5.5. Customizing a security profile with autotailor

Procedure

1. Create a tailoring file for your profile by using the autotailor command, for example:

   $ autotailor \ --select=<rule_ID_1> \ --select=<rule_ID_2> \ --unselect=<rule_ID_3> \ --var-value=<value_ID_1>=<value_1> \ --var-value=<value_ID_2>=<value_2> \ --output=<tailoring.xml> \ --tailored-profile-id=<custom_profile_ID> \ /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml <profile_ID>

   Where:

   • <customization_options> are the modifications of the profile. Use one or more of the following options:

     --select=<rule_ID>

     Add an existing rule to the profile.

     --unselect=<rule_ID>

     Remove a rule from the profile.

     --var-value=<value_ID>=<value>

     Override a pre-set value. For example, to set var_sshd_max_sessions to 10, use --var-value=var_sshd_max_sessions=10.

   • <tailoring.xml> is the file name where autotailor saves the tailoring.
   • <custom_profile_ID> is the profile ID within which the autotailor saves customizations, for example, custom_cis.
   • <profile_ID> is the profile ID with which the system should comply, for example, cis.
   참고

   For all profile, rule, and variable XCCDF IDs, you can use either a full namespaced identifier or a shortened ID that autotailor automatically augments with the namespace prefix. For example, cis is equivalent to xccdf_org.ssgproject.content_profile_cis.

   You can override the default namespace org.ssgproject.content by using the --id-namespace option.

2. Optional: Create a tailoring file based on the customizations defined in the JSON Tailoring format:

   $ autotailor --output=<tailoring.xml> --json-tailoring=<json_tailoring.json>

   Replace <json_tailoring.json> with the file name with JSON Tailoring definitions.

   참고

   You can mix --json-tailoring with --select, --unselect, and --var-value command-line customizations. In that case, command-line customizations have priority over JSON Tailoring.