Red Hat Security: Linux in Physical, Virtual, and Cloud

Instructions

1. On the workstation machine, install the SCAP Workbench and SCAP Security Guide utilities.

   [student@workstation ~]$ sudo dnf install -y scap-workbench scap-security-guide
   [sudo] password for student: student
   ...output omitted...
   Complete!

   Hide Solution

2. On the workstation machine, customize the DISA STIG for Red Hat Enterprise Linux 9 profile. Set the new profile identifier to xccdf_com.example_profile_lab-rhel9, disable all the rules, and then enable only the following rules:

   • Install AIDE

   • Build and Test AIDE Database

   • Configure AIDE to Verify the Audit Tools

   • Configure Periodic Execution of AIDE

   Store the resulting tailoring file on the workstation machine in the /home/student/lab-tailoring.xml file.

   1. On the workstation machine, start SCAP Workbench by running the scap-workbench command.

      [student@workstation ~]$ scap-workbench

      SCAP Workbench detects that the SCAP Security Guide is already installed on the system and asks you to select the content to use.

      In the Select content to load field, select RHEL9 and click Load Content.

   2. Locate the Profile field and select the DISA STIG for Red Hat Enterprise Linux 9 profile.

      Click Customize to the right of that field.

   3. In the New Profile ID field, enter xccdf_com.example_profile_lab-rhel9 and click OK.

      The new window displays all the available rules.

   4. Click Deselect All and select the following rules in the System and Software Integrity section:

      • Install AIDE

      • Build and Test AIDE Database

      • Configure AIDE to Verify the Audit Tools

      • Configure Periodic Execution of AIDE

      Click OK.

   5. Save the customization in a tailoring file. Select File → Save Customization Only and enter lab-tailoring.xml for the file name in the /home/student/ directory.

      Close SCAP Workbench.

   Hide Solution

3. Scan the serverd machine for compliance with your customization of the DISA STIG for Red Hat Enterprise Linux 9 profile. Save the result on the workstation machine in the /home/student/lab-results.xml file. Generate the HTML report of the scan and store it in the /home/student/lab-results.html file on the workstation machine.

   1. Copy the lab-tailoring.xml tailoring file to the serverd machine. You need this file to scan the system.

      [student@workstation ~]$ scp lab-tailoring.xml student@serverd:
      ...output omitted...

   2. Log in to the serverd machine as the student user. No password is required.

      [student@workstation ~]$ ssh student@serverd
      [student@serverd ~]$

   3. Change to the root user. Use student as the password.

      [student@serverd ~]$ sudo -i
      [sudo] password for student: student
      [root@serverd ~]#

   4. Install the scap-security-guide package.

      [root@serverd ~]# dnf install -y scap-security-guide
      ...output omitted...
      Complete!

   5. Scan the system for compliance with your customization. Save the result in the /root/lab-results.xml file.

      [root@serverd ~]# oscap xccdf eval \
          --profile xccdf_com.example_profile_lab-rhel9 \
          --tailoring-file /home/student/lab-tailoring.xml \
          --results /root/lab-results.xml \
          /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
      ...output omitted...

   6. When the scan is complete, convert the /root/lab-results.xml file to HTML. Save the HTML report as /root/lab-results.html.

      [root@serverd ~]# oscap xccdf generate report \
          lab-results.xml > lab-results.html
      [root@serverd ~]#

   7. Use the scp command to copy the two files to the workstation machine. Use student as the password.

      [root@serverd ~]# scp lab-results.* student@workstation:
      student@workstation's password: student
      ...output omitted...

   8. Return to the workstation machine.

      [root@serverd ~]# logout
      [student@serverd ~]$ logout
      [student@workstation ~]$

   Hide Solution

4. On the workstation machine, generate an Ansible Playbook to resolve the compliance issues that were detected in the previous step. Create an inventory file that contains the serverd host. Save the Ansible Playbook as /home/student/fix.yml and run it to resolve the compliance issues on the serverd host.

   1. Use the oscap xccdf generate fix command to generate the Ansible Playbook. Save the playbook as /home/student/fix.yml.

      [student@workstation ~]$ oscap xccdf generate fix \
          --profile xccdf_com.example_profile_lab-rhel9 \
          --tailoring-file lab-tailoring.xml \
          --fix-type ansible \
          --result-id "" \
          lab-results.xml > fix.yml
      [student@workstation ~]$

   2. Create an inventory file that contains the serverd host.

      [student@workstation ~]$ echo serverd > inventory

   3. Edit the fix.yml file to set the become: true option.

      ...output omitted...
      - hosts: all
        become: true
        vars:
        tasks:
      ...output omitted.

   4. Use the ansible-playbook command to run the playbook. The AIDE database build might take several minutes to complete. Use the -K flag and the student become password.

      [student@workstation ~]$ ansible-playbook -K -i inventory fix.yml
      BECOME password: student
      ...output omitted...
      PLAY RECAP
      ***********************************************************************************
      serverd                    : ok=14   changed=5    unreachable=0    failed=0    skipped=1    rescued=0    ignored=0

   Hide Solution

5. Scan the serverd machine again for compliance with your customization of the DISA STIG for Red Hat Enterprise Linux 9 profile. Save the result on the workstation machine in the /home/student/lab-results-fix.xml file.

   1. Log in to the serverd machine as the student user. No password is required.

      [student@workstation ~]$ ssh student@serverd
      [student@serverd ~]$

   2. Change to the root user. Use student as the password.

      [student@serverd ~]$ sudo -i
      [sudo] password for student: student
      [root@serverd ~]#

   3. Scan the system for compliance with your customization of the DISA STIG for Red Hat Enterprise Linux 9 profile. Save the result in the /root/lab-results-fix.xml file.

      [root@serverd ~]# oscap xccdf eval \
          --profile xccdf_com.example_profile_lab-rhel9 \
          --tailoring-file /home/student/lab-tailoring.xml \
          --results /root/lab-results-fix.xml \
          /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
      ...output omitted...
      --- Starting Evaluation ---
      
      Title   Install AIDE
      Rule    xccdf_org.ssgproject.content_rule_package_aide_installed
      Ident   CCE-90843-4
      Result  pass
      
      Title   Build and Test AIDE Database
      Rule    xccdf_org.ssgproject.content_rule_aide_build_database
      Ident   CCE-83438-2
      Result  pass
      
      Title   Configure AIDE to Verify the Audit Tools
      Rule    xccdf_org.ssgproject.content_rule_aide_check_audit_tools
      Ident   CCE-87757-1
      Result  pass
      
      Title   Configure Periodic Execution of AIDE
      Rule    xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking
      Ident   CCE-83437-4
      Result  pass

   4. Use the scp command to copy the /root/lab-results-fix.xml file to the workstation machine. Use student as the password.

      [root@serverd ~]# scp lab-results-fix.xml student@workstation:
      student@workstation's password: student
      lab-results-fix.xml                                   100%   15MB 219.0MB/s   00:00

   5. Return to the workstation machine as the student user.

      [root@serverd ~]# logout
      [student@serverd ~]$ logout
      [student@workstation ~]$

   Hide Solution