5.4. Performing a hardened installation of RHEL with Kickstart

Procedure

1. Find the ID of the security profile from the data stream file:

   $ oscap info /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml
   Profiles:
   …
     Title: Australian Cyber Security Centre (ACSC) Essential Eight
   	Id: xccdf_org.ssgproject.content_profile_e8
     Title: Health Insurance Portability and Accountability Act (HIPAA)
   	Id: xccdf_org.ssgproject.content_profile_hipaa
     Title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 10
   	Id: xccdf_org.ssgproject.content_profile_pci-dss
   …

2. Optional: If you want to customize your hardening with XCCDF Tailoring file you can use the autotailor command provided in the openscap-utils package. For more information, see Customizing a security profile with autotailor.

3. Generate the Kickstart file from the SCAP source data stream:

   $ oscap xccdf generate fix --profile <profile_ID> --output <kickstart_file>.cfg --fix-type kickstart /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

   + Replace <profile_ID> with the profile ID with which the system should comply, for example, hipaa.

   + If you are using a tailoring file, embed the tailoring file into the generated Kickstart file by using the --tailoring-file tailoring.xml option and your custom profile ID, for example:

   +

1. Review and, if necessary, manually modify the generated <kickstart_file>.cfg to fit the needs of your deployment. Follow the instructions in the comments in the file.

   참고

   Some changes might affect the compliance of the systems installed by the Kickstart file. For example, some security policies require defined partitions or specific packages and services.

2. Use the Kickstart file for your installation. For the installation program to use the Kickstart, the Kickstart can be served through a web server, provided in PXE, or embedded into the ISO image. For detailed steps, see the Semi-automated installations: Making Kickstart files available to the RHEL installer chapter in the Automatically installing RHEL document.
3. After the installation finishes, the system reboots automatically. After the reboot, log in and review the installation SCAP report saved in the /root directory.