Vulnerability scans

Once a day the agent lists the Red Hat security advisories (RHSA) the installed packages still need, with their severity, CVEs and fixed packages.

Turn scans on

The scans are off by default. Turn them on in /etc/drra/drra.ini:

[scan]
enabled=1

# systemctl reload drra
# drra scan                 # or run one now

An OpenSCAP scan can use about 800 MB of memory for a few minutes: keep that in mind on small cloud servers, or use source=dnf there.

Sources

source	Used for	How
`auto` (default)	Every host	OpenSCAP on RHEL 8 and 9; the CSAF/VEX index on RHEL 10 when the agent sends to a report server over https; dnf updateinfo otherwise
`oval`	Any release	Always OpenSCAP: `oscap oval eval` against `oval_feed_url`
`csaf`	RHEL 10 (8 and 9 too)	The report server's CSAF/VEX index, plus dnf errata newer than the VEX files
`dnf`	Any release	`dnf updateinfo`: the repositories' security errata, plus EPEL

RHEL 8 and 9: OpenSCAP

The agent runs oscap oval eval (package openscap-scanner) against Red Hat's OVAL feed for the release, for example security.access.redhat.com/data/oval/v2/RHEL9/rhel-9.oval.xml.bz2. The feed is downloaded only when it changes. The OpenSCAP HTML report goes to the server with the next report, and DRSM links it from the Vulnerabilities page.

RHEL 10: CSAF/VEX

Red Hat publishes no OVAL feed for RHEL 10, only CSAF/VEX files: one JSON file per CVE, about 400 MB in all. Rather than every host downloading them, vex_sync.php on the report server builds a small index (about 2 MB) of the RHEL 10 packages each CVE is fixed in, and of the packages Red Hat lists as affected with no fix yet (see Set up the report server). Agents download the index from vex_index.php when it changes and compare it with their packages using rpm's version rules. Red Hat's VEX files can lag the errata by a day or more, so the agent adds the dnf errata that are newer.

CVEs with no fix

CSAF/VEX scans also count the CVEs that affect an installed package and have no update yet, which dnf updateinfo cannot do. RHEL lists thousands of moderate and low CVEs (most of them kernel) as affected while they are reviewed, so the agent counts them all by severity and lists only those at or above unfixed_list_severity (Important). DRSM warns about unfixed CVEs at or above UNFIXED_WARN_SEVERITY (Critical).

Compliance scans

Set compliance_profile to run a SCAP Security Guide profile (package scap-security-guide) with each scan, for example cis_server_l1, stig or pci-dss. The report gets the score and the failed rules, and the HTML report goes to the server. List the profiles with:

$ oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

A compliance scan can also be run by hand and sent as a hook upload, so a host does not run it every day.

Hosts with no internet

source=oval with oval_feed_url set to a local file uses a feed you copy to the host. csaf_index_url can point at a local copy of the CSAF/VEX index too.

The Vulnerabilities page

DRSM's Vulnerabilities page shows every host's advisory counts by severity, the advisories that affect the most hosts, and per host its advisories, fixed packages, CVEs, unfixed CVEs and compliance results. The linux/vulnerabilities plugin raises an error for a critical advisory and a warning for an important one, an unfixed critical CVE, a scan older than 3 days, a failed scan or a low compliance score.