Red Hat Security: Linux in Physical, Virtual, and Cloud

Instructions

1. From the workstation machine, connect to the Satellite web UI at https://satellite.lab.example.com. If prompted, accept the self-signed certificate and log in as the admin user with redhat as the password.

2. Upload a new tailoring file named ComplianceLab-TailoringFile to customize the default Standard System Security profile for RHEL 9 SCAP content. Upload the tailoring file from /home/student/RH415-tailoring.xml to Satellite.

   1. Select Operations from the Organizations list.

      Note

      At some resolutions, the Organizations list displays in a sidebar menu. If the Organizations list does not display at the top, then navigate to Organizations → Operations from the sidebar menu.

   2. In the Satellite web UI, navigate to Hosts → Compliance → Tailoring Files. Click Upload New Tailoring file to upload a new tailoring file.

   3. On the Upload new Tailoring File page, enter ComplianceLab-TailoringFile in the Name field. Click Browse to upload the /home/student/RH415-tailoring.xml tailoring file. Click Submit.

   Hide Solution

3. Create a compliance policy named ComplianceLab-Policy1 by using the default RHEL 9 SCAP content. Choose the [DRAFT] DISA STIG for Red Hat Enterprise Linux 9 XCCDF profile and the ComplianceLab-TailoringFile tailoring file. The policy should execute weekly on Sunday and should be deployed by using Ansible. Use the following table to specify the other fields for the compliance policy:

   Table 11.3. Compliance Policy Parameters

   Field	Value
   Deployment	Ansible
   Locations	Default Location
   Organizations	Operations
   Hostgroups	org-hostgroup1

   
   

   1. Navigate to Hosts → Compliance → Policies.

      Click New Compliance Policy.

   2. Select Ansible as the deployment option, and then click Next.

   3. On the New Compliance Policy page, enter ComplianceLab-Policy1 as the name of the policy. The policy description is optional. Click Next.

   4. On the SCAP Content tab, set the following values:

      • Select rhel9 content from the SCAP Content list.

      • For Tailoring File, select ComplianceLab-TailoringFile.

      • The XCCDF Profile in Tailoring File list automatically sets the [DRAFT] DISA STIG for Red Hat Enterprise Linux 9 [CUSTOMIZED] XCCDF profile, because only one profile is included in the tailoring file. Click Next.

   5. On the Schedule tab, choose Weekly for Period. For Weekday, select Sunday. Click Next.

   6. On the Locations tab, select Default Location to move it to the Selected items list. Click Next.

   7. On the Organizations tab, select Operations to move it to the Selected items list. Click Next.

   8. On the Hostgroups tab, select org-hostgroup1 to move it to the Selected items list. Click Submit to create the compliance policy.

   Hide Solution

4. Assign the ComplianceLab-Policy1 policy to all hosts.

   1. Navigate to Hosts → Hosts → All Hosts, and then select the checkboxes for the servera.lab.example.com and serverb.lab.example.com hosts.

   2. Click Select Action and select Assign Compliance Policy from the list.

   3. Select Remember hosts selection for the next bulk action.

   4. Select ComplianceLab-Policy1 from the list and click Submit.

   5. Select the checkboxes for the servera.lab.example.com and serverb.lab.example.com hosts. Click Select Action, and then select Run all Ansible roles from the list.

   Hide Solution

5. Manually run the compliance scan on the following hosts to update the clients with the new compliance policy.

   • servera.lab.example.com

   • serverb.lab.example.com

   1. Navigate to Hosts → Hosts → All Hosts, and then select the checkboxes for the servera.lab.example.com and serverb.lab.example.com hosts.

   2. Click Select Action → Schedule Remote Job.

   3. Select the OpenSCAP job category and the Run OpenSCAP scans job template, and then click Run on selected hosts.

   Hide Solution

6. View and download the results of the ComplianceLab-Policy1 OpenSCAP scan.

   1. Navigate to Hosts → Compliance → Policies.

   2. Click Dashboard for the ComplianceLab-Policy1 scan.

   3. Click View Report for the servera host.

   4. Browse through the results to find which rules the servera machine is compliant with.

   5. Click Download XML in bzip to download the results.

   Hide Solution