses":{"href":"https://api.github.com/repos/theforeman/theforeman.org/statuses/9cae2fa821fab4cdcb8535d1ad3bec0d37eaf475"}}}}