Red Hat Security: Linux in Physical, Virtual, and Cloud

On workstation open a command terminal. Use the wget command to download the tailoring file from http://materials.example.com/labs/compliancelab-tailoring.xml to the /home/student/Downloads directory.

[student@workstation ~]$ wget \
> http://materials.example.com/labs/compliancelab-tailoring.xml \
> -P ~/Downloads
...output omitted...

In the Satellite web UI, navigate to Hosts → Tailoring Files. Click New Tailoring File to upload a new tailoring file.

On the Upload new Tailoring File page, enter ComplianceLab-TailoringFile in the Name field. Click Browse to upload the /home/student/Downloads/compliancelab-tailoring.xml tailoring file. Click Submit.

Navigate to Hosts → Policies.

Click New Policy.

On the New Compliance Policy page, enter ComplianceLab-Policy1 as the name of the policy. The policy description is optional. Click Next.

On the SCAP Content tab, select Red Hat rhel7 default content from the SCAP Content list. For XCCDF Profile, select Standard System Security Profile. For Tailoring File, select ComplianceLab-TailoringFile. The XCCDF Profile in Tailoring File list automatically sets the Standard System Security Profile [CUSTOMIZED] XCCDF profile, because there is only one profile included in the tailoring file. Click Next.

On the Schedule tab, for Period, choose Weekly. For Weekday, select Sunday. Click Next.

On the Locations tab, click Default Location to move it to the Selected items list. Click Next.

On the Organizations tab, click org-example to move it to the Selected items list. Click Next.

On the Hostgroups tab, click org-hostgroup1 to move it to the Selected items list. Click Submit to create the compliance policy.

From the Satellite's web UI, use the remote execution feature to run the Puppet agent. Navigate to Hosts → All hosts. Select the following hosts in the Hosts page.

Select Schedule Remote Job from the Select Action list.

On the Job invocation page, for Job Category, select Puppet. Ensure that Execute now is selected for Schedule. Click Submit.

On the Overview tab, wait until you see succeeded with the 100% Success message.

Navigate to Hosts → All hosts. Select the following hosts:

Select Schedule Remote Job from the Select Action list.

On the Job invocation page, for Job Category, select OpenSCAP. Ensure that Execute now is selected for Schedule. Click Submit.

On the Overview tab, wait until you see succeeded with the 100% Success message.

Navigate to Hosts → Reports.

To open the latest report, click the link under the Reported At column to view the details for the latest scan result on serverd.

Click View full report to evaluate the detailed full report.

On the OpenSCAP Evalution Report page of serverd, glance through the report to see what rules passed or failed. Evaluate the severity of the security rules.

Search for Prevent Log In to Accounts With Empty Password in the OpenSCAP evaluation report. Notice that the Prevent Log In to Accounts With Empty Password security rule fails with severity high.

Click the Prevent Log In to Accounts With Empty Password link. The Remediation Shell script section provides the remediation commands to fix the compliance issue. Click show.

Copy both commands.

sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/system-auth
sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/password-auth

In the Satellite web UI, navigate to Hosts → All hosts. Select serverd.lab.example.com. Clear any other hosts that are selected.

Choose Schedule Remote Job from the Select Action list.

On the Job invocation page, for Job Category, select Commands. Paste the remediation commands from the previous step in the command field. Ensure that Execute now is selected for Schedule. Click Submit.

On the Overview tab, wait until you see succeeded with the 100% Success message.

Navigate to Hosts → All hosts. Select the following hosts:

Select Schedule Remote Job from the Select Action list.

On the Job invocation page, for Job Category, select OpenSCAP. Ensure that Execute now is selected for Schedule. Click Submit.

On the Overview tab, wait until you see succeeded with the 100% Success message.

Navigate to Hosts → Reports to list the OpenSCAP scan reports uploaded by all the hosts.

Notice that the OpenSCAP scan on serverd must now show 10 passes and 0 failed result. The other hosts must show 9 passes and 1 failed result.

Click the link under the Report At column to view the details for the latest scan result on serverd.

Click View full report to view the OpenSCAP Evalution Report page. Verify that the Prevent Log In to Accounts With Empty Password compliance report is resolved on serverd.

Log off from the Satellite web UI.