Walkthrough: Scanning containers for SCAP compliance

Right-click the Servers folder, and select New > Server Smart Group.

For Name, enter a name for the server smart group, such as Containerized Servers.

In the list of conditions, define a condition in the first row:

1. In the first column, select Server.
2. In the second column, select SERVER_CONTAINER_TYPE.
3. In the third column, select equals.
4. In the fourth column, set the property value to "RHEL Docker Container".
5. Click Apply Changes .

The full condition is now displayed as the following text:
Any Server Where ??SERVER_CONTAINER_TYPE?? equals "RHEL DOCKER Container"

Click Finish.

A new smart group collects all RHEL servers on which Docker containers exist.

Under the Depot folder, navigate to Container Compliance > RHEL Container Compliance > RHEL Container SCAP Policy. Right-click this custom software package, and select Open.
Note: In this walkthrough, we will be scanning containers that are based on a RHEL images. A separate folder and software package are available in the depot for containers that are based on a CentOS image.

In the content editor on the right, in the list of Support Files at the bottom, select the last parameter, __SCAP_DEFINITIONS, and then click Edit Parameter Entry .

In the Set File Parameters dialog box, in the File location field, click the Browse button and then select your SCAP 1.2 content file (an XML file) in the Select Param File Location dialog box.

Click OK in all dialog boxes.

Under the Jobs folder, navigate to Container Compliance > RHEL Container Compliance > RHEL Container Scan Job. Right-click the job and select Open.
Note: In this walkthrough, we will be scanning containers that are based on a RHEL images. A separate folder and job are available in the Jobs folder for containers that are based on a CentOS image.

In the content editor on the right, click the Targets tab. On this tab, click Add Servers . Then, in the Select Servers/Groups dialog box, select the Containerized Servers smart group that we prepared earlier.

Click the Parameters tab, and then set values for the following parameters. You can either keep the default values or enter a new value for any of these parameters in the Value column.

• CONCURRENT_SCANS — The maximum number of containers or images to scan concurrently (that is, in parallel).
• SCAN_TYPE — The type of scan to perform, that is, which type of objects to scan and analyze. Specify one of the following values: CONTAINER (the default), IMAGE, or BOTH. In this walkthrough, we will set this parameter to scan BOTH.
• TMP_LOCATION — A path to a temporary location in which the job will untar images. The default is /tmp.

Click the Schedules tab. On this tab, click New Schedule . Then, in the Scheduling box, schedule a one-time or recurring job run.
For this walkthrough, we are scheduling a one-time job run to execute immediately.

Save the job to apply all changes.

The Container Scan Job runs and analyzes SCAP compliance of the RHEL containers on the containerized target servers.

After the job completes running, navigate to Jobs > Container Compliance > RHEL Container Compliance > RHEL Container Scan Job. Right-click the job and select Show Results.

In the Job Results pane on the right, right-click a successful job run and select Show Log.

In the log (towards the top), find the log message that tells you where to find the web-based report for this job run on the file server. Make a note of this location. If you want, you can right-click the log message and select Copy to Clipboard.

On the host computer of the file server, navigate to the location specified in the log message. You can either open the report on that computer or copy the whole folder to your own desktop and open the report there. To display the report, open the Home file in your Internet Explorer or Firefox browser.

When browsing the report, you have the following options for navigating the report and drilling down into more specific details:

a. The home page lists the host computers that were scanned, and provides the numbers of containers (running, stopped, and paused) and images on each one. To drill down into the details of any specific host computer, click the host name.

b. When you drill down into a host computer, details are first displayed regarding the containers on that host.
Containers are divided into three categories — running, stopped, and paused. When you first enter the page, the table on this page displays a summary of details for the running containers. To switch to details for the containers in the other categories (stopped or paused), click View Details in the relevant colored box at the top of the page.

c. In the list of running containers or paused container (but not in the list of stopped containers), you can drill down into full details about the SCAP results for any specific container. This includes a list of the rules that were used in the scan and an indication of which rules failed and which passed.

d. For details about the images on the host, click the Images link at the top of the page.

e. In the list of images, you can drill down into full details about the SCAP results for any specific image (similar to the results displayed for running or paused containers). This includes a list of the rules that were used in the scan and an indication of which rules failed and which passed.