{"action":"created","comment":{"url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments/31171048","id":31171048,"diff_hunk":"@@ -0,0 +1,187 @@\n+---\n+layout: plugin\n+title: Foreman OpenSCAP Manual\n+images: /plugins/foreman_openscap/0.4\n+version: 0.4.1\n+---\n+\n+# 1. {{ page.title }}\n+\n+This plugin enables Foreman to receive automated vulnerability assessment and security complinace audits from Foreman hosts.\n+You can upload SCAP compliance contents, create compliance policies out of them and assign the policies to hosts or hostgroups.\n+foreman_openscap plugin provides three default SCAP contents, so you could start testing security compliance on RHEL6/7 and Fedora.\n+\n+OpenSCAP reports (aka arf reports) will help you find vulnerabilities on your hosts and also suggest remediation plan to fix those vulnerabilities.\n+![OpenScap report]({{page.images}}/report_info_details.png)\n+\n+Foreman OpenSCAP plugin is made of 5 components:\n+\n+* Scaptimony - Rails engine which creates and persists SCAP content, Compliance policy and ARF report objects\n+* foreman_openscap - UI to display Scaptimony engine (which actually connects to OpenSCAP)\n+* smart_proxy_openscap - Smart-Proxy plugin which distributes SCAP content to hosts and post ARF reports from client hosts to Foreman\n+* foreman_scap_client - A client script which runs OpenSCAP scan and uploads the scan report to the Smart-Proxy\n+* puppet-foreman_scap_client - A puppet module which configures foreman_scap_client\n+\n+## 1.1 OpenSCAP Basic Concepts\n+\n+There are three basic concepts (entities) in OpenSCAP plug-in: SCAP Contents, Compliance Policies and ARF Reports.\n+\n+__SCAP Content__ represents SCAP DataStream XML file as defined by SCAP 1.2 standard. Datastream file contains implementation of compliance, configuration or security baselines. Users are advised to acquire examplary baseline by installing scap-security-guide package. DataStream file usualy contains multiple XCCDF Profiles. Each for different security target. The content of Datastream file can be inspected by oscap tool from openscap-scanner package.\n+\n+__Compliance Policy__ is highlevel concept of a baseline applied to the infrastructure. Compliance Policy is defined by user on web interface. User may assign following information to the Policy:\n+\n+* SCAP Content\n+* XCCDF Profile from particular SCAP Content\n+* Hostgroups that should comply with the policy\n+* Schedule - the period in which the audit shall occur\n+\n+__ARF Report__ is XML output of single scan occurance per single host. Asset Reporting File format is defined by SCAP 1.2 standard. Foreman plug-in stores the ARF Reports in database for later inspections.\n+\n+\n+## 1.2 Release Notes\n+OpenSCAP has two versions: 0.3.4 for Foreman 1.7 and 0.4.x for 1.8+.\n+\n+Both versions' functionality is the same. The changes reflect the changes in communicating with Foreman API and Smart-Proxy.\n+\n+<table class=\"table table-bordered table-condensed\">\n+  <tr>\n+    <th>Foreman version</th>\n+    <th>Plugin version</th>\n+    <th>Proxy version</th>\n+    <th>Client version</th>\n+  </tr>\n+  <tr>\n+    <td>= 1.7</td>\n+    <td>0.3.4</td>\n+    <td>0.3.1</td>\n+    <td>0.1.1</td>\n+  </tr>\n+  <tr>\n+    <td>>= 1.8</td>\n+    <td>0.4.1</td>\n+    <td>0.4.0</td>\n+    <td>0.1.1</td>\n+  </tr>\n+</table>\n+\n+# 2. Installation\n+\n+There are a few components to install: \n+\n+Foreman OpenSCAP plugin, Foreman Proxy OpenSCAP plugin (aka Smart Proxy OpenSCAP), foreman_scap_client and puppet-foreman_scap_client.\n+\n+### 2.1 Installing foreman_openscap\n+\n+Please refer to Foreman install plugin [manual](http://theforeman.org/manuals/1.8/index.html#6.1InstallaPlugin) to install the plugin on Foreman.\n+\n+### 2.2 Installing smart_proxy_openscap\n+\n+On the Smart-Proxy server:\n+\n+    \n+    > gem install smart_proxy_openscap -v '<version>'\n+    > cp /path/to/gem/smart_proxy_openscap-<version>/settings.d/openscap.yml.example /path/to/foreman-proxy/settings.d/openscap.yml\n+    \n+Edit ```openscap.yml``` with the appropriate settings\n+\n+    ---\n+    :enabled: true\n+\n+\n+### 2.3 Installing puppet-foreman_scap_client\n+\n+    puppet module install isimluk-foreman_scap_client\n+    \n+Running puppet on the client host, will install also foreman_scap_client.\n+\n+\n+# 4. Usage \n+\n+This chapter covers features that you can use in terms of Foreman and OpenSCAP\n+integration. Everything described below assumes you've sucessfully installed \n+foreman_openscap, smart_proxy_openscap and puppet-foreman_scap_client is available on your puppetmaster and Foreman.\n+\n+You would usually start with uploading SCAP contents, then create policies of those SCAP contents and assign the policy to hosts or hostgroups.\n+The puppet module will install ```foreman_scap_client``` and configure it with the needed policy information. The puppet module also adds a cron line,\n+which runs the scap client at the schedule select when creating the policy.\n+\n+## 4.1 Creating SCAP content\n+\n+foreman_openscap comes with default scap content provided by [scap-security-guide](https://fedorahosted.org/scap-security-guide/).\n+\n+The default SCAP content is available for RHEL 6, RHEL 7 and Fedora.\n+\n+Besides the default SCAP content, you can also upload your own SCAP content.\n+\n+__Access SCAP contents__ Hosts -> Compliance -> SCAP Contents\n+\n+__Create SCAP Content__ - You can upload any valid OpenSCAP DataStream file\n+![New SCAP Content]({{page.images}}/create_new_scap_content.png)\n+\n+\n+## 4.2 Creating Policy wizard\n+\n+* First step is to name your policy. \n+* Second, choose which SCAP content & SCAP profile to apply, \n+* Then choose schedule when to run this policy, \n+* Select to which taxonomies this policy belongs to\n+* And finally to which hostgroup you wish apply this policy.\n+\n+![Policy Wizard]({{page.images}}/policy_wizard.gif)\n+## 4.3 Assigning Policy to host\n+\n+You can assign a policy in two ways:\n+\n+* By assigning a policy to hostgroup(s) when creating / editing a policy. All hosts which belong to that hostgroup will automatically be assigned to the policy.\n+* By assigning a policy to host(s) via hosts index: In the hosts index, choose the hosts you wish to assign a policy. Click on 'Select Action' and choose: \"Assign Compliance Policy\" and choose which policy to assign to the selected hosts.\n+\n+![Assign Hosts]({{page.images}}/assign_hosts.png)\n+\n+## 4.4 ARF Reports\n+You can access the generated reports via Hosts -> Compliance -> Reports\n+![ARF reports index]({{page.images}}/arf_index.png)\n+Clicking on \"View Report\" will lead you to the actual security audit report, with detailed information on the host's security check and suggested remediation.\n+![ARF report]({{page.images}}/arf_report.png) \n+\n+# 5. Advanced topics\n+\n+## 5.1 Distributing SCAP content with Foreman & Proxy\n+\n+__Content distribution:__","path":"plugins/foreman_openscap/0.4/index.md","position":150,"original_position":150,"commit_id":"14e878901c05ace6adfda4770cb0f62475671da8","original_commit_id":"14e878901c05ace6adfda4770cb0f62475671da8","user":{"login":"eLobato","id":598891,"avatar_url":"https://avatars.githubusercontent.com/u/598891?v=3","gravatar_id":"","url":"https://api.github.com/users/eLobato","html_url":"https://github.com/eLobato","followers_url":"https://api.github.com/users/eLobato/followers","following_url":"https://api.github.com/users/eLobato/following{/other_user}","gists_url":"https://api.github.com/users/eLobato/gists{/gist_id}","starred_url":"https://api.github.com/users/eLobato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eLobato/subscriptions","organizations_url":"https://api.github.com/users/eLobato/orgs","repos_url":"https://api.github.com/users/eLobato/repos","events_url":"https://api.github.com/users/eLobato/events{/privacy}","received_events_url":"https://api.github.com/users/eLobato/received_events","type":"User","site_admin":false},"body":"This subtitle effectively means the same as point 5.1?","created_at":"2015-05-27T19:29:33Z","updated_at":"2015-05-27T19:29:33Z","html_url":"https://github.com/theforeman/theforeman.org/pull/386#discussion_r31171048","pull_request_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386","_links":{"self":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments/31171048"},"html":{"href":"https://github.com/theforeman/theforeman.org/pull/386#discussion_r31171048"},"pull_request":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386"}}},"pull_request":{"url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386","id":36176197,"html_url":"https://github.com/theforeman/theforeman.org/pull/386","diff_url":"https://github.com/theforeman/theforeman.org/pull/386.diff","patch_url":"https://github.com/theforeman/theforeman.org/pull/386.patch","issue_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/386","number":386,"state":"open","locked":false,"title":"Openscap plugin manual","user":{"login":"shlomizadok","id":433583,"avatar_url":"https://avatars.githubusercontent.com/u/433583?v=3","gravatar_id":"","url":"https://api.github.com/users/shlomizadok","html_url":"https://github.com/shlomizadok","followers_url":"https://api.github.com/users/shlomizadok/followers","following_url":"https://api.github.com/users/shlomizadok/following{/other_user}","gists_url":"https://api.github.com/users/shlomizadok/gists{/gist_id}","starred_url":"https://api.github.com/users/shlomizadok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlomizadok/subscriptions","organizations_url":"https://api.github.com/users/shlomizadok/orgs","repos_url":"https://api.github.com/users/shlomizadok/repos","events_url":"https://api.github.com/users/shlomizadok/events{/privacy}","received_events_url":"https://api.github.com/users/shlomizadok/received_events","type":"User","site_admin":false},"body":"@ares can you review and fix my bed inglisch ? (before @eLobato / @domcleal.... ;) )","created_at":"2015-05-26T07:39:05Z","updated_at":"2015-05-27T19:29:33Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2f6fe66c7b3fdb6dbbd6a3f315c463b95929a331","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386/commits","review_comments_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386/comments","review_comment_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments{/number}","comments_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/386/comments","statuses_url":"https://api.github.com/repos/theforeman/theforeman.org/statuses/14e878901c05ace6adfda4770cb0f62475671da8","head":{"label":"shlomizadok:openscap_plugin","ref":"openscap_plugin","sha":"14e878901c05ace6adfda4770cb0f62475671da8","user":{"login":"shlomizadok","id":433583,"avatar_url":"https://avatars.githubusercontent.com/u/433583?v=3","gravatar_id":"","url":"https://api.github.com/users/shlomizadok","html_url":"https://github.com/shlomizadok","followers_url":"https://api.github.com/users/shlomizadok/followers","following_url":"https://api.github.com/users/shlomizadok/following{/other_user}","gists_url":"https://api.github.com/users/shlomizadok/gists{/gist_id}","starred_url":"https://api.github.com/users/shlomizadok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlomizadok/subscriptions","organizations_url":"https://api.github.com/users/shlomizadok/orgs","repos_url":"https://api.github.com/users/shlomizadok/repos","events_url":"https://api.github.com/users/shlomizadok/events{/privacy}","received_events_url":"https://api.github.com/users/shlomizadok/received_events","type":"User","site_admin":false},"repo":{"id":23576782,"name":"theforeman.org","full_name":"shlomizadok/theforeman.org","owner":{"login":"shlomizadok","id":433583,"avatar_url":"https://avatars.githubusercontent.com/u/433583?v=3","gravatar_id":"","url":"https://api.github.com/users/shlomizadok","html_url":"https://github.com/shlomizadok","followers_url":"https://api.github.com/users/shlomizadok/followers","following_url":"https://api.github.com/users/shlomizadok/following{/other_user}","gists_url":"https://api.github.com/users/shlomizadok/gists{/gist_id}","starred_url":"https://api.github.com/users/shlomizadok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shlomizadok/subscriptions","organizations_url":"https://api.github.com/users/shlomizadok/orgs","repos_url":"https://api.github.com/users/shlomizadok/repos","events_url":"https://api.github.com/users/shlomizadok/events{/privacy}","received_events_url":"https://api.github.com/users/shlomizadok/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/shlomizadok/theforeman.org","description":"The new and improved Foreman website.","fork":true,"url":"https://api.github.com/repos/shlomizadok/theforeman.org","forks_url":"https://api.github.com/repos/shlomizadok/theforeman.org/forks","keys_url":"https://api.github.com/repos/shlomizadok/theforeman.org/keys{/key_id}","collaborators_url":"https://api.github.com/repos/shlomizadok/theforeman.org/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/shlomizadok/theforeman.org/teams","hooks_url":"https://api.github.com/repos/shlomizadok/theforeman.org/hooks","issue_events_url":"https://api.github.com/repos/shlomizadok/theforeman.org/issues/events{/number}","events_url":"https://api.github.com/repos/shlomizadok/theforeman.org/events","assignees_url":"https://api.github.com/repos/shlomizadok/theforeman.org/assignees{/user}","branches_url":"https://api.github.com/repos/shlomizadok/theforeman.org/branches{/branch}","tags_url":"https://api.github.com/repos/shlomizadok/theforeman.org/tags","blobs_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/refs{/sha}","trees_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/trees{/sha}","statuses_url":"https://api.github.com/repos/shlomizadok/theforeman.org/statuses/{sha}","languages_url":"https://api.github.com/repos/shlomizadok/theforeman.org/languages","stargazers_url":"https://api.github.com/repos/shlomizadok/theforeman.org/stargazers","contributors_url":"https://api.github.com/repos/shlomizadok/theforeman.org/contributors","subscribers_url":"https://api.github.com/repos/shlomizadok/theforeman.org/subscribers","subscription_url":"https://api.github.com/repos/shlomizadok/theforeman.org/subscription","commits_url":"https://api.github.com/repos/shlomizadok/theforeman.org/commits{/sha}","git_commits_url":"https://api.github.com/repos/shlomizadok/theforeman.org/git/commits{/sha}","comments_url":"https://api.github.com/repos/shlomizadok/theforeman.org/comments{/number}","issue_comment_url":"https://api.github.com/repos/shlomizadok/theforeman.org/issues/comments{/number}","contents_url":"https://api.github.com/repos/shlomizadok/theforeman.org/contents/{+path}","compare_url":"https://api.github.com/repos/shlomizadok/theforeman.org/compare/{base}...{head}","merges_url":"https://api.github.com/repos/shlomizadok/theforeman.org/merges","archive_url":"https://api.github.com/repos/shlomizadok/theforeman.org/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/shlomizadok/theforeman.org/downloads","issues_url":"https://api.github.com/repos/shlomizadok/theforeman.org/issues{/number}","pulls_url":"https://api.github.com/repos/shlomizadok/theforeman.org/pulls{/number}","milestones_url":"https://api.github.com/repos/shlomizadok/theforeman.org/milestones{/number}","notifications_url":"https://api.github.com/repos/shlomizadok/theforeman.org/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/shlomizadok/theforeman.org/labels{/name}","releases_url":"https://api.github.com/repos/shlomizadok/theforeman.org/releases{/id}","created_at":"2014-09-02T11:53:34Z","updated_at":"2015-05-12T10:02:27Z","pushed_at":"2015-05-26T07:37:28Z","git_url":"git://github.com/shlomizadok/theforeman.org.git","ssh_url":"git@github.com:shlomizadok/theforeman.org.git","clone_url":"https://github.com/shlomizadok/theforeman.org.git","svn_url":"https://github.com/shlomizadok/theforeman.org","homepage":null,"size":17996,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"gh-pages"}},"base":{"label":"theforeman:gh-pages","ref":"gh-pages","sha":"aa094820f9c94eeedc18ebf15e87e90e255869bf","user":{"login":"theforeman","id":1439844,"avatar_url":"https://avatars.githubusercontent.com/u/1439844?v=3","gravatar_id":"","url":"https://api.github.com/users/theforeman","html_url":"https://github.com/theforeman","followers_url":"https://api.github.com/users/theforeman/followers","following_url":"https://api.github.com/users/theforeman/following{/other_user}","gists_url":"https://api.github.com/users/theforeman/gists{/gist_id}","starred_url":"https://api.github.com/users/theforeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theforeman/subscriptions","organizations_url":"https://api.github.com/users/theforeman/orgs","repos_url":"https://api.github.com/users/theforeman/repos","events_url":"https://api.github.com/users/theforeman/events{/privacy}","received_events_url":"https://api.github.com/users/theforeman/received_events","type":"Organization","site_admin":false},"repo":{"id":5928690,"name":"theforeman.org","full_name":"theforeman/theforeman.org","owner":{"login":"theforeman","id":1439844,"avatar_url":"https://avatars.githubusercontent.com/u/1439844?v=3","gravatar_id":"","url":"https://api.github.com/users/theforeman","html_url":"https://github.com/theforeman","followers_url":"https://api.github.com/users/theforeman/followers","following_url":"https://api.github.com/users/theforeman/following{/other_user}","gists_url":"https://api.github.com/users/theforeman/gists{/gist_id}","starred_url":"https://api.github.com/users/theforeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theforeman/subscriptions","organizations_url":"https://api.github.com/users/theforeman/orgs","repos_url":"https://api.github.com/users/theforeman/repos","events_url":"https://api.github.com/users/theforeman/events{/privacy}","received_events_url":"https://api.github.com/users/theforeman/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/theforeman/theforeman.org","description":"The new and improved Foreman website.","fork":false,"url":"https://api.github.com/repos/theforeman/theforeman.org","forks_url":"https://api.github.com/repos/theforeman/theforeman.org/forks","keys_url":"https://api.github.com/repos/theforeman/theforeman.org/keys{/key_id}","collaborators_url":"https://api.github.com/repos/theforeman/theforeman.org/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/theforeman/theforeman.org/teams","hooks_url":"https://api.github.com/repos/theforeman/theforeman.org/hooks","issue_events_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/events{/number}","events_url":"https://api.github.com/repos/theforeman/theforeman.org/events","assignees_url":"https://api.github.com/repos/theforeman/theforeman.org/assignees{/user}","branches_url":"https://api.github.com/repos/theforeman/theforeman.org/branches{/branch}","tags_url":"https://api.github.com/repos/theforeman/theforeman.org/tags","blobs_url":"https://api.github.com/repos/theforeman/theforeman.org/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/theforeman/theforeman.org/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/theforeman/theforeman.org/git/refs{/sha}","trees_url":"https://api.github.com/repos/theforeman/theforeman.org/git/trees{/sha}","statuses_url":"https://api.github.com/repos/theforeman/theforeman.org/statuses/{sha}","languages_url":"https://api.github.com/repos/theforeman/theforeman.org/languages","stargazers_url":"https://api.github.com/repos/theforeman/theforeman.org/stargazers","contributors_url":"https://api.github.com/repos/theforeman/theforeman.org/contributors","subscribers_url":"https://api.github.com/repos/theforeman/theforeman.org/subscribers","subscription_url":"https://api.github.com/repos/theforeman/theforeman.org/subscription","commits_url":"https://api.github.com/repos/theforeman/theforeman.org/commits{/sha}","git_commits_url":"https://api.github.com/repos/theforeman/theforeman.org/git/commits{/sha}","comments_url":"https://api.github.com/repos/theforeman/theforeman.org/comments{/number}","issue_comment_url":"https://api.github.com/repos/theforeman/theforeman.org/issues/comments{/number}","contents_url":"https://api.github.com/repos/theforeman/theforeman.org/contents/{+path}","compare_url":"https://api.github.com/repos/theforeman/theforeman.org/compare/{base}...{head}","merges_url":"https://api.github.com/repos/theforeman/theforeman.org/merges","archive_url":"https://api.github.com/repos/theforeman/theforeman.org/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/theforeman/theforeman.org/downloads","issues_url":"https://api.github.com/repos/theforeman/theforeman.org/issues{/number}","pulls_url":"https://api.github.com/repos/theforeman/theforeman.org/pulls{/number}","milestones_url":"https://api.github.com/repos/theforeman/theforeman.org/milestones{/number}","notifications_url":"https://api.github.com/repos/theforeman/theforeman.org/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/theforeman/theforeman.org/labels{/name}","releases_url":"https://api.github.com/repos/theforeman/theforeman.org/releases{/id}","created_at":"2012-09-24T02:36:57Z","updated_at":"2015-05-21T06:48:29Z","pushed_at":"2015-05-27T07:28:12Z","git_url":"git://github.com/theforeman/theforeman.org.git","ssh_url":"git@github.com:theforeman/theforeman.org.git","clone_url":"https://github.com/theforeman/theforeman.org.git","svn_url":"https://github.com/theforeman/theforeman.org","homepage":null,"size":22527,"stargazers_count":34,"watchers_count":34,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":103,"mirror_url":null,"open_issues_count":22,"forks":103,"open_issues":22,"watchers":34,"default_branch":"gh-pages"}},"_links":{"self":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386"},"html":{"href":"https://github.com/theforeman/theforeman.org/pull/386"},"issue":{"href":"https://api.github.com/repos/theforeman/theforeman.org/issues/386"},"comments":{"href":"https://api.github.com/repos/theforeman/theforeman.org/issues/386/comments"},"review_comments":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386/comments"},"review_comment":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/theforeman/theforeman.org/pulls/386/commits"},"statuses":{"href":"https://api.github.com/repos/theforeman/theforeman.org/statuses/14e878901c05ace6adfda4770cb0f62475671da8"}}}}