SCAP, the Security Content Automation Protocol (SCAP), was created by the U.S. National Institute of Standards and Technology. It consists of hardening guides, hardening templates, and baseline configuration guides for setting up secure systems. OpenSCAP is a set of free open source software tools that can be used to implement SCAP. It consists of the following:

• Security profiles that you can apply to a system. There are different profiles for meeting the requirements of several different certifying agencies.
• Security guides to help with the initial setup of your system.
• The oscap command-line utility to apply security templates.
• On Red Hat-type systems that have a desktop interface, you have SCAP Workbench, a GUI-type utility.

You can install OpenSCAP on either the Red Hat or the Ubuntu distros, but it's much better implemented on the Red Hat distros. For one thing, the Red Hat world has the very cool SCAP Workbench, but the Ubuntu world doesn't. When you install a Red Hat-type operating system, you can choose to apply a SCAP profile during installation. You can't do that with Ubuntu. Finally, the Red Hat distros come with a fairly complete set of ready-to-use profiles. Curiously, Ubuntu only comes with profiles for older versions of Fedora and Red Hat, which aren't usable on an Ubuntu system. If you want usable profiles for Ubuntu, you'll have to download them from the OpenSCAP website and manually install them yourself. (We'll cover that in the last section of the chapter.) Having said this, let's see how to install OpenSCAP and how to use the command-line utility that's common to both of our distros.  Since CentOS has the more complete implementation, I'll use it for the demos.