Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 1. Remediations overview

After identifying the highest remediation priorities in your Red Hat Enterprise Linux (RHEL) infrastructure, you can create and execute remediation plans to fix those issues.

1.1. About remediations
Copy link

Remediations enables you to address the following topics on your connected RHEL systems:

  • Advisor recommendations
  • Content advisories
  • Vulnerability CVEs
  • Failed compliance rules found by Red Hat Lightspeed

You can remediate a single issue or a related group of issues by using a pathway in Red Hat Lightspeed. Pathways group multiple advisor recommendations under common actions for better efficiency. For more information, see Remediating pathways.

For some issues, Red Hat Lightspeed provides several different remediation paths.

When you create a remediation plan, Red Hat Lightspeed generates an Ansible Playbook to implement the required remediation actions and apply any required patches on affected systems in your RHEL infrastructure.

Some issues require a manual fix and cannot be resolved by executing a remediation plan in Red Hat Lightspeed. To determine if you can remediate a problem in Red Hat Lightspeed, check the Resolution type value of the issue or recommendation.

1.2. Remediation types
Copy link

In Red Hat Lightspeed, an issue or recommendation for remediation can be one of the following two types:

  • Manual: Red Hat Lightspeed provides the manual remediation steps needed to fix or address all issues and recommendations, including whether the system requires a reboot for the remediation to take effect.

  • Playbook: For many issues, Red Hat Lightspeed also provides a pre-built remediation playbook that automates the required resolution steps, which you can either:

    • Run on your systems from within Red Hat Lightspeed
    • Download and run externally in your Ansible Playbooks environment

1.3. Red Hat Lightspeed remediations workflow
Copy link

You can use the following outline of a remediations workflow to design how you will create and execute a remediation plan.

  • Choose an issue or recommendation

    • Choose an issue or recommendation that Red Hat Lightspeed has detected on one or more of your RHEL systems.

  • Review the recommended resolution path

    • Determine which versions of RHEL are affected and whether or not a playbook is available. You can only create a remediation plan in Red Hat Lightspeed if a pre-built playbook exists.

  • Decide which RHEL systems to remediate

    • After you review the recommended resolution steps and determine if a playbook is available to remediate the issue, choose which systems to include in the plan.

      Important

      To create a remediation plan for a group of systems, you must ensure that all systems in the group are running the same RHEL major and minor versions so that the resolution applied by the Red Hat Lightspeed-generated playbook is compatible.

  • Create a remediation plan

    • The wizard in the Red Hat Lightspeed UI can help you create a remediation plan that you can access from the advisor, compliance, vulnerability, and patch service pages.

      To start the wizard and create a remediation plan, click Plan remediation after you select at least one system and one issue or recommendation for remediation. You can also create a remediation plan from the details page of a system, as long as Red Hat Lightspeed has detected issues that impact the system.

  • Decide how you want to execute your remediation plan

    • You can execute a remediation plan in Red Hat Lightspeed on directly connected Red Hat Enterprise Linux systems without additional subscriptions or tools. You can also download and run the associated playbook on your organization’s Ansible Automation Platform (AAP) workflow.

1.4. Prerequisites for remediations
Copy link

To create and execute remediation plans, you must meet the following criteria:

Subscription
Red Hat Lightspeed is included with every RHEL subscription. No additional subscriptions are required to use Red Hat Lightspeed remediation features.
User access role

By default, all Red Hat Lightspeed users automatically have access to read, create, and manage remediation plans.

  • To remediate your Red Hat Enterprise Linux systems from Red Hat Lightspeed, you also need:

    • Access to Red Hat Lightspeed on the Red Hat Hybrid Cloud Console (Hybrid Cloud Console).
    • If you are using Red Hat Satellite, you need access to Satellite-managed systems on the console or in the Satellite application UI.
    • The required Hybrid Cloud Console User Access roles for managing and executing remediation plans.
Important

All Red Hat Lightspeed users automatically have access to read, create, and manage remediation plans, but you need the Remediations administrator predefined User Access role to execute a remediation plan in Red Hat Lightspeed. Your Organization Administrator can grant User Access roles in Identity & Access Management settings on the Hybrid Cloud Console.

Remote host connectivity
To execute remediations, you must set up and enable the remote host configuration (rhc) within Red Hat Lightspeed. You will also need to permit Red Hat Lightspeed users to execute remediation playbooks on rhc-connected systems, which can be done by enabling the Remote Host Configuration Manager (rhc) setting in Red Hat Lightspeed, provided you have the required administrative permissions.

To help you get started with remediations, an interactive quick start is available in Red Hat Lightspeed on the Hybrid Cloud Console.

The Creating and executing remediation plans quick start guides you through the process in under 10 minutes and provides links to additional resources.

Prerequisites

  • You must have a Red Hat Hybrid Cloud Console account and be subscribed to the Red Hat Lightspeed services.

Procedure

  1. Log on to Red Hat Hybrid Cloud Console and then navigate to the Red Hat Lightspeed services.

  2. To access the quick start, use one of the following steps:

Manage user permissions to control access to Red Hat Lightspeed applications. Use the User Access feature to apply role-based access control (RBAC). Red Hat provides predefined groups and a set of predefined roles to make it easier for Organization Administrators to assign, restrict, and remove user permissions to Red Hat Lightspeed.

1.6.1. User Access overview
Copy link

Understand how the role-based access control (RBAC) User Access feature of the Red Hat Hybrid Cloud Console manages user permissions through roles instead of individual user assignments. User Access simplifies permission management by assigning specific permissions to roles, which can then be assigned to user groups.

You can also create custom groups and roles to provide more fine-tuned control over specific features of Red Hat Lightspeed to suit the needs of your organization.

If you are an Organization Administrator, you can use the User Access feature under Identity & Access Management in the Hybrid Cloud Console to:

  • Control user permissions and organize roles.
  • Create groups that include roles and their corresponding permissions.
  • Assign users to these groups, allowing them to inherit the permissions associated with their group’s roles.

1.6.2. Predefined groups in User Access
Copy link

Understand the two predefined groups available in User Access: Default access and Default admin access. Create custom groups to align permissions with specific personas, job functions, or teams in your organization.

The Default access group
By default, the Default access group is assigned many granular predefined roles, such as Remediations viewer and Inventory Hosts viewer, so that group members have basic visibility. Because all users in your organization are members of the Default access group, they inherit all permissions assigned to that group. The Default access group is automatically updated by Red Hat.
Important

If your Organization Administrator modifies the Default access group, for example, by removing roles to restrict access to specific applications or to use the consolidated roles, the group is automatically renamed to Custom default access. Once converted, this group is no longer automatically updated by Red Hat.

The Default admin access group
The Default admin access group contains only users who have Organization Administrator permissions. This group is automatically maintained, and users and roles in this group cannot be changed.

The Default admin access group includes many (but not all) predefined roles that provide update and delete permissions. The roles in this group usually include administrator in their names.

1.6.3. Predefined roles assigned to groups
Copy link

Understand how predefined roles in Red Hat Hybrid Cloud Console bundle permissions across multiple Red Hat Lightspeed applications to align with common user personas. Use predefined roles to reduce administrative effort, or create custom roles for more fine-tuned control over specific features.

The predefined roles are a starting point to help you to control and manage user permissions. You can then use these roles to create custom roles that are tailored to your specific use cases and organization. For example, you can use the predefined granular roles to create custom roles that provide more fine-tuned control over specific features of Red Hat Lightspeed.

By default, Red Hat provides a set of consolidated roles and a set of granular roles in the Red Hat Hybrid Cloud Console User Access UI. The consolidated roles significantly reduce the administrative effort required to manage user permissions, while the granular roles provide more fine-tuned control over specific features of Red Hat Lightspeed.

You can use the predefined consolidated and granular roles in User Access simultaneously, but using consolidated roles can significantly reduce the administrative effort.

Select from the predefined consolidated roles library

The Red Hat Hybrid Cloud Console provides three predefined, consolidated User Access roles to help you manage user permissions to Red Hat Lightspeed applications and services that run on registered Red Hat Enterprise Linux systems. These roles help simplify how the Organization Administrator creates groups and permissions for various levels of access to the Red Hat Lightspeed services. If you want to reduce the administrative effort required to manage user permissions and your use case aligns with the permissions included in these roles, select from the consolidated roles library.

The consolidated roles are as follows:

RHEL viewer: The RHEL viewer role provides users visibility without the ability to make changes. It allows read-only access to Red Hat Lightspeed. You can view system configurations, compliance reports, inventory data, patch information, vulnerabilities, and overall resource states and activities. The only action permitted with this role is to generate activation keys.

RHEL operator: The RHEL operator role allows active management of your Red Hat Lightspeed environment. With this role, you can edit system configurations, inventory details, policies, and notification/integration settings. The RHEL operator role allows many of the RHEL administrator role functions, but it is restricted from editing compliance policies, content source templates, policies, or tasks. In addition, the RHEL operator role cannot execute remediation plans.

RHEL administrator: The RHEL administrator role provides comprehensive administrative privileges across your RHEL systems and Red Hat Lightspeed. With this role, you can manage system configurations, inventory, compliance policies, notifications, patch management, remediations, malware detection, and advisor recommendations. The role can also view and modify all vulnerability settings.

Important

To use the consolidated roles effectively, you might need to remove the granular RHEL roles from the Default access group to prevent permission conflicts. This action automatically changes the name of the predefined Default access group to Custom default access group, after which, it is no longer automatically updated by Red Hat.

See Predefined User Access roles for a list of the roles included in the Default admin access group and a reference table that lists most of the predefined groups and roles that are available in the Red Hat Hybrid Cloud Console and the permissions included in each role.

Granular roles
The granular roles are specific roles for individual services that allow for fine-tuned control over specific features of Red Hat Lightspeed, for example, Inventory Hosts administrator or Compliance viewer. If you want to have more control over specific features of Red Hat Lightspeed and your use case does not align with the permissions included in the consolidated roles, use the granular predefined roles.
Tip

Across the Red Hat Lightspeed product documentation, the Prerequisites section for each procedure lists which predefined roles provide the permissions needed to use the features in that procedure. For example, if a procedure requires permissions to view and manage remediations, the Prerequisites section for that procedure lists the Remediations administrator or other valid role as a recommended predefined role to use for that procedure.

1.6.4. Check your permissions
Copy link

Verify your current permissions and the roles or groups assigned to you in the Red Hat Hybrid Cloud Console. Check your permissions to troubleshoot access issues or understand your level of access to Red Hat Lightspeed applications.

Note

Only users with the Organization Administrator role can view the permissions of other users in the User Access settings and manage user permissions to Red Hat Lightspeed services. For more information, see the Configure user permissions section.

Prerequisites

  • You are logged in to the Red Hat Hybrid Cloud Console.

Procedure

  1. In the Hybrid Cloud Console, click the Settings icon (⚙), then navigate to My User Access.
  2. Optional: If you require additional permissions, use the Red Hat Hybrid Cloud Console Virtual Assistant to ask "Contact my Organization Administrator". The assistant sends an email to the Organization Administrator on your behalf.

Results

All of the applications that you have permissions to access are listed on this page and are grouped by product, for example, RHEL, OpenShift Container Platform, and Ansible Automation Platform.

You can also filter your permissions by application, for example, by advisor, cost management, inventory, and remediations.

1.6.5. Configure user permissions
Copy link

If you are an Organization Administrator, you can view and manage user permissions for all users in your organization. Control access to Red Hat Lightspeed and other Red Hat Hybrid Cloud Console services through the User Access interface.

Important

If you are not an Organization Administrator, you will be unable to complete this task. However, you can check your own permissions for different applications by navigating to My User Access. Contact your Organization Administrator to request more permissions.

Prerequisites

  • You have logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator, or you have the required administrator User Access role permissions.

Procedure

Results

From here, you can create and manage:

  • Roles to determine permissions to Red Hat Lightspeed services and features
  • Groups to include one or more roles to align with a specific persona, job function, or team in your organization
  • Users and their assignment to groups to inherit permissions from the roles assigned to those groups

Understand the predefined roles that control permissions to view, create, and execute remediation plans on your RHEL systems. Use these role definitions to assign appropriate permissions to users based on their responsibilities.

To remediate issues on your RHEL systems, become familiar with the roles that provide the required access permissions for creating, managing, and executing remediation plans in Red Hat Lightspeed.

The following User Access roles provide standard or enhanced access to remediation features in Red Hat Lightspeed:

Expand
Table 1.1. Permissions provided by the User Access roles
User Access roleGrants permissions to …​Included in the Default access group

Remediations administrator

  • Do everything that a Remediations user can do.
  • Execute remediation plans on connected remote host systems from within Red Hat Lightspeed.
 

Remediations user

  • View existing remediation plans.
  • Create a remediation plan.
  • Delete a remediation plan.

X

RHEL administrator

  • Do everything that a RHEL operator can do.
  • Administer RHEL system configs, inventory, compliance, notifications, patch management, execute remediation plans, malware detection, and advisor.
  • View and modify vulnerability settings.
 

RHEL operator

  • Do everything that a RHEL viewer can do.
  • Edit system configs, inventory, policies, notifications, and integrations.
  • View compliance reports, patch info, malware detections, and recommendations.
  • Create remediation plans, manage stale data, and change vulnerability settings.
Note

The RHEL operator role is restricted from editing compliance policies, content source templates, policies, or tasks. Also, the RHEL operator role cannot execute remediation plans.

 

RHEL viewer

  • Read all available data across Red Hat Lightspeed services and features.

    • View system configs, compliance reports, inventory data, patch info, vulnerabilities, and more to observe the state of resources or activities.
Note

Cannot perform actions other than generating activation keys.

 

For more information about user access and permissions, see User Access configuration guide for role-based access control (RBAC).

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top