OpenSCAP is an open source implementation of the Security Content Automation Protocol (SCAP) — the U.S. standard maintained by the National Institute of Standards and Technology (NIST) for expressing security checklists, configuration baselines and vulnerability data in machine-readable form. It is both a C library (libopenscap) and a command-line scanner called oscap, and it is the engine under most of the compliance tooling used on Linux today: the same library powers the SCAP Workbench desktop application, the OpenSCAP Daemon, and the SCAPTimony result store. The project earned SCAP 1.2 certification from NIST in 2014, supports SCAP 1.2, and remains backward compatible with SCAP 1.1 and 1.0. Because it consumes standard SCAP content rather than a vendor-specific format, a single scanner can evaluate DISA STIGs, NIST’s USGCB, Red Hat’s security content and the community SCAP Security Guide without changes. It is written in C, packaged by every major distribution, and since version 1.3.0 also builds for Microsoft Windows.

Key Features

• One scanner, four SCAP specifications — the oscap tool is organised as modules that map directly onto the standard: xccdf (checklists, benchmarks and profiles), oval (vulnerability and configuration assessment definitions), ds (SCAP data streams that bundle content together) and cpe (platform naming). A fifth, info, inspects any SCAP file and reports its type, specification version and creation dates.
• NIST-recognised capability set — the project states that OpenSCAP provides the capabilities of both an Authenticated Configuration Scanner and an Authenticated Vulnerability Scanner as defined by NIST, which is what makes its output usable in formal audit and certification processes rather than only for informal spot checks.
• Evaluation and remediation — oscap xccdf eval evaluates a system against a chosen profile and can apply the fixes as it goes, while oscap oval eval checks the host against OVAL definitions for known vulnerabilities. Both walk through the content rule by rule and report a result for each.
• Reports built for auditors — results are produced as ARF (Asset Reporting Format) XML for machine consumption and as a self-contained HTML report with per-rule pass/fail detail. The HTML report is the artefact most reviewers actually read, and the ARF file is what downstream tooling ingests.
• Tailoring without forking content — profiles can be adapted with an XCCDF tailoring file, so an organisation can deselect rules it cannot yet meet or tighten others while keeping the upstream baseline intact and still tracking it for updates.
• A real content ecosystem — the companion SCAP Security Guide supplies community-maintained hardening profiles (CIS, STIG, PCI-DSS and more), and oscap will equally consume benchmarks produced by any other SCAP-conformant source.
• A family of front ends — SCAP Workbench is a Qt desktop GUI for tailoring and running scans; OpenSCAP Daemon performs continuous scheduled evaluation; SCAPTimony centralises scan results for larger fleets and integrates with Red Hat Satellite; the oscap-anaconda-addon enforces a profile during installation; and the official openscap container image scans containers for both vulnerabilities and compliance issues.
• Embeddable library — libopenscap exposes the whole parsing and evaluation stack to new tools, which is why third-party compliance products build on it instead of re-implementing SCAP themselves.
• Packaged everywhere — dnf install openscap-scanner on Fedora, yum install openscap-scanner on RHEL and CentOS, or the equivalent Debian and Ubuntu packages, with SCAP Workbench and content packages equally standard.

Why Use OpenSCAP?

Compliance work usually fails in one of two ways: the policy lives in a document nobody executes, or the check is a hand-run script that slowly drifts away from that document. OpenSCAP removes both problems by making the policy itself executable. A SCAP checklist is data, so the same baseline can be evaluated on a laptop, a fleet of servers and a container image, and the results are comparable because they all come from one certified engine. Because it implements a NIST standard rather than a proprietary format it also avoids lock-in — content written for one SCAP tool works with oscap — and the audit trail it produces (ARF plus an HTML report) is already in a shape regulators and auditors accept. For anyone who has to demonstrate that a machine genuinely matches a hardening guide, it is the reference implementation on Linux.

Use Cases

• Audit one host against a baseline — run oscap xccdf eval --profile PROFILE --results results.xml --report report.html and hand the HTML report to whoever asked the question.
• Hardening before deployment — use the Anaconda add-on to refuse an installation that does not match the target profile, so systems are compliant from first boot instead of after a remediation project.
• Vulnerability assessment — oscap oval eval against vendor OVAL definitions finds unpatched packages on systems that are not covered by a central patch tool.
• Continuous compliance — OpenSCAP Daemon or a scheduled job re-evaluates hosts on a timetable, turning compliance from a yearly exercise into ongoing monitoring.
• Container and image scanning — evaluate container images for both configuration drift and known vulnerabilities with the official OpenSCAP image.
• Authoring and tailoring content — SCAP Workbench lets a security team adapt an upstream profile and export a tailoring file without editing the original benchmark.

Platform

Linux — Red Hat Enterprise Linux, Fedora, CentOS, Debian, Ubuntu, openSUSE and SUSE — with Microsoft Windows builds since version 1.3.0. Written in C and packaged by the major distributions; SCAP Workbench is the desktop-side graphical companion.

Licence

GNU Lesser General Public License v2.1 (LGPL-2.1) — free and open source.

Website

open-scap.org