Red Hat Security: Linux in Physical, Virtual, and Cloud

On workstation, open a browser and navigate to the Satellite Server web UI at https://satellite.lab.example.com. If prompted, accept the self-signed certificate and log in as admin using redhat as the password.

Customize the default Common Profile for General-Purpose Systems profile for RHEL 7 SCAP content with the provided tailoring file. Download the tailoring file from http://materials.example.com/labs/ssg-rhel7-ds-tailoring.xml to workstation.

1. On workstation open a terminal window. Use the wget command to download the tailoring file from http://materials.example.com/labs/ssg-rhel7-ds-tailoring.xml to the /home/student/Downloads directory.

   [student@workstation ~]$ wget \
   > http://materials.example.com/labs/ssg-rhel7-ds-tailoring.xml \
   > -P ~/Downloads
   ...output omitted...

2. In the Satellite Server web UI, navigate to Hosts → Tailoring Files. Click New Tailoring File to add a new tailoring file.

3. On the Upload new Tailoring File page, enter the Name as Tailoring-File-1. Click Browse to upload the /home/student/Downloads/ssg-rhel7-ds-tailoring.xml tailoring file, and then click Submit.

Edit the OpenSCAP-Policy1 compliance policy to add the tailoring file uploaded in the previous step.

1. Navigate to Hosts → Policies.

2. Choose Edit from the list of the OpenSCAP-Policy1 policy to open the policy for editing.

3. On the SCAP Content tab, for Tailoring File, select Tailoring-File-1. The XCCDF Profile in Tailoring File list automatically selects the Common Profile for General-Purpose Systems [CUSTOMIZED] XCCDF profile, because there is only one profile included in the tailoring file.

4. Click Submit.

On your Satellite Server, use remote execution to manually run the Puppet agent on serverd to fetch the edited compliance policy.

1. From the Satellite web UI, use the remote execution feature to execute the Puppet run. Navigate to Hosts → All hosts. Select the serverd.lab.example.com in Hosts page.

2. Select Schedule Remote Job from the Select Action list.

3. On the Job invocation page, select Puppet from the Job category list. Do not change or edit any other fields in the page. Select Execute now for Schedule. Click Submit.

4. On the Overview tab, wait until you see succeeded with the 100% Success message. Click serverd.lab.example.com on the Hosts tab to see the output of the Puppet run.

View the content of the /etc/foreman_scap_client/config.yaml file to verify that the compliance policy now uses a tailoring file.

1. Log in to serverd as student. Use the sudo -i command to change to the root user. Use student as the password.

   [student@workstation ~]$ ssh student@serverd
   [student@serverd ~]$ sudo -i
   [sudo] password for student: student
   [root@serverd ~]# 

2. View the /etc/foreman_scap_client/config.yaml file to inspect the compliance policy settings defined in the file which now includes a tailoring file.

   [root@serverd ~]# cat /etc/foreman_scap_client/config.yaml
   # DO NOT EDIT THIS FILE MANUALLY
   # IT IS MANAGED BY PUPPET
   
   ...output omitted...
   # policy (key is id as in Foreman)
   
   1:
     :profile: 'xccdf_com.lab.example_profile_common_customized'
     :content_path: '/var/lib/openscap/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d.xml'
     # Download path
     # A path to download SCAP content from proxy
     :download_path: '/compliance/policies/1/content/96c2a9d5278d5da905221bbb2dc61d0ace7ee3d97f021fccac994d26296d986d'
     :tailoring_path: '/var/lib/openscap/tailoring/7ebe67694d7ce79d08c960a5854c3b246fd317b5de187a7cd467f349a777a679.xml'
     :tailoring_download_path: '/compliance/policies/1/tailoring/7ebe67694d7ce79d08c960a5854c3b246fd317b5de187a7cd467f349a777a679'

   In the above output the compliance policy ID is 1. The policy is based on the xccdf_com.lab.example_profile_common_customized OpenSCAP profile and uses the tailoring file.

3. Log off from serverd.

   [root@serverd ~]# logout
   [student@serverd ~]$ logout
   Connection to serverd closed.
   [student@workstation ~]$ 

Initiate an OpenSCAP scan on serverd from the Satellite Server's web UI.

1. In the Satellite web UI, navigate to Hosts → All hosts. Ensure that the serverd.lab.example.com host is checked.

2. Select Schedule Remote Job from the Select Action drop-down list.

3. On the Job invocation page, select OpenSCAP from the Job category list. Do not change or edit any other fields in the page. Ensure that for Schedule, Execute now is selected. Click Submit.

4. On the Overview tab, wait until you see succeeded with the 100% Success message. Click serverd.lab.example.com on the Hosts tab to see the output of an OpenSCAP scan run.

Evaluate an OpenSCAP report in the Satellite web UI to determine which checks passed and failed.

1. Navigate to Hosts → Reports to list the OpenSCAP scan reports uploaded by serverd. The report page might lists more than one report.

2. To open the latest report, click the link under the Reported At column to view the details for the latest scan result. Notice that the OpenSCAP scan result should now show seven passes and zero failures in comparison to the non-customized compliance policy which shows more failures.

3. Log off from the Satellite web UI.