OpenSCAP: Add exception management in the GUI (including tailor file for the scan)
Additional STATUS: Exception
Additional Column: Exception Reason/Validation (editable) => Rule ID can be used as autotailor input (see https://github.com/PatchMon/PatchMon/issues/582)cat ssg-debian13-ds-tailoring.xml
<?xml version="1.0" encoding="UTF-8"?>
<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
<xccdf:benchmark href="/tmp/scap-workbench-wuLUYs/ssg-debian13-ds.xml"/>
<xccdf:version time="2026-02-25T14:50:33">1</xccdf:version>
<xccdf:Profile id="xccdf_org.ssgproject.content_profile_standard_customized" extends="xccdf_org.ssgproject.content_profile_standard">
<xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Standard System Security Profile for Debian 13 [CUSTOMIZED]</xccdf:title>
<xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">This profile contains rules to ensure standard security baseline
of a Debian 13 system. Regardless of your system's workload
all of these checks should pass.</xccdf:description>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false"/>
</xccdf:Profile>
</xccdf:Tailoring><img width="1598" height="467" alt="Image" src="https://github.com/user-attachments/assets/aa6a4838-b62d-418d-95de-6b61c686569d" />
<img width="1505" height="304" alt="Image" src="https://github.com/user-attachments/assets/a9c00d77-1843-4ffa-a5c3-656dda930013" />
<img width="548" height="338" alt="Image" src="https://github.com/user-attachments/assets/5de9a812-8b8f-4190-be68-d4293fdb44cf" />
Last activity and Compliance Profiles in Use: level1_server => Bullshit ...
15 Comments
·26 days agoAlso, I'm a bit concerned no that duration number. Shouldn't take 1076 minutes 🙁
·26 days agoI had another person mention that ALma compliance scans didn't want to work. I need to properly test in the lab as well. 🙂
Another idea, is perhaps compressing the report data.
For me it was sending a stream of video/audio/stream data through the websocket.
So when you sent stuff, it needs to be sent in parts, but it depends on the framework you use.
I hit the limit, as a websocket frame is something like 65535 bytes.
Yah, thing is that I've been coding on a streaming platform that also uses websockets (well, WebRTC for peer2peer connectivity).
·26 days agoHey. Thanks for this. That's an interesting one indeed.
There is a post body max size configuration that can be changed in the environment settings. We can try increasing that size and going from there
It's being tested on a qemu test vm with alma linux, but the scan seems to be a issue.
There is also a bug/problem when sending the report @user
Seems the body size when it needs to sent the report is too big, or so I read.
Since it uses websocket, the data probably needs to be cut up ?
·6 months agoThe OpenSCAP Original integration PR was submitted by a member of the commuity, but I refactored and reshaped teh dashboard and improved the compatibiltiy and installation steps myself. Some was hand coded and some was assisted by Ai with 3 developers hands in the mix of it.
Saying that, code does go through Linting, formatting, security, npm scanning of vulns, tests and other bits to make sure that it's not giong to error out when the frontend or backend artefacts are built 🙂
curious if you vibe coded this or did it all by hand?
·6 months agoIt makes sense. there does need to be more customisabliity when it comes to what rules are silenced etc.
Thanks for the usecase and I'll work towrds it 🙂
Yah, I was wondering about that too.
I have a 64core homelab 2U server at home, since I need to get also some training done on Kubernetes (although I'm still more a fan of Docker Swarm).
I use it also to test Patchmon, which runs on my Synology NAS 😉