Mastering Linux Security and Hardening

Remediating the system

So, we have 20 problems that we need to fix before our system can be considered as compliant with Payment Card Industry standards. Let's see how many of them that oscap can fix for us:

sudo oscap xccdf eval --remediate --profile pci-dss --results scan-xccdf-remediate-results.xml /usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml

This is the same command that I used to perform the initial scan, except that I added the --remediate option, and I'm saving the results to a different file. You'll want to have a bit of patience when you run this command, because fixing some problems involves downloading and installing software packages. In fact, even as I type this, oscap is busy downloading and installing the missing AIDE ...