Harden your server with OpenSCAP (CIS Level 1/2, DISA STIG)

⏱ 10 min read 🟠 Advanced Last updated: October 2026

OpenSCAP scans a server against a security profile and can apply the fixes. The profiles come from the open-source ComplianceAsCode project, which publishes CIS Level 1 and Level 2 (server and workstation) and DISA STIG profiles for Ubuntu 22.04 and 24.04. No subscription is needed.

ℹ️ This helps you work toward a CIS or STIG baseline on your own server. It does not make the server, or your organisation, certified or compliant. Compliance is assessed for your organisation, and you keep the evidence.

Before you start

Try it on a throwaway server first. Build a fresh server from the same image, harden that, and check your application still works before touching anything you care about. Remediation changes SSH, the firewall, kernel parameters, file permissions and mount options, and some of those changes need a reboot.
Make sure you can get back in without SSH. Remediation can lock you out of SSH, for example through SSH access rules or a firewall that denies inbound traffic by default. The browser terminal in the dashboard still works, but it needs a password: set one for your user (sudo passwd $USER) or use Reset password in the dashboard. See Connecting to your server.
Set a password before remediating. New servers give the default user passwordless sudo. The STIG and CIS Level 2 profiles remove it, so without a password you lose sudo. Run sudo passwd $USER first.
Prefer a fresh server. Hardening a server that already runs services can break them.

1. Install the scanner and the profiles

The scanner is in Ubuntu's own archive. The package name differs by release:

# Ubuntu 24.04
sudo apt update && sudo apt install -y openscap-scanner unzip

# Ubuntu 22.04
sudo apt update && sudo apt install -y libopenscap8 unzip

Download the profiles from the ComplianceAsCode releases page. This guide uses 0.1.82; use the latest release and check its checksum:

VER=0.1.82
curl -LO https://github.com/ComplianceAsCode/content/releases/download/v$VER/scap-security-guide-$VER.zip
curl -LO https://github.com/ComplianceAsCode/content/releases/download/v$VER/scap-security-guide-$VER.zip.sha512
sha512sum -c scap-security-guide-$VER.zip.sha512
unzip -q scap-security-guide-$VER.zip

Each release has one file per Ubuntu version: ssg-ubuntu2204-ds.xml for 22.04 and ssg-ubuntu2404-ds.xml for 24.04. Pick the one that matches your server:

DS=scap-security-guide-$VER/ssg-ubuntu2404-ds.xml   # or ssg-ubuntu2204-ds.xml on 22.04

2. List the profiles

oscap info $DS

The Profiles section lists their IDs. The ones you will usually want are:

xccdf_org.ssgproject.content_profile_cis_level1_server: CIS Level 1, server
xccdf_org.ssgproject.content_profile_cis_level2_server: CIS Level 2, server (stricter)
xccdf_org.ssgproject.content_profile_stig: DISA STIG

3. Scan

A scan only reads the system. It is safe to run at any time:

PROFILE=xccdf_org.ssgproject.content_profile_cis_level1_server
sudo oscap xccdf eval --profile $PROFILE \
  --results-arf results.xml --report report.html $DS

The terminal prints a pass or fail result for each rule. An exit code of 2 means at least one rule failed, which is normal on a first scan; it does not mean the scan itself went wrong.

4. Read the report

report.html lists every rule with its result, its severity, why it matters and how to fix it. To read it on your own computer, copy it across:

scp ubuntu@YOUR_SERVER_IP:report.html .

Before changing anything, decide which failed rules apply to your server. Some rules suit a workstation or a multi-user host more than a single-purpose server. A rule that does not fit is a documented exception, not something to force.

5. Remediate

⚠️ Keep your current SSH session open from here until after the reboot. Do not reboot until a new SSH session and sudo both work. If they don't, use your open session or the browser terminal to undo the SSH, firewall or sudo change that blocks you.

Generate a fix script, read it, and run it. That way you see every change before it happens:

oscap xccdf generate fix --fix-type bash --profile $PROFILE --output fix.sh $DS
less fix.sh          # review; remove anything you do not want
sudo bash fix.sh

Leave that session open. From your own computer, open a new SSH session and check that sudo still works:

ssh ubuntu@YOUR_SERVER_IP
sudo -v      # asks for the password you set; must succeed

Only when both work, reboot:

sudo reboot

The script contains a fix for every rule in the profile, including rules that already pass. OpenSCAP can also scan and fix in one step with sudo oscap xccdf eval --remediate --profile $PROFILE --results-arf results.xml $DS, but then you do not get to review the changes first.

6. Re-scan, and keep re-scanning

Run the scan from step 3 again after the reboot and compare the reports. Some rules need a manual decision, and some fixes only take effect after a reboot.

A report describes your server only at the moment you ran the scan. Scan again after package upgrades, configuration changes, or a new ComplianceAsCode release. Keep the dated reports as your evidence.