Appendix F. Securing Red Hat Virtualization

This information is specific to Red Hat Virtualization. It does not cover fundamental security practices related to any of the following:

Prerequisites

You should be proficient in your organization’s security standards and practices. If possible, consult with your organization’s Security Officer.
Consult the Red Hat Enterprise Linux Security hardening before deploying RHEL hosts.

F.1. Applying the DISA STIG profile in RHEL based hosts and the standalone Manager

When installing RHV, you can select the DISA STIG profile with the UI installer, which is the profile provided by RHEL 8.

Important

The DISA STIG profile is not supported for Red Hat Virtualization Host (RHVH).

Procedure

In the Installation Summary screen, select Security Policy.
In the Security Policy screen, set the Apply security policy to On.
Select DISA STIG for Red Hat Enterprise Linux 8.
Click Select profile. This action adds a green checkmark next to the profile and adds packages to the list of Changes that were done or need to be done. Follow the onscreen instructions if they direct you to make any changes.
Click Done.
On the Installation Summary screen, verify that the status of Security Policy is Everything okay.
Reboot the host.

You can enable DISA STIG in a self-hosted engine during deployment when using the command-line.

Procedure

Start the self-hosted engine deployment script. See Installing Red Hat Virtualization as a self-hosted engine using the command line.
When the deployment script prompts Do you want to apply an OpenSCAP security profile?, enter Yes.
When the deployment script prompts Please provide the security profile you would like to use?, enter stig.

When installing RHVH, you can select the PCI-DSS profile with the UI installer, which is the profile provided by RHEL 8.

Procedure

In the Installation Summary screen, select Security Policy.
In the Security Policy screen, set the Apply security policy to On.
Select PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8.
Click Select profile. This action adds a green checkmark next to the profile and adds packages to the list of Changes that were done or need to be done. Follow the onscreen instructions if they direct you to make any changes.
Click Done.
In the Installation Summary screen, verify that the status of Security Policy is Everything okay.
Reboot the host.

You can enable PCI-DSS in a self-hosted engine during deployment when using the command-line.

Procedure

Start the self-hosted engine deployment script. See Installing Red Hat Virtualization as a self-hosted engine using the command line.
When the deployment script prompts Do you want to apply an OpenSCAP security profile?, enter Yes.
When the deployment script prompts Please provide the security profile you would like to use?, enter pci-dss.