aboutsummaryrefslogtreecommitdiffstats
path: root/testcases/SECTests/OpenSCAP.py
diff options
context:
space:
mode:
Diffstat (limited to 'testcases/SECTests/OpenSCAP.py')
-rw-r--r--testcases/SECTests/OpenSCAP.py219
1 files changed, 219 insertions, 0 deletions
diff --git a/testcases/SECTests/OpenSCAP.py b/testcases/SECTests/OpenSCAP.py
new file mode 100644
index 00000000..6f7510ac
--- /dev/null
+++ b/testcases/SECTests/OpenSCAP.py
@@ -0,0 +1,219 @@
+#!/usr/bin/python
+#
+# Copyright (c) 2016 Red Hat
+# Luke Hinds (lhinds@redhat.com)
+# This program and the accompanying materials
+# are made available under the terms of the Apache License, Version 2.0
+# which accompanies this distribution, and is available at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# 0.1: This script installs OpenSCAP on the remote host, and scans the
+# nominated node. Post scan a report is downloaded and if '--clean' is passed
+# all trace of the scan is removed from the remote system.
+
+import os
+import datetime
+import argparse
+
+__version__ = 0.1
+__author__ = 'Luke Hinds (lhinds@redhat.com)'
+__url__ = 'https://wiki.opnfv.org/display/functest/Functest+Security'
+
+'''
+Example Run:
+ python ./OpenSCAP.py --host 192.168.0.24 --port 22 --user root --password
+ p6ssw0rd oval --secpolicy
+ /usr/share/xml/scap/ssg/content/ssg-rhel7-oval.xml --report report.html
+ --results results.xml
+
+'''
+
+# Variables needed..
+pwd = os.getcwd()
+oscap = '/bin/oscap'
+currenttime = datetime.datetime.now().strftime('%Y-%m-%d_%H-%M-%S')
+
+# Set up the main parser
+parser = argparse.ArgumentParser(description='OpenSCAP Python Scanner')
+
+# Main args
+# Todo add required = True
+parser.add_argument('--user',
+ action='store',
+ dest='user',
+ help='user')
+parser.add_argument('--password',
+ action='store',
+ dest='password',
+ help='Password')
+parser.add_argument('--host',
+ action='store',
+ dest='host',
+ help='host',
+ required=True)
+parser.add_argument('--port',
+ action='store',
+ dest='port"',
+ help='port',
+ required=True)
+parser.add_argument('--dist',
+ action='store',
+ dest='dist',
+ help='Distribution')
+parser.add_argument('--clean',
+ action='store_true',
+ dest='clean',
+ help='Clean all files from host')
+
+# And the subparser
+subparsers = parser.add_subparsers(
+ title='subcommands',
+ description='valid subcommands',
+ help='additional help')
+
+
+parser_xccdf = subparsers.add_parser('xccdf')
+parser_xccdf.set_defaults(which='xccdf')
+
+parser_oval = subparsers.add_parser('oval')
+parser_oval.set_defaults(which='oval')
+
+parser_oval_collect = subparsers.add_parser('oval-collect')
+parser_oval_collect.set_defaults(which='oval-collect')
+
+parser_xccdf.add_argument(
+ '--profile',
+ action='store',
+ dest='profile',
+ help='xccdf profile')
+
+parser_oval.add_argument(
+ '--results',
+ action='store',
+ dest='results',
+ help='Report name (inc extension (.html)')
+
+parser_oval.add_argument(
+ '--report',
+ action='store',
+ dest='report',
+ help='Report name (inc extension (.html)')
+
+parser_oval.add_argument(
+ '--secpolicy',
+ action='store',
+ dest='secpolicy',
+ help='Security Policy')
+
+parserout = parser.parse_args()
+args = vars(parser.parse_args())
+
+
+def createfiles():
+ import connect
+ global tmpdir
+ localpath = os.getcwd() + '/scripts/createfiles.py'
+ remotepath = '/tmp/createfiles.py'
+ com = 'python /tmp/createfiles.py'
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ localpath,
+ remotepath,
+ com)
+ tmpdir = connect.remotescript()
+
+
+def install_pkg():
+ import connect
+ com = 'yum -y install openscap-scanner scap-security-guide'
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ com)
+ install_pkg = connect.remotecmd()
+ print install_pkg
+
+
+def run_scanner():
+ import connect
+
+ if args['which'] == 'xccdf':
+ print 'xccdf'
+ com = '{0} xccdf eval'.format(oscap)
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ com)
+ elif args['which'] == 'oval':
+ com = '{0} oval eval --results {1}/{2} --report {1}/{3} {4}'.format(oscap,
+ tmpdir.rstrip(),
+ parserout.results,
+ parserout.report,
+ parserout.secpolicy)
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ com)
+ run_tool = connect.remotecmd()
+ else:
+ com = '{0} oval-collect '.format(oscap)
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ com)
+ run_tool = connect.remotecmd()
+
+
+def post_tasks():
+ import connect
+ dl_folder = os.path.join(os.getcwd(), parserout.host + datetime.datetime.now().strftime('%Y-%m-%d_%H-%M-%S'))
+ os.mkdir(dl_folder, 0755)
+ reportfile = '{0}/{1}'.format(tmpdir.rstrip(), parserout.report)
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ dl_folder,
+ reportfile,
+ parserout.report,
+ parserout.results)
+ run_tool = connect.download_reports()
+
+
+def removepkg():
+ import connect
+ com = 'yum -y remove openscap-scanner scap-security-guide'
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ com)
+ yumremove = connect.remotecmd()
+ print yumremove
+
+
+def cleandir():
+ import connect
+ com = 'rm -r {0}'.format(tmpdir.rstrip())
+ connect = connect.connectionManager(parserout.host,
+ parserout.user,
+ parserout.password,
+ com)
+ deldir = connect.remotecmd()
+
+
+if __name__ == '__main__':
+ print 'Creating temp file structure...\n'
+ createfiles()
+ print 'Install OpenSCAP scanner...\n'
+ install_pkg()
+ print 'Running scan...\n'
+ run_scanner()
+ print 'Post installation tasks...\n'
+ post_tasks()
+ if parserout.clean:
+ print 'Cleaning down environment...\n'
+ print 'Removing OpenSCAP...\n'
+ removepkg()
+ print 'Deleting tmp file and reports (remote)...\n'
+ cleandir()