Automated DISA STIG Remediation with Ansible & OpenSCAP
1. Scope & Objective
Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) are the technical standard for securing federal operating systems, networks, and applications. Performing manual STIG audits on dozens or hundreds of virtual machines is unscalable and prone to severe configuration drift.
This SOP documents the implementation of an automated Compliance-as-Code pipeline leveraging Ansible and OpenSCAP to assess, remediate, and generate audit-ready Checklist (.ckl) artifacts.
2. STIG Severity Categories (CAT I, II, III)
| Category | Severity | Failure Impact | Remediation Requirement |
|---|---|---|---|
| CAT I | High (CVSS >= 7.0) | Direct, immediate remote exploitation or unauthorized root takeover | Remediation mandatory prior to system network activation |
| CAT II | Medium (CVSS 4.0 - 6.9) | Weaknesses in access controls, audit retention, or network session isolation | Remediated within 30 days of discovery |
| CAT III | Low (CVSS < 4.0) | Degraded defenses, administrative hygiene, or missing warning banners | Remediated within 90 days or documented in POA&M |
3. Automated Scanning Execution Protocol
Execute OpenSCAP against the official DISA benchmark using the command line:
# Execute authenticated scan generating both HTML report and eMASS ARF XML
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --results-arf /var/log/stig/arf-report-$(date +%F).xml --report /var/log/stig/stig-scorecard-$(date +%F).html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel9-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
4. Idempotent Ansible Remediation Playbook Snippet
Below is an enterprise Ansible snippet enforcing CAT I and CAT II access control rules:
---
- name: "DISA STIG Automated Hardening - Core OS"
hosts: all
become: yes
tasks:
- name: "V-230230: Enforce DoD Login Warning Banner"
ansible.builtin.copy:
dest: "/etc/issue"
owner: "root"
group: "root"
mode: "0644"
content: |
You are accessing a U.S. Government (USG) Information System (IS)
that is provided for USG-authorized use only. By using this IS,
you consent to continuous monitoring and audio/keystroke logging.
- name: "V-230300: Disable Core Dumps for Setuid Programs"
ansible.posix.sysctl:
name: "fs.suid_dumpable"
value: "0"
state: "present"
reload: yes
- name: "V-230350: Ensure Password Encryption Uses SHA512"
ansible.builtin.lineinfile:
path: "/etc/login.defs"
regexp: "^ENCRYPT_METHOD"
line: "ENCRYPT_METHOD SHA512"
state: "present"
5. Operational Verification Checklist
- Zero CAT I Findings: Confirm the post-remediation OpenSCAP scan returns 0 fail results for high-severity rules.
- Idempotency Check: Re-run the Ansible playbook a second time and ensure changed=0 across all target hosts.
- Auditd Rule Persistence: Verify
/etc/audit/rules.d/audit.rulesis immutable (-e 2) and resists tampering. - CKL Export: Generate the
.cklfile and verify compatibility with DISA STIG Viewer 3.x before uploading to eMASS.
