Red Hat Lightspeed remediations guide

Procedure

1. Log on to Red Hat Hybrid Cloud Console and then navigate to the Red Hat Lightspeed services.

2. To access the quick start, use one of the following steps:

   • From within the Red Hat Lightspeed application: Go to Automation Toolkit > Remediation Plans, and then click Launch Quick Start in the upper right corner.
   • From the Quick starts library: Go to RHEL Learning Resources.

Procedure

1. To connect rhc on RHEL 8.5 systems, use the following commands:

   # subscription-manager repos --enable ansible-2.9-for-rhel-8-x86_64-rpms
   # dnf -y install ansible rhc-worker-playbook-0.1.5-3.el8_4
   # rhc connect

   Copy to Clipboard Toggle word wrap

   Note, remote host configuration on RHEL 8.5 has dependencies on ansible and rhc-worker-playbook. To install the dependencies, you must first register with Subscription Manager.

2. To connect rhc on RHEL8.6 and later systems, use the following commands:

   # dnf -y update rhc
   # dnf -y install rhc-worker-playbook
   # rhc connect

   Copy to Clipboard Toggle word wrap

3. To connect rhc on RHEL9.0 and later systems, use the following commands:

   # dnf -y install rhc rhc-worker-playbook
   # rhc connect

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to Remote Host Configuration Manager.
2. Under Permission, set the option Allow permitted Red Hat Lightspeed users to execute remediation playbooks on rhc-connected systems to Enabled.
3. Click Save changes.

Procedure

1. Navigate to Automation Toolkit > Remediation Plans.
2. On the Remediation Plans page, choose a remediation plan that includes the system you are interested in checking. The General tab opens.
3. Open the Systems tab, and locate the system in the table.

4. Check the Connection Status value for the system.

   Note, if the Connection Status value is Unknown, this means that you do not have the correct User Access permissions to view the status.

Procedure

1. In the Red Hat Hybrid Cloud Console, navigate to Red Hat Hybrid Cloud Console > the Settings icon (⚙) > Service Accounts.

2. Create a token-based service account, or select an existing service account. For more information about creating service accounts, see Creating a service account.

   Important

   If you create a new service account, make sure to save the Client ID and Client secret to a safe location. If you select an existing service account, ensure that you have access to the Client ID and Client secret.

3. Create a User Access group to associate to the service account, or assign the service account to an existing User Access group that has the required permissions. For more information about creating User Access groups, see Managing group access with roles and members.

4. Assign the following permissions to the group, if the group does not already have them. For more information about how to add roles and permissions to a User Access group, see Adding a role to a group.

   • inventory:hosts:read (included in the Inventory Hosts viewer role)
   • patch:*:read* (included in the Patch viewer role)

   • remediations:remediation:read and playbook-dispatcher:run:read (included in the Remediations User role)

     Note

     You can also grant the RHEL viewer role to the service account in the User Access group. The RHEL viewer role includes the correct permissions for inventory:hosts:read and remediations:remediation:read.

     For more information about assigning a service account to a User Access group, see Adding service accounts to a User Access group.

     Note

     If your organization uses Workspaces, ensure that your User Access group has the necessary permissions for full visibility into your inventory in AAP. For more information about workspaces, see Workspaces.

Procedure

1. Create a new credential in AAP. The Create credential screen displays. For more information about how to create and configure credentials in AAP, see Creating Red Hat Insights credentials.
2. In the Credential Type drop-down menu, select Insights as the credential type.
3. Paste the Client ID and Client secret for the service account into the respective fields in the Type Details section.
4. Click Create credential.

1. Find an issue to resolve
2. Review the recommended remediation steps
3. Select the systems to remediate

Procedure

1. Choose a Red Hat Lightspeed advisor service recommendation to remediate:

   1. Navigate to Operations > Advisor > Recommendations.
   2. Review the Recommendations table to see which recommendations are applicable for your systems and whether they have a playbook already created.

   3. Use the search and filtering function in the table to sort the items by Resolution type.

      Important

      Look for recommendations that have a Resolution type of Playbook. You cannot create a remediation plan if the Resolution type is set to Manual.

   4. Click the recommendation name. The full details of the recommendation are displayed, and a list of impacted systems is displayed on the lower part of the page.

2. Select which systems to include in the remediation plan:

   1. Scroll to view all of the registered RHEL systems that are impacted by the recommendation.

   2. Find the systems to include. If needed, use the search and filter functions in the table. For example, you can use the filtering options to list the affected systems by version.

      Important

      To create a remediation plan for a group of systems, all systems in the group must be running the same RHEL major and minor versions to ensure that the resolution applied by the Red Hat Lightspeed-generated playbook is compatible.

   3. Select at least one system to include in a remediation plan by clicking the checkbox to the left of the system ID.

3. Create and save the plan:

   1. Click Plan remediation to start the wizard.

   2. Select Create new playbook, and enter a name for the playbook.

      Note

      You can also add this recommendation or the selected systems to an existing remediation plan by choosing Add to existing playbook, and then selecting the plan name from the list presented.

   3. Under Review systems, review the systems included in the plan, and if applicable, clear the checkbox next to any systems that you do not want to include.
   4. Click Next.

   5. Under Review and edit actions, review the resolution steps for the action. Some actions will present different steps that you can choose from in the wizard. Complete one of the following steps:

      • If the action has a choice of methods to remediate:

        • Select Review and/or change the resolution steps for this 1 action, and click Next.
        • Choose one of the step choices, and click Next.
      • If there are no choices to be made and you are satisfied with the actions for this plan, select Accept all recommended resolution steps for all actions, and then click Next.

4. On the Remediation review pane, review the summary of your remediation plan and use the back button to make changes if needed.

   Note

   If a reboot is required to fix the issue or risk, all systems in the remediation plan will be automatically rebooted. If you prefer to reboot manually after the plan has been executed, toggle the Auto-reboot button accordingly.

5. Click Submit.

Verification

1. Navigate to Automation Toolkit > Remediation Plans.
2. Search for your remediation plan in the table and click its name to open the plan.

Procedure

1. Navigate to the Security > Vulnerability > CVEs page.
2. Set the filters as needed and select a CVE.
3. Scroll down to view all of the affected systems. Use the filtering options to list the affected systems by version.

4. Select systems to include in a remediation plan by clicking the box to the left of the system ID.

   Important

   To create a remediation plan for a group of systems, all systems in the group must be running the same RHEL major and minor versions to ensure that the resolution applied by the Red Hat Lightspeed-generated playbook is compatible.

5. Click Plan remediation.

6. Choose whether to add the remediations to an existing or new remediation plan, and then do one of the following actions, and then click Next:

   • Click Add to existing playbook, and then select a remediation plan from the list presented.
   • Click Create new playbook, and enter a name for the playbook.

7. Review the systems to include in the remediation plan, then click Next.

   Note

   Only affected systems can be selected and included in a remediation plan.

8. Review the information under the remediation review summary.

   1. If a reboot is required to fix the issue or risk, all systems in the remediation plan will be automatically rebooted. If you prefer to reboot manually after the plan has been executed, toggle the Auto-reboot button accordingly.
   2. Click Submit.

Verification

1. Navigate to Automation Toolkit > Remediation Plans.
2. Search for your remediation plan. You should see the plan that you just created showing in the list.

Procedure

1. Navigate to Security > Vulnerability > CVEs.

2. Set filters if needed (for example, filter to see CVEs with security rules to focus on issues that have elevated risk associated with them). Or, click the CVEs with security rules tile on the dashbar.

   

3. Click a CVE in the list.

4. Scroll to view affected systems, and select the systems you want to include in a remediation plan by clicking the box to the left of the system ID on the Review systems page. When you select at least one system, the Plan remediation button gets activated.

   Note

   Recommended: Include systems of the same RHEL major or minor version by filtering the list of affected systems.

5. Click Plan remediation.

6. Decide whether to add the selected remediations to an existing or new remediation plan by taking one of the following actions:

   • Click Add to existing playbook and select the required playbook from the dropdown list.
   • Click Create new playbook, and add a playbook name.

7. Click Next. The systems impacted by the CVE are listed.

   Note

   Only impacted systems can be selected and included in a remediation plan.

8. Review the systems to include in the playbook and clear the checkbox beside any systems that you do not want to include.

9. Click Next to see the Review and edit actions page, which shows you options to remediate the CVE. The number of items to remediate can vary. You will also see additional information (that you can expand and collapse) about the CVE, such as:

   • Action: Shows the CVE ID.
   • Resolution: Displays the recommended resolution for the CVE and also confirms whether you have alternate resolution options.
   • Reboot required: Confirms whether you must reboot your systems.
   • Systems: Confirms the number of systems you are remediating.

10. On the Review and edit actions page, choose one of two options to finish creating your remediation plan and to generate the Ansible Playbook:

    • Option 1: To review all of the recommended and alternative remediation options available (and choose one of those options):

      1. Select Review and/or change the resolution steps for this 1 action or similar based on your actual options.
      2. Click Next.
      3. On the Choose action: <CVE information> page, click a tile to select your preferred remediation option. The bottom edge of the tile highlights when selected. The recommended solution is highlighted by default.
      4. Click Next.

    • Option 2: To accept all recommended remediations:

      1. Choose Accept all recommended resolution steps for all actions.
      2. Click Next.

11. On the final Remediation review pane, review the summary of your remediation plan and use the back button to make changes to the actions or resolution options if required.

    Note

    If a reboot is required to fix the issue or risk, all systems in the remediation plan will be automatically rebooted. If you prefer to reboot manually after the plan has been executed, toggle the Auto-reboot button accordingly.

12. Click Submit.

1. Navigate to Automation Toolkit > Remediation Plans.
2. Search for your remediation plan.
3. To execute your remediation plan and run the generated Ansible Playbook on the affected systems, see Executing remediation playbooks from the Red Hat Lightspeed UI.

Procedure

1. Navigate to Automation Toolkit > Remediation Plans.
2. Select the checkbox next to the name of the remediation plan you want to download.

3. Complete one of the following steps:

   • To download a single remediation plan, go to the end of the row, click More options > Download.
   • To download multiple remediation plans in bulk, click the Download button at the top of the table.

Procedure

1. Navigate to Automation Toolkit > Remediation Plans.
2. In the table, find the plan you want to delete.
3. At the end of the row, click the More options icon, and then click Delete.
4. When prompted, click Delete to confirm the permanent removal of the plan.

Procedure

1. Navigate to Automation Toolkit > Remediation Plans.
2. In the table, find the plan you want to rename.
3. At the end of the row, click the More options icon, and then click Rename.
4. When prompted, enter a unique title for the plan name and click Rename.

Procedure

1. Navigate to Automation Toolkit > Remediation Plans.
2. In the table, find the plan that you want to monitor.

3. Click the name of the remediation plan to open the Plan details and status card on the General tab. The latest execution status of the remediation plan is displayed.

   Note

   A status of N/A indicates that the remediation plan has not yet been executed from within Red Hat Lightspeed.

4. Optional: Go to the Execution History tab to view the progress or status status of the execution on each individual system included in the plan including links to more detailed execution activity logs.

Procedure

1. Navigate to Automation Toolkit > Remediation Plans.
2. Scroll through the list and find a remediation plan.
3. Click the name to open the Remediation plan details view.

4. Click Execute.

   Important

   If the Execute button is disabled, this means that the execution readiness check failed because one of the requirements was not met. To help you troubleshoot and complete the execution readiness check successfully, see Execution readiness check.

5. When prompted, click Execute playbook on systems. The playbook runs on the systems included in the remediation plan.

   Note, that a remediation plan with a large number of actions to execute on many systems might take a while to complete.

Procedure

1. To remediate a recommendation on RHEL systems managed by Red Hat Satellite, see Remediating issues based on Red Hat Lightspeed recommendations in the Satellite Managing hosts documentation.

   Important

   When you introduce a new host into your Satellite inventory, by means of provisioning or registration, two automatic background tasks will initiate. It will take 24 hours for these tasks to complete. This is a typical time frame for the automatic synchronization.

   If you identify security issues or another scenario that warrants not waiting 24 hours for the automatic sync, you can manually synchronize by clicking the sync button in the UI. This manual sync will complete in a few minutes.

2. To view the procedures for enabling automatic and manual synchronization, see the Configuring Synchronization of Red Hat Lightspeed Recommendations for Hosts in the Satellite documentation.

Procedure

1. Install the insights-client:

   # yum install insights-client

   Copy to Clipboard Toggle word wrap

2. Register the host to Red Hat Lightspeed:

   # insights-client --register

   Copy to Clipboard Toggle word wrap
3. Repeat these steps on each host.
4. Alternatively, you can use the RedHatInsights.insights-client` Ansible role to install the insights-client and register the hosts. For more information, see Monitoring hosts by using Red Hat Lightspeed in the Red Hat Satellite Managing Hosts guide.

Procedure

1. Go to Hosts menu → All Hosts in the Satellite web UI.
2. Locate the host, and click Edit → Parameters.
3. Set the enable_cloud_remediations parameter to False.

Procedure

1. Navigate to the Satellite Dashboard.
2. Click Configure → Global Parameters → Create Parameter.
3. In the Name field, enter enable_cloud_remediations.
4. In the Value field, enter false.
5. Click Submit.