Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
In this exercise, you will use an Ansible Playbook provided with the system's SCAP content to remediate a failed compliance check.
Outcomes
You should be able to:
Use output of the customized scan from the previous exercise and an Ansible Playbook provided by the SCAP content to resolve a compliance issue.
Re-scan the system to confirm the issue is reported as resolved.
Confirm that the workstation and serverc machines are started.
Log in to workstation as student using student as the password.
On workstation, run lab oscap-remediate setup to verify that the environment is ready.
This script also installs the openscap-scanner and scap-security-guide packages on serverc, and prepares the systems for the exercise.
[student@workstation ~]$lab oscap-remediate setup
On
workstation, generate the Ansible Playbook to resolve the compliance issues detected in the previous exercise.To create the remediation Ansible Playbook, the oscap command needs:
The
RH415-tailoring.xmltailoring file used for the scan. You should have this file in thestudentuser's home directory from the previous exercise. If not, the exercise setup script has deployed a copy of that file to the/home/student/RH415/labs/oscap-custom/directory. Copy it to thestudentuser's home directory.The
RH415-results.xmlfile from the previous scan onserverc. If you do not have this file, a copy is available in the/home/student/RH415/labs/oscap-custom/directory.
As
root, use scp to retrieve theRH415-results.xmlfile fromserverc. No password is required.[student@workstation ~]$scp root@serverc:RH415-results.xml .RH415-results.xml 100% 67KB 11.9MB/s 00:00Alternatively, copy the two files from the
/home/student/RH415/labs/oscap-custom/directory.[student@workstation ~]$cp /home/student/RH415/labs/oscap-custom/RH415*.xml .[student@workstation ~]$ls RH415*.xmlRH415-results.xml RH415-tailoring.xmlUse the oscap info command on the
RH415-tailoring.xmltailoring file to retrieve the associated profile identifier.[student@workstation ~]$oscap info RH415-tailoring.xmlDocument type: XCCDF Tailoring Imported: 2018-07-27T17:17:43 Benchmark Hint: /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml Profiles: Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT [CUSTOMIZED] Id:xccdf_com.example_profile_RH415-rhel7Use the oscap xccdf generate fix command to generate the Ansible Playbook. Save the playbook as
/home/student/RH415/labs/oscap-custom/playbook.yml.[student@workstation ~]$oscap xccdf generate fix \>--profile xccdf_com.example_profile_RH415-rhel7 \>--tailoring-file RH415-tailoring.xml \>--fix-type ansible \>--result-id "" \>RH415-results.xml > /home/student/RH415/labs/oscap-custom/playbook.yml[student@workstation ~]$The command uses an empty string for the
--result-idoption. This way you do not have to specify the full result identifier.Notice that you do not need to run this command on the scanned system, provided your local system has the tailoring file, the result file, the SCAP Security Guide, and the oscap command.
Review the Ansible Playbook in
/home/student/RH415/labs/oscap-custom/playbook.yml.[student@workstation ~]$cat \>/home/student/RH415/labs/oscap-custom/playbook.yml...output omitted...Notice that the tasks fix the issues reported in the scan from the previous exercise.
On
workstation, run the Ansible Playbook to resolve the compliance issues onserverc. Scanservercagain to confirm that the system is now compliant.From the
/home/student/RH415/labs/oscap-custom/directory, use the ansible-playbook command to run the playbook.[student@workstation ~]$cd /home/student/RH415/labs/oscap-custom/[student@workstation oscap-custom]$ansible-playbook playbook.yml...output omitted... PLAY RECAP ************************************************************** serverc.lab.example.com : ok=3 changed=2 unreachable=0 failed=0Log in to
servercasstudent. No password is required.[student@workstation oscap-custom]$ssh student@serverc[student@serverc ~]$Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@serverc ~]$sudo -i[sudo] password for student:student[root@serverc ~]#Use the oscap info command on the
/home/student/RH415-tailoring.xmltailoring file to retrieve the associated profile.[root@serverc ~]#oscap info /home/student/RH415-tailoring.xmlDocument type: XCCDF Tailoring Imported: 2018-07-27T07:02:06 Benchmark Hint: /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml Profiles: Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT [CUSTOMIZED] Id:xccdf_com.example_profile_RH415-rhel7The
/home/student/RH415-tailoring.xmltailoring file was created during the previous exercise. If you do not have this file, copy it fromworkstationand rerun the previous oscap info command. Usestudentas the password.[root@serverc ~]#scp student@workstation:RH415-tailoring.xml /home/studentThe authenticity of host 'workstation (172.25.250.254)' can't be established. ECDSA key fingerprint is SHA256:GCpIQxItJSWgZDzlmpnZINbwsjf9axrs+o6170OyOuk. ECDSA key fingerprint is MD5:2b:98:e1:85:8b:c7:ea:31:72:08:4d:39:15:ec:5d:da. Are you sure you want to continue connecting (yes/no)?yesWarning: Permanently added 'workstation,172.25.250.254' (ECDSA) to the list of known hosts. student@workstation's password:studentRH415-tailoring.xml 100% 50KB 5.7MB/s 00:00[root@serverc ~]#oscap info /home/student/RH415-tailoring.xmlDocument type: XCCDF Tailoring Imported: 2018-07-27T07:02:06 Benchmark Hint: /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml Profiles: Title: United States Government Configuration Baseline (USGCB / STIG) - DRAFT [CUSTOMIZED] Id:xccdf_com.example_profile_RH415-rhel7Use the oscap xccdf eval command to scan the system for compliance.
[root@serverc ~]#oscap xccdf eval \>--profile xccdf_com.example_profile_RH415-rhel7 \>--tailoring-file /home/student/RH415-tailoring.xml \>/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xmlWARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them. WARNING: Skipping https://learn.spidernet.pl/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content Title Ensure gpgcheck Enabled In Main Yum Configuration Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated Ident CCE-26989-4 ResultpassTitle Ensure gpgcheck Enabled For All Yum Package Repositories Rule xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled Ident CCE-26876-3 ResultpassTitle Ensure YUM Removes Previous Package Versions Rule xccdf_org.ssgproject.content_rule_clean_components_post_updating Ident CCE-80346-0 ResultpassTitle Set Password Minimum Length Rule xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen Ident CCE-27293-0 ResultpassAll the tests passed. The system now complies with your custom policy.
Log off from
serverc.[root@serverc ~]#logout[student@serverc ~]$logout[student@workstation oscap-custom]$
