OpenSCAP: Implement Remote Scanning

Use oscap-ssh to scan remote systems over an SSH connection.

By using remote scanning you can audit systems that you don't have physical access to and that might not have a current version of the SCAP Security Guide or current OVAL definitions available.
The oscap-ssh is often used to scan several remote systems against a single locally stored and maintained OVAL definition file. The oscap-ssh command is provided in the openscap-utils package.

The remote system must have the openscap-scanner package installed, which provides the oscap command. This system must also be configured with a user account that you can connect with that has sudo privileges so you can run the scan correctly.

oscap-ssh uses SSH connection to copy the SCAP content to a remote machine, then it runs an evaluation of the target system and downloads the results back.

• oscap-ssh requires that you specify the hostname or IP address of the remote system to scan and the port number that SSH is listening on.
• oscap-ssh can evaluate source data streams and OVAL files.
• Usage of oscap-ssh mimics usage and options of oscap tool.
• Use the --sudo option to escalate user privileges before running the scan.

Dependencies [see 582, Steps a) - l) ]

Recommendation: Perform remote scans from the patchmon system (policy server)

a) Scan from the policy server by remote root user (not recommended):

oscap-ssh root@pve1.fritz.box 22 xccdf eval \
--profile xccdf_org.ssgproject.content_profile_standard_custom \
--tailoring-file /usr/share/xml/scap/ssg/custom_profile/content_profile_standard_custom.xml \
--results /usr/share/xml/scap/ssg/reports/report_xccdf_content_profile_standard_ssg-debian13-ds_custom.xml \
--results-arf /usr/share/xml/scap/ssg/reports/report_xccdf_content_profile_standard_ssg-debian13-ds_custom_arf.xml \
--report /usr/share/xml/scap/ssg/reports/report_xccdf_content_profile_standard_ssg-debian13-ds_custom.html \
--cpe /usr/share/xml/scap/ssg/content/ssg-debian13-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-debian13-ds.xml

b) Scan from the policy server by remote scapadm user (recommended):

oscap-ssh --sudo scapadm@pve1.fritz.box 22 xccdf eval \
--profile xccdf_org.ssgproject.content_profile_standard_custom \
--tailoring-file /usr/share/xml/scap/ssg/custom_profile/content_profile_standard_custom.xml \
--results /usr/share/xml/scap/ssg/reports/report_xccdf_content_profile_standard_ssg-debian13-ds_custom.xml \
--results-arf /usr/share/xml/scap/ssg/reports/report_xccdf_content_profile_standard_ssg-debian13-ds_custom_arf.xml \
--report /usr/share/xml/scap/ssg/reports/report_xccdf_content_profile_standard_ssg-debian13-ds_custom.html \
--cpe /usr/share/xml/scap/ssg/content/ssg-debian13-cpe-dictionary.xml \
/usr/share/xml/scap/ssg/content/ssg-debian13-ds.xml

c) Scanning from the policy server using the remote patchmon-agent, which mimics the functionality of the oscap-ssh bash script. (most convenient - recommended):

Big advantages:

• NO additional remote ssh access / UIDs required
• NO additional remote SUDO rights required
• NO remote ssg packages required
• Centralized managed custom profiles/policies (group or host based tailoring-file(s))
• Centralized managed custom remediation profiles/policies (group or host based remediation rule(s))

References:
https://wiki.debian.org/UsingSCAP
https://github.com/mpreisler/oscap-ssh/
https://oneuptime.com/blog/post/2026-01-15-run-openscap-compliance-scans-ubuntu/view
https://developers.redhat.com/articles/2024/02/08/how-visualize-your-openscap-compliance-reports
https://github.com/jritter/SCAPinoculars
https://go.dev/doc/install