ranbot-ai/awesome-skills/cis-benchmarks

# Install
apt install openscap-scanner scap-security-guide
 
# Confirm installed content matches the actual OS and required benchmark/version.
SCAP_FILE="<approved-installed-datastream.xml>"
oscap info "$SCAP_FILE"
PROFILE_ID="<exact-CIS-profile-listed-by-oscap-info>"
# Run the selected assessment only after scope and report-location approval.
oscap xccdf eval \
  --profile "$PROFILE_ID" \
  --results results.xml \
  --report report.html \
  "$SCAP_FILE"

# Install
apt install lynis
 
# Run audit
lynis audit system
 
# Generate report
lynis audit system --report-file "$PRIVATE_AUDIT_DIR/lynis-report.dat"

# cis-profile/controls/ssh.rb
control 'cis-ssh-1' do
  impact 1.0
  title 'Ensure SSH root login is disabled'
  
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end
 
control 'cis-ssh-2' do
  impact 0.7
  title 'Ensure SSH password authentication is disabled'
  
  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
  end
end

# Run InSpec
inspec exec cis-profile -t ssh://user@target

# kube-bench
docker run --rm -v /etc:/etc:ro -v /var:/var:ro \
  aquasec/kube-bench@sha256:<reviewed-image-digest> run --targets node
 
# Check specific sections
kube-bench --help
# Select role/sections supported by the reviewed version and actual cluster; do not assume master is a current target name.

workflow:
  1_scan:
    - Run automated assessment
    - Generate baseline report
    
  2_analyze:
    - Review findings
    - Identify false positives
    - Prioritize by risk
    
  3_remediate:
    - Apply fixes
    - Document exceptions
    - Verify changes
    
  4_validate:
    - Re-run assessment
    - Confirm remediation
    - Generate compliance report

# Read-only first: inventory before any active step.
command -v oscap
oscap --version