8.2. Creating a pre-hardened image with RHEL image builder

Procedure

1. Create a hardening blueprint in the TOML format, using the OpenSCAP tool and scap-security-guide content, and modify it if necessary:

   # oscap xccdf generate fix --profile=<profileID> --fix-type=<blueprint> /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml > cis.toml

   Replace <profileID> with the profile ID that the system should comply with, for example, cis.

2. Start the build of hardened image:

   # image-builder build <image_type> --blueprint <blueprint_name>

   Replace <image_type> with any image type, for example, qcow2.

   After the image build is ready, you can use your pre-hardened image on your deployments. See Creating a virtual machine from a KVM guest image.