SCAP Compliance Role

Ansible role to run OpenSCAP XCCDF audits and optional remediation. SCAP content and profiles are based on the ComplianceAsCode project.

Supported OS

AlmaLinux 9/10
RHEL 9/10
Debian 11/12/13

Usage

- hosts: all
  become: true
  roles:
    - role: scap_compliance
      vars:
        scap_profile: anssi_bp28_intermediary
        scap_remediate: false

Main Variables

scap_profile: anssi_bp28_intermediary
scap_remediate: false
scap_initial_audit: true
scap_final_audit: false
scap_work_dir: /opt/scap

Notes

Audit reports are written under {{ scap_work_dir }}/reports.
Remediation requires matching pre-extracted files under files/remediation/.
Sudo Exceptions: For strict ANSSI profiles, noexec and requiretty exceptions are added for the Ansible user. For ANSSI high and enhanced profiles, the sudo binary chmod restriction is also bypassed, preventing lockouts and avoiding playbook errors during remediation.
Pre-processed remediation files edited to set mail alias to root@ifri.akl.

Tests

Proxmox VMs

Testing with proxmox VMs: Debian 13 and AlmaLinux 10

qm clone 3000 3012 --name debarm3012 && sleep 2
qm set 3012 --ipconfig0 ip=192.168.1.92/24,gw=192.168.1.254
qm resize 3012 scsi0 12G
qm set 3012 --cicustom "user=local-data:snippets/cloud-init-3012.yml"
qm start 3012

while ! ssh-keyscan -H 192.168.1.92 2>/dev/null | grep -q .; do sleep 1; done \
&& ssh ansibledo@192.168.1.92 uname -a
Linux debarm3012.ifri.aklab 6.12.100+deb13-cloud-arm64 #1 SMP Debian 6.12.100-1 (2026-07-30) aarch64 GNU/Linux

qm clone 1000 1012 --name almarm1012 && sleep 2
qm set 1012 --ipconfig0 ip=192.168.1.94/24,gw=192.168.1.254
qm resize 1012 scsi0 12G
qm set 1012 --cicustom "user=local-data:snippets/cloud-init-1012.yml"
qm start 1012

while ! ssh-keyscan -H 192.168.1.94 2>/dev/null | grep -q .; do sleep 1; done \
&& ssh ansibledo@192.168.1.94 uname -a
Linux almarm1012.ifri.aklab 6.12.0-211.40.1.el10_2.aarch64 #1 SMP PREEMPT_DYNAMIC Sat Aug  1 05:10:04 EDT 2026 aarch64 GNU/Linux

Playbook example:

---
- name: SCAP ANSSI Compliance
  hosts: all
  become: yes
  gather_facts: yes

  roles:
    - role: scap_compliance
      vars:
        scap_profile: anssi_bp28_minimal
        #scap_profile: anssi_bp28_intermediary
        #scap_profile: anssi_bp28_enhanced
        #scap_profile: anssi_bp28_high
        scap_remediate: true
        scap_initial_audit: false

Docker

Run converge tests:

molecule create

molecule converge

molecule verify

molecule destroy

References

ComplianceAsCode