Overview
TencentOS Server is now officially one of the Linux commercial distributions supported by OpenSCAP, a well-known international security community, marking its deep integration with mainstream international security communities in the field of security compliance. You can now use the full suite of OpenSCAP tools, including the oscap command line tool and the SCAP Workbench graphical interface, to perform automated security scanning, compliance auditing, and security configuration remediation on TencentOS Server.
Introduction to OpenSCAP
SCAP (Security Content Automation Protocol) is designed to unify and automate the definition, verification, and vulnerability assessment of information system security baselines. Through a series of interrelated specifications (such as XCCDF, OVAL, CPE, CCE, and CVE) and XML-based data streams (DataStream), it helps security teams accurately describe system components, write detection rules, perform scans, and generate auditable reports. The standardized format and automation philosophy of SCAP not only significantly reduce the repetitive work of manual auditing, but also provide a unified basis for cross-organizational and cross-product security compliance, and are widely adopted in industries with high security requirements such as finance, government, and energy.
OpenSCAP is a comprehensive suite of open source tools and libraries for implementing and enforcing the SCAP standard. Since receiving NIST SCAP 1.2 certification in 2014, OpenSCAP has become the de facto industry standard for SCAP, with its core components including:
SCAP Workbench: a GTK-based graphical interface that visually manages DataStream, performs checks by policy groups, compares multiple configuration files, and exports results in formats such as HTML, CSV, and ARF.
OpenSCAP: provides libraries and a command line CLI scanning tool (oscap), supporting features such as scanning (oscap xccdf eval), report generation, and compliance remediation (--remediate).
SCAP Security Guide (SSG): an officially maintained rule set that contains XCCDF configuration files and OVAL detection scripts for many mainstream Linux distributions. You can quickly select and customize scanning profiles based on various compliance standards.
Script Check Engine (SCE): an optional module that allows you to write custom check logic based on scripts such as Python or Shell, extending compliance verification capabilities for non-standard or proprietary applications.
SCAP Security Guide (SSG) includes security scanning policies for a wide range of OS distributions and software products, serving as a critical basis for OpenSCAP to perform security compliance baseline checks, remediation, and vulnerability assessment.
Based on its extensive practical experience in the security field, TencentOS Server has integrated and developed two levels of SSG security configuration baselines that cover all scenarios, including SSH login, user password policies, network services, file permissions, log auditing, and kernel network parameters. Through community proposals, code adaptation, and multiple rounds of testing, TencentOS Server has been officially added to the list of OpenSCAP-supported distributions.
You can now install and run tools such as scap-security-guide, openscap, and scap-workbench directly on TencentOS Server, select the TencentOS Server basic or standard security policy as needed to scan and remediate the system, and enjoy a native support experience on par with distributions such as RHEL and Ubuntu.
Getting Started with OpenSCAP
Installing OpenSCAP Tools
dnf install openscap-scanner scap-security-guide -y
After installation, you can run the following command to verify:
Output example:
OpenSCAP command line tool (oscap) 1.3.8
Copyright 2009--2021 Red Hat Inc., Durham, North Carolina.
Viewing Available Security Configuration Files
After the installation is complete, you can view the security configuration files (Profiles) supported by the current system:
oscap info /usr/share/xml/scap/ssg/content/ssg-tencentos4-ds.xml
Output example (excerpt):
Document type: Source Data Stream
Imported: 2025-06-16T18:25:12
Version: 1.3
Profiles:
Title: Basic System Security Profile for TencentOS Server 4
Id: xccdf_org.ssgproject.content_profile_basic
Title: Standard System Security Profile for TencentOS Server 4
Id: xccdf_org.ssgproject.content_profile_standard
Performing Compliance Scans
Taking the basic profile as an example, run a scan and generate an HTML report:
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_basic --results-arf /tmp/oscap-results.xml --report /tmp/oscap-report.html /usr/share/xml/scap/ssg/content/ssg-tencentos4-ds.xml
Output example (excerpt, 313 items in total):
--- Starting Evaluation ---
Title Install sudo Package
Rule xccdf_org.ssgproject.content_rule_package_sudo_installed
Result pass
Title Ensure Sudo Logfile Exists - sudo logfile
Rule xccdf_org.ssgproject.content_rule_sudo_custom_logfile
Result fail
......
Title Ensure the audit Subsystem is Installed
Rule xccdf_org.ssgproject.content_rule_package_audit_installed
Result pass
TencentOS Server provides two security baseline Profiles. Select one based on your security requirements:
xccdf_org.ssgproject.content_profile_basic: basic security baseline.
xccdf_org.ssgproject.content_profile_standard: standard security baseline with stricter check items. If you select the standard baseline, replace the value of the --profile parameter in the preceding command with xccdf_org.ssgproject.content_profile_standard.
Note:
To have oscap automatically remediate certain failed items, add the --remediate option to the command. Automatic remediation directly modifies system configurations such as kernel parameters, service configurations, and file permissions. Before running it, fully understand its impact and verify it in a test environment before using it in production.
Viewing Scan Reports
Copy the html report to your local desktop and view it.
scp root@server:/tmp/oscap-report.html ./