Red Hat Security: Linux in Physical, Virtual, and Cloud

On workstation, open a web browser and navigate to https://satellite.lab.example.com. Log in as admin using redhat as the password.

1. From workstation, open a web browser and navigate to https://satellite.lab.example.com. Accept the self-signed certificate and log in as admin using redhat as the password.

Verify that a host group named org-hostgroup1 exists in the org-example organization.

1. Set the organization context to org-example. Navigate to Any Context → Any Organization and select org-example.

2. Navigate to Configure → Host groups. Verify that the org-hostgroup1 host group exists.

3. Click the org-hostgroup1 link to open the group for editing.

   Ensure that the following fields are correctly configured:

   Table 10.2. Puppet Configurations

   Field	Value
   Puppet Environment	production
   Puppet Master	satellite.lab.example.com
   Puppet CA	satellite.lab.example.com
   OpenSCAP Capsule	satellite.lab.example.com

   
   

Add the foreman_scap_client Puppet module to the org-hostgroup1. This Puppet module automatically installs and configures the client's /etc/foreman_scap_client/config.yaml file with parameters that are needed for the operation of OpenSCAP scans and to upload the scan result to the Satellite Server.

1. From the Edit org-hostgroup1 page, select the Puppet Classes tab. Click + to add the foreman_scap_client Puppet class listed under the foreman_scap_client Puppet module.

2. Click Submit.

Upload the default OpenSCAP content provided by the scap-security-guide package to the Satellite Server's database.

1. On workstation, open a command terminal. Log in to the satellite server as student. Use the sudo -i command to switch identity to the root user. Use student as the password.

   [student@workstation ~]$ ssh student@satellite
   [student@satellite ~]$ sudo -i
   [sudo] password for student: student
   [root@satellite ~]# 

2. Use the foreman-rake foreman_openscap:bulk_upload:default command to upload the default SCAP content provided by the scap-security-guide package to the Satellite Server's database.

   [root@satellite ~]# foreman-rake foreman_openscap:bulk_upload:default
   Saved /usr/share/xml/scap/ssg/content/ssg-firefox-ds.xml as Red Hat firefox default content
   Saved /usr/share/xml/scap/ssg/content/ssg-jre-ds.xml as Red Hat jre default content
   Saved /usr/share/xml/scap/ssg/content/ssg-rhel6-ds.xml as Red Hat rhel6 default content
   Saved /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml as Red Hat rhel7 default content

3. Verify that the default SCAP content is uploaded to the Satellite Server's database using the hammer CLI. Use the hammer scap-content list command from the terminal to list the SCAP content loaded to the Satellite Server's database.

   [root@satellite ~]# hammer scap-content list
   ---|--------------------------------
   ID | TITLE
   ---|--------------------------------
   1  | Red Hat firefox default content
   2  | Red Hat jre default content
   3  | Red Hat rhel6 default content
   4  | Red Hat rhel7 default content
   ---|--------------------------------

   Log off from satellite.

   [root@satellite ~]# logout
   [student@satellite ~]$ logout
   Connection to satellite closed.
   [student@workstation ~]$ 

View the OpenSCAP content from the Satellite Server web UI.

Navigate to Hosts → SCAP contents. The SCAP Contents page lists the default SCAP contents.

In the classroom environment, the serverd.lab.example.com host is already registered to the Satellite Server running on satellite.lab.example.com. Re-registering serverd to the Satellite Server deletes the host from the Satellite Server and configures the host with the SCAP client and all necessary packages.

Re-registering serverd ensures that the foreman_scap_client Puppet class assigned to the org-hostgroup1 host group is executed.

1. Log in to serverd as student. Use the sudo -i command to change to the root user. Use student as the password.

   [student@workstation ~]$ ssh student@serverd
   [student@serverd ~]$ sudo -i
   [sudo] password for student: student
   [root@serverd ~]# 

2. Download the bootstrap.py script file from http://satellite.lab.example.com/pub/bootstrap.py on serverd. Change the permission of the bootstrap.py file to make it executable.

   [root@serverd ~]# wget http://satellite.lab.example.com/pub/bootstrap.py
   ...output omitted...
   [root@serverd ~]# chmod a+x bootstrap.py

3. Run the bootstrap.py script to re-register serverd with the serverkey activation key to the Satellite Server, as shown in the following example. Use the --force option to overwrite all the registration configurations. The command re-registers serverd and configures the SCAP client. Enter redhat as the admin user's password.

   [root@serverd ~]# ./bootstrap.py -l admin -s satellite.lab.example.com \
   > -o 'org-example' -L 'Default Location' -a serverkey -g org-hostgroup1 --force
   Foreman Bootstrap Script
   This script is designed to register new systems or to migrate an existing system to a Foreman server with Katello
   admin's password: redhat
   ...output omitted...
   Complete!
   Uploading Enabled Repositories Report
   Loaded plugins: langpacks, product-id, subscription-manager
   [SUCCESS], [2018-07-25 20:28:35], [/usr/bin/yum -y remove rhn-setup rhn-client-tools yum-rhn-plugin rhnsd rhn-check rhnlib spacewalk-abrt spacewalk-oscap osad 'rh-*-rhui-client' 'candlepin-cert-consumer-*'], completed successfully.

4. View the /etc/foreman_scap_client/config.yaml file to check the Satellite capsule address to which the SCAP scan reports are uploaded. Notice that the OpenSCAP policy is not yet defined in the file.

   [root@serverd ~]# cat /etc/foreman_scap_client/config.yaml
   # DO NOT EDIT THIS FILE MANUALLY
   # IT IS MANAGED BY PUPPET
   
   # Foreman proxy to which reports should be uploaded
   :server: 'satellite.lab.example.com'
   :port: 9090 
   ...output omitted...
   # policy (key is id as in Foreman)

5. List the OpenSCAP packages installed by the foreman_scap_client Puppet module.

   [root@serverd ~]# rpm -qa | grep -E 'foreman_scap|openscap'
   rubygem-foreman_scap_client-0.3.0-2.el7sat.noarch
   openscap-scanner-1.2.16-8.el7_5.x86_64
   openscap-1.2.16-8.el7_5.x86_64

   The rubygem-foreman_scap_client.noarch package provides the client script that runs the OpenSCAP scan and uploads the result to the Satellite Server.

6. Log off from serverd.

   [root@serverd ~]# logout
   [student@serverd ~]$ logout
   Connection to serverd closed.
   [student@workstation ~]$