9장. Security hardening and compliance of bootable images

Procedure

1. Create a Containerfile:

   FROM registry.redhat.io/rhel10/rhel-bootc:latest
   
   # Install OpenSCAP scanner and security content to the image
   RUN dnf install -y openscap-utils scap-security-guide && dnf clean all
   
   # Run scan and hardening
   RUN oscap-im --profile <profile_ID> /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml
   
   # Because certain profiles prevent ssh root logins, add a separate sudo user with a password
   # Alternatively, you can add users with Kickstart, cloud-init, or other methods
   RUN useradd -G wheel -p "<password_hash>" <admin_user>

   Replace <admin_user> with the user name and <password_hash> with the hash of the selected password.

   This Containerfile performs the following tasks:

   • Installs the openscap-utils package that provides the oscap-im tool and the scap-security-guide package that provides the data streams with the Security Content Automation Protocol (SCAP) content.
   • Adds a user with sudoer privileges for profiles that prevent SSH root logins.
   • Scans and remediates the image for compliance with the selected profile.

2. Build the image by using the Containerfile in the current directory:

   $ podman build -t quay.io/<namespace>/<image>:<tag> .