Scanning a Linux host against a baseline with OpenSCAP

Goal

Evaluate a Linux host against a published security profile with OpenSCAP and produce a report that shows exactly which checks pass, fail, or do not apply.

Prerequisites

Root privileges (a non-root scan cannot read many of the files and settings the rules check); on RHEL-family systems the openscap-scanner package provides oscap and scap-security-guide provides the content, giving a data-stream file such as /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml (ssg-rhel8-ds.xml, ssg-rhel10-ds.xml for other releases; list the directory rather than guessing the name). Other distributions package the content under different names, or not at all. The project was originally named SCAP Security Guide (SSG) and ships one data-stream file per supported product.

Steps

1. List the profiles available in a data-stream file: oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml. Each profile has an ID such as xccdf_org.ssgproject.content_profile_cis; which profiles exist (CIS levels, STIG, OSPP and so on) depends on the content version, so copy the ID from this output.
2. Run an evaluation against a chosen profile, writing both a machine-readable results file and an HTML report: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --results-arf arf.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml. The oscap manual documents this exact xccdf eval --profile PROFILE_ID ... --report REPORT_FILE form. In scripts, note that oscap exits with 2 when the scan completed but at least one rule failed, and with 1 on an actual error; do not treat every non-zero exit as a broken scan.
3. Open report.html (or copy it off the host) and read the pass/fail/notapplicable counts per rule before changing anything.
4. A remediation script can be generated from the results with oscap xccdf generate fix --fix-type bash --output fix.sh --result-id <id> arf.xml (or --fix-type ansible); read every command in it — it is a starting point, not a script to pipe straight into a shell. Avoid oscap xccdf eval --remediate on production hosts: it applies every fix in the profile during the scan.
5. Apply only the remediations reviewed and accepted, then re-run the same oscap xccdf eval command to confirm the specific rules now pass.
6. Keep the dated arf.xml/report.html pair as the audit record for that host and that profile version.

Expected result

A report listing every rule in the chosen profile with a pass/fail/notapplicable/error status, reproducible by re-running the same command against the same data-stream file.

Limits and test basis

oscap reports the state of a system against a profile's checks; it does not itself guarantee the checks are appropriate for a given workload — review before remediating (see the CIS/STIG baseline article). Nothing here is undone by a single command: back up any configuration file oscap or its remediation touches before running it, the same as for any other manual edit. No reboot is required to run a scan; a remediation step may require one depending on what it changes.