OpenSCAP

OpenSCAP checks each host against a compliance benchmark, such as a CIS Benchmark or a DISA STIG, using the SCAP Security Guide (SSG) content. Results can be exported as a STIG Viewer checklist that is ready to upload to eMASS.

Supports: NIST 800-53 CM-6 (Configuration Settings), CA-2 (Control Assessments), and CA-7 (Continuous Monitoring).

Choosing a profile

The default profile is CIS Level 1 Server (cis_server_l1). To use a different benchmark, set profile in the scan’s options or schedule, for example:

{"profile": "stig"}

Common profiles include cis_server_l1, cis_workstation_l1, cis_workstation_l2, stig, pci-dss, anssi_bp28_high, ospp, and cui. Availability depends on the host’s operating system.

Reef selects the SSG content that matches the host’s distribution and version. If there is no exact match, Reef uses the closest related content and notes this on the checklist. Every rule’s title, rationale, fix text, and references (CIS, NIST 800-53, CCI, and CCE) come directly from the content that was evaluated.

If the requested profile isn’t available for the host, or nothing could be evaluated, the scan is marked failed instead of reporting misleading results.

What you get

The scan summary shows the overall compliance percentage, the score, and the number of rules that passed, failed, need manual review, or don’t apply. Each failed rule becomes a finding, with severity taken from the benchmark and the fix text included for reference. Rules that couldn’t be evaluated also become findings, flagged for manual review.

Exporting a STIG checklist for eMASS

When an OpenSCAP scan finishes, its detail page includes a Download .cklb checklist button. The file opens in STIG Viewer 3 and can be uploaded to eMASS. Results are mapped as follows:

Rules outside the selected profile are left out of the checklist.

Install OpenSCAP on each host (recommended)

To produce accurate results, OpenSCAP needs to see the host’s real services, kernel modules, mounts, and packages. Reef uses the most accurate method available on each host:

1. Host install (recommended). If openscap and the SSG content are installed on the host, Reef uses them. This option is the most accurate and the easiest to maintain.
2. Bundled. If OpenSCAP isn’t installed, Reef temporarily runs its own bundled copy directly on the host. This method is equally accurate but requires a reasonably modern host (Fedora 36+, RHEL 9+, Ubuntu 22.04+, or Debian 12+).
3. Limited. On older hosts, Reef falls back to checking files only. In this mode, results for services, kernel modules, and mounts can’t be trusted, so the checklist marks those rules Not Reviewed rather than Not Applicable. The scan tells you how many rules this affected.

Installing OpenSCAP on the host avoids these compatibility limits. It also keeps the benchmark content current through your normal package updates, and it lets you run oscap yourself for spot checks. Once it’s installed, Reef switches to it automatically.

Fedora / RHEL / CentOS / Rocky / AlmaLinux

sudo dnf install -y openscap-scanner scap-security-guide

Debian

sudo apt update
sudo apt install -y libopenscap8 ssg-debderived ssg-debian ssg-applications

Ubuntu

sudo apt update
sudo apt install -y libopenscap8 ssg-debderived ssg-nondebian ssg-applications

Package names vary by release. If one isn’t found, run apt search ssg- on the host to see what’s available.

openSUSE / SLES

sudo zypper install -y openscap openscap-utils scap-security-guide

Arch Linux

sudo pacman -S openscap scap-security-guide

Confirm the install and that the content is available:

oscap -V
ls /usr/share/xml/scap/ssg/content/

Options

OpenSCAP scans can take a long time on large hosts. Reef allows up to six hours before a scan times out.