Compliance audits used to be a person with a clipboard. I automated the entire process with OpenSCAP and wired the results into Prometheus so compliance drift triggers alerts instead of quarterly surprises.

**What's covered:**

* OpenSCAP installation differences: Rocky Linux (dnf + SSG in repos), Ubuntu 24.04 (apt scanner + upstream SSG ZIP — `ssg-base` doesn't include datastream XML), Kinoite (baked into OSTree treefile as custom RPM)
* CIS profile auto-discovery: handles Rocky vs Oracle Linux profile ID differences automatically
* Exit code semantics: 2 = rules failed (expected), 1 = scan error — important for automation
* SCAPinoculars v0.0.3 quirk: ignores `--report-dir` and `--port` flags, hardcodes `resources/reports` path relative to working directory
* Systemd unit workaround: symlink `resources/reports` → `/var/log/openscap/` via ExecStartPre
* Prometheus scrape job for compliance metrics at port 2112
* Security hardening: ARF report access control, firewall rules for port 2112, dedicated scan service account

**Why it matters:**

* Compliance and operational monitoring unified in one Grafana dashboard
* Configuration drift surfaces immediately rather than at audit time
* Automated evidence generation for SOX, HIPAA, PCI-DSS frameworks
* Cross-distribution approach works across heterogeneous environments

Full guide with scan commands, systemd units, Prometheus config, and SCAPinoculars quirks documented.

\#linux #openscap #compliance #cis #prometheus #grafana #kinoite #sysadmin #homelab

[https://richard-sebos.github.io/sebostechnology/posts/OpenSCAP/](https://richard-sebos.github.io/sebostechnology/posts/OpenSCAP/)  


OpenSCAP: Automating CIS Compliance Scanning Across Rocky Linux, Ubuntu, and Fedora Kinoite