OpenSCAP on Ubuntu 24.04 LTS | 24/7 Support by cloudimg

OpenSCAP is the reference open source implementation of the Security Content Automation Protocol, the machine readable format that governments, auditors and security teams use to express security policy. It evaluates a system against a published benchmark and produces a report showing exactly which rules pass, which fail, and why.

Compliance content that can actually audit Ubuntu 24.04

This is the substantive difference in this image and it is worth being precise about. Ubuntu 24.04 ships SCAP Security Guide content at version 0.1.71, which predates upstream's Ubuntu 24.04 benchmark: those packages contain datastreams for Ubuntu 16.04, 18.04, 20.04 and 22.04, and no Ubuntu 24.04 datastream at all. A scanner installed from the distribution archive alone therefore cannot audit the operating system it is running on. It installs cleanly, reports its version happily, and is useless for the job you deployed it to do.

This image ships the current upstream SCAP Security Guide content release instead, verified against its published checksum and installed at the standard content path, so all five Ubuntu 24.04 profiles are available immediately.

What ships

• The OpenSCAP scanner, installed unmodified from the Ubuntu archive so it stays patchable through the normal update path.
• Five Ubuntu 24.04 profiles: CIS Level 1 Server, CIS Level 2 Server, CIS Level 1 Workstation, CIS Level 2 Workstation, and the Canonical Ubuntu 24.04 DISA STIG.
• A baseline report generated on first boot, so the appliance arrives having already proved it works.
• Scheduled drift detection, re-running your chosen profile and keeping dated reports.
• Reviewable remediation content for every profile, as both shell scripts and Ansible playbooks.

What this is, and what it is not

OpenSCAP is a compliance scanner, not a compliance platform. There is no web console, no fleet inventory and no historical trending. It measures and reports; it does not make a machine compliant. Four patterns are real: auditing this machine against a recognised benchmark, detecting configuration drift on a schedule, auditing other hosts over SSH from this one, and generating remediation scoped to the rules that actually failed.

If you need a GRC platform with a dashboard across a fleet, this is not that.

Secure and honest by default

The image carries no login and no password of any kind: OpenSCAP has no user database, no daemon and no web interface, and it binds no network port. Administration is over SSH with your own key.

For a compliance tool the worst outcome is not silence but a confident wrong answer, because a scan run against missing or corrupt policy content produces a clean looking report that you then file as evidence. This image therefore verifies its policy content before every scheduled scan and refuses to produce a report at all if that content has been altered.

Nothing on this image ever remediates automatically, at build time, at first boot, or on a schedule. Benchmark remediation disables services and tightens access controls, and applied without review it can lock you out of your own machine. Remediation here is always a deliberate, reviewed act.

Licensing

The OpenSCAP scanner is licensed under the LGPL 2.1 or later and is free. The SCAP Security Guide content is BSD 3-Clause licensed and is redistributed with its notice retained. The cloudimg charge covers packaging, content pairing and verification, security patching, image maintenance and 24/7 expert support.

cloudimg is not affiliated with, endorsed by, or sponsored by Red Hat, Inc. or the ComplianceAsCode project. CIS and DISA STIG are the marks of the Center for Internet Security and the US Defense Information Systems Agency respectively; the profiles on this image are the community implementations of those benchmarks and a passing scan is not a certification of compliance.