OpenSCAP – Fedora Linux 41 (Workstation Edition) – Standard System Security Profile for Fedora

Project Discussion
1

Hello Fedora community.

I would like to ask you some questions regarding the Standard System Security Profile for Fedora hardening settings through OpenSCAP.

Based on the information given, it seems that the current configuration settings are not applicable for Fedora 41. In this regard, when could we reasonably expect the hardening settings for Fedora 41?

Regarding the above-mentioned standard security baseline of a Fedora system, would it be possible to share more information, how strict are those hardening rules? Fedora is the main OS on my computer and I use it mainly for science-related programming (JupyterLabs, Pycharm, Octave, Rstudio, VSCodium), by working with TeXstudio, Zettlr, Zotero as well as running some virtual machines (mainly Windows 10 and 11 through GNOME Boxes and Virtual Machine Manager). Would it be reasonable to expect any issues if I implement the OpenSCAP Fedora hardening settings? Many thanks! Cheers!

2

You would need to find out from the openscap people who maintains that information. Is it a Fedora dev or a openscap dev?

3

Hi @viktorkat , thanks for the question.

There are indeed some OpenSCAP profiles for Fedora, but most of them are not so often updated. It would be amazing to have more contributors for Fedora profiles in GitHub - ComplianceAsCode/content: Security automation content in SCAP, Bash, Ansible, and other formats

This is the repository where we maintain the profiles available in scap-security-guide package, which are ultimately consumed by OpenSCAP.

But I also have good news. Since Fedora 42 there a new tool to make the compliance activities a lot easier and simpler in Fedora: complyctl

You can check more details in this article: Introducing complyctl for Effortless Compliance in Fedora - Fedora Magazine

We can still use the OpenSCAP profiles through complyctl + complyctl-openscap-plugin. This simplifies the user experience with a technology agnostic user interface while allowing to transparently use a combination of the best underlying technologies as soon as more plugins are available.

With complyctl you can also easily customize your Assessment Plan if any default rule in a framework can impact your development environment. I would recommend you to give a try and also join us to collaborate in these projects.

Cheers

6

@marcusburghardt please read my post in the other topic you promoted your article in: Relevant CIS benchmark for Fedora 41 Workstation? - #6