Red Hat Security: Linux in Physical, Virtual, and Cloud

Instructions

1. On the workstation machine, generate a remediation Ansible Playbook. The playbook resolves the compliance issues that you detected in a previous exercise, in a scan that you performed with a customized policy.

   To create the remediation Ansible Playbook, the oscap command requires:

   • The RH415-tailoring.xml tailoring file

   • The RH415-results.xml results file

   1. Use the oscap info command on the RH415-tailoring.xml tailoring file to retrieve the associated profile identifier.

      [student@workstation ~]$ oscap info RH415-tailoring.xml
      Document type: XCCDF Tailoring
      Imported: 2023-10-24T16:58:41
      Benchmark Hint: /tmp/scap-workbench-IlIHwP/ssg-rhel9-ds.xml
      Profiles:
      	Title: [DRAFT] DISA STIG for Red Hat Enterprise Linux 9 [CUSTOMIZED]
      		Id: xccdf_com.example_profile_RH415-rhel9

   2. Use the oscap xccdf generate fix command to generate the Ansible Playbook. Save the playbook to the /home/student/playbook.yml file.

      [student@workstation ~]$ oscap xccdf generate fix \
          --profile xccdf_com.example_profile_RH415-rhel9 \
          --tailoring-file RH415-tailoring.xml \
          --fix-type ansible \
          --result-id "" \
          RH415-results.xml > /home/student/playbook.yml
      [student@workstation ~]$

      The command uses an empty string for the --result-id option. This way, you do not need to specify the full result identifier.

      Notice that you do not need to run this command on the scanned system, provided that the tailoring file, the result file, the SCAP Security Guide, and the oscap command are available on your local system.

   3. Review the /home/student/playbook.yml Ansible Playbook.

      [student@workstation ~]$ cat playbook.yml
      ...output omitted...

      The tasks fix the issue that is reported in the scan from the previous exercise.

2. On the workstation machine, run the Ansible Playbook to resolve the compliance issues on the serverc machine.

   1. Create an inventory file that contains the serverc machine.

      [student@workstation ~]$ echo serverc > inventory

   2. Edit the /home/student/playbook.yml file and add the become: true line.

      ...output omitted...
      - hosts: all
        become: true
        vars:
      ...output omitted...

   3. Use the ansible-playbook command to run the playbook. Include the -K flag to configure the command to prompt for the become password. Use student as the become password.

      [student@workstation ~]$ ansible-playbook -K -i inventory playbook.yml
      BECOME password: student
      
      PLAY [all] *********************************************************************
      
      TASK [Gathering Facts] *********************************************************
      ok: [serverc]
      
      TASK [Gather the package facts] ************************************************
      ok: [serverc]
      
      TASK [Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM variable minlen is set accordingly] *******************************************
      changed: [serverc]
      
      PLAY RECAP *********************************************************************
      serverc                    : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

3. Scan the serverc machine again to confirm that the system is now compliant.

   1. Log in to the serverc machine as the student user. No password is required.

      [student@workstation ~]$ ssh student@serverc
      [student@serverc ~]$

   2. Change to the root user. Use student as the password.

      [student@serverc ~]$ sudo -i
      [sudo] password for student: student
      [root@serverc ~]#

   3. Use the oscap info command on the /root/RH415-tailoring.xml tailoring file to retrieve the associated profile.

      [root@serverc ~]# oscap info RH415-tailoring.xml
      Document type: XCCDF Tailoring
      Imported: 2023-10-24T17:56:55
      Benchmark Hint: /tmp/scap-workbench-IlIHwP/ssg-rhel9-ds.xml
      Profiles:
      	Title: [DRAFT] DISA STIG for Red Hat Enterprise Linux 9 [CUSTOMIZED]
      		Id: xccdf_com.example_profile_RH415-rhel9

   4. Use the oscap xccdf eval command to scan the system for compliance.

      [root@serverc ~]# oscap xccdf eval \
          --profile xccdf_com.example_profile_RH415-rhel9 \
          --tailoring-file RH415-tailoring.xml \
          /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
      ...output omitted...
      --- Starting Evaluation ---
      
      Title   Ensure dnf Removes Previous Package Versions
      Rule    xccdf_org.ssgproject.content_rule_clean_components_post_updating
      Ident   CCE-83458-0
      Result  pass
      
      Title   Ensure gpgcheck Enabled In Main dnf Configuration
      Rule    xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
      Ident   CCE-83457-2
      Result  pass
      
      Title   Ensure gpgcheck Enabled for All dnf Package Repositories
      Rule    xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
      Ident   CCE-83464-8
      Result  pass
      
      Title   Ensure PAM Enforces Password Requirements - Minimum Length
      Rule    xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen
      Ident   CCE-83579-3
      Result  pass

      All the tests pass. The system now complies with your custom policy.

   5. Return to the workstation machine when done.

      [root@serverc ~]# logout
      [student@serverc ~]$ logout
      [student@workstation ~]$