Configuration compliance across a Linux fleet: auditing as code
You write the organisation’s Linux configuration standard, turn auditing and fixing into code with OpenSCAP and Ansible, catch configuration drift, record exceptions and measure and report the fleet’s compliance.
Level 501 · 12 lessons · 9 practice labs
Lessons
Standard and tools
- Writing the organisation’s Linux configuration standard
- Compliance as code: OpenSCAP profiles
- Audit and remediation playbooks with Ansible
- Short task: write a Linux baseline configuration standard for a fictional organisation
Continuous auditing
- Detecting configuration drift
- Recording exceptions
- The compliance report and per-server score
- Golden images: building from a hardened template
- Short task: find the drift on five servers and fix it automatically
Operating
- Working with change management
- Metrics: compliance rate and time to fix
- Capstone: build a compliance-as-code pipeline for a server fleet
Practice labs
- Write a Linux baseline configuration standard for a fictional company: Write ten measurable items on accounts, SSH, logging and updates for Demirsu Enerji.
- Evaluate a server against the standard with an OpenSCAP profile: Choose a suitable profile, run the evaluation and report the failing rules.
- Fix non-compliance with an Ansible playbook and re-evaluate: Run in check mode first, then apply the fix and show the compliance score rose.
- Find configuration drift on five servers: Compare SSH and sudo settings of five servers with the standard and list the deviations.
- Auto-fix drift and record an exception: Fix drift with the playbook and add the deviation with a real business need to the exception register with a deadline.
- Build a server from a hardened golden image and verify compliance: Create a server from the template image, run the compliance evaluation at first boot and prove full compliance.
- Prepare a per-server compliance score report: Extract per-server compliance percentage and the most-failed rules from evaluation results.
- Apply a compliance fix together with a change record: Prepare the change record, affected servers and rollback, apply the fix and close the record.
- Build a compliance-as-code pipeline for a server fleet: Chain evaluation, fixing and reporting into one scheduled pipeline and produce compliance rate and fix-time metrics.
About this course
You write the organisation’s Linux configuration standard, turn auditing and fixing into code with OpenSCAP and Ansible, catch configuration drift, record exceptions and measure and report the fleet’s compliance.
What you will learn
- Standard and tools
- Continuous auditing
- Operating
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.