Quick Start Guide: CIS-CAT Remote Linux Scanning From a Windows Host

Owned by Amanda McGown
Last updated: Aug 15, 2023 by Andrew Dannenberger
3 min read

Overview

This guide will show how to set up a remote Linux scanning environment for CIS-CAT Pro Assessor from a Windows system using a CMD prompt.

Requirements

  • PowerShell installed on Windows system with Assessor

  • PowerShell LanguageMode is not configured to ConstrainedLanguage

    • ConstrainedLanguage mode blocks assessor actions as CIS-CAT PowerShell scripts cannot be dot-sourced

    • Verify LanguageMode using this command: PS> $ExecutionContext.SessionState.LanguageMode

Jump to:

1 Guided Video Resource on setting up CIS-CAT Pro Assessor for Remote Linux Scanning

Implementation Steps

  1. Navigate to \Assessor\config and open the sessions.properties file with Notepad++ or the text editor of your choice. NOTE: The version of Assessor you are using will likely be different, so be sure to change the version number in the path.

  2. Edit the ā€œSample Remote Linux Connectionā€ section by uncommenting (deleting the # symbol) the lines below.

Ā 

For details on the configuration properties for sessions.properties, please see the following section from Assessor's Configuration Guide: https://ccpa-docs.readthedocs.io/en/latest/Configuration%20Guide/#remote-local-assessment-sessions

If you are using a key pair instead of a password, then remove the # symbol from the session.2.identity line and add a # symbol (comment out) to the session.2.cred line.

3. From a CMD prompt, enter the following command (NOTE: your version of Assessor and the Benchmark name and version may be different than the one seen below):

>Assessor-CLI.bat -b benchmarks/CIS_Ubuntu_Linux_20.04_LTS_Benchmark_v1.1.0-xccdf.xml

You should see output similar to the one below:

On the Linux target, ensure that you have a firewall rule in place to allow port 22.

Ā 

Guided Video Resource on setting up CIS-CAT Pro Assessor for Remote Linux Scanning

Ā 

Additional Troubleshooting Information

Network diagram for remote scan setup

Problems with ssh connection for a remote assessment

Linux Assessment Trouble

Differing Results between Local and Remote Linux Assessment

Remote Linux Scan is at Stuck Collecting System Characteristics

Ā 

Ā 

Copyright Ā© 2022 Center for Internet SecurityĀ® Privacy Policy

Ā 

Ā