redhatgov / ssg-el7-kickstart Goto Github PK
View Code? Open in Web Editor NEWDVD embedded Kickstart for RHEL 7 utilizing SCAP Security Guide (SSG) as a hardening script.
License: Other
DVD embedded Kickstart for RHEL 7 utilizing SCAP Security Guide (SSG) as a hardening script.
License: Other
############################################################################### # SCAP Security Guide RHEL 7 DVD CREATOR # # This script was written by Frank Caviggia, Red Hat Consulting # Last update was 6 August 2017 # This script is NOT SUPPORTED by Red Hat Global Support Services. # # Author: Frank Caviggia ([email protected]) # Copyright: Red Hat, (c) 2015 # License: Apache License, Version 2.0 # Description: Kickstart Installation of RHEL 7 with SCAP Security Guide (SSG) ############################################################################### ABOUT ===== Modifies a RHEL 7.4+ x86_64 Workstation or Server DVD with a kickstart that will install a system that is configured and hardened for Red Hat Enterprise Linux 7. NOTE: ROOT ACCOUNT IS LOCKED WITH INSTALL USE 'admin' ACCOUNT WITH 'sudo' INSTEAD. The kickstart script involves the integration of the following projects into a single installer: - classification-banner.py (Python for displaying a graphical classification banner) https://github.com/RedHatGov/classification-banner - SCAP Security Guide (SSG) Content - Benchmark and hardening scripts for the system after installation https://github.com/OpenSCAP/scap-security-guide CONTENT ======= createiso.sh - installation script to modify RHEL 7.4+ ISO image /config - Kickstarts, Python, and RPMs needed to modify image. EFI/BOOT/ grub.cfg - Menu Configuration for UEFI boot isolinux/ isolinux.cfg - Menu Configuration for Kickstart hardening/ ssg-rhel.cfg Kickstart Configuration (Calls menu.py in %pre) menu.py Python Script that presents a graphical menu to modify the kickstart. Contains the "Profiles" for configuring the system partitioning and packages. classification-banner.py Graphical Classification Banner (for GNOME Desktops User/ Developer Workstation Profiles) openscap*.rpm scap-security-guide-*.el7.noarch.rpm Uses OpenSCAP and the SCAP Security Guide (SSG) to test and remediate system. ssg-suplemental.sh Additional system lockdowns (FIPS 140-2 Kernel Mode, GNOME, wheel group for root access, etc.) rhevm-preinstall.sh rhevm-postinstall.sh Scripts to loosen settings temporarily to allow registration of the system with RHEV-M by allowing root login and allowing exec in /tmp. Run rhevm-postinstall.sh after system is added into RHEV-M. Copied to /root after kickstart install iptables.sh (use with KVM host - which prefers iptables/ebtables) Configures iptables firewall during kickstart installation. Called in menu.py script. Firewall is configured to recommended ports for each product or profile. Copied to /root after kickstart install. FirewallD is default except for KVM systems. ipa-pam-configuration.sh Configures system for using IPA/IdM authentication by overwriting the pam.d configurations. Copied to /root after kickstart installation usbguard-*.x86_64.rpm USB guard will control what USB devices are accessible by the system. HARDENING INFORMATION ===================== Here is some additional information added by the supplemental hardening script in addition to the SSG: 1. The kernel option for FIPS 140-2 mode is contained on the kickstart menu 2. Shell timeout (bash/csh) is 15 minutes of inactivity, vlock will lock CLI console 3. The 'wheel' group is required for privileged users (beyond root) to run `su -` or `sudo -i` commands, sudo timeout is 5 minutes 4. The 'sshusers' group is required for SSH/SFTP access, other users are limited to console access without this group 5. Additional Software such as McAfee EPo/HBSS may be required meet site policy 6. Configure PTP or NTP for time synchronization (/etc/chrony.conf or /etc/ntp.conf) 7. Configure rsyslog to send logs to a centralized log monitoring. (/etc/rsyslog.conf) 8. Create users: NOTE: The root user is locked now - use 'admin' user account with sudo instead of root. Local Console Access Only (Unprivileged) # useradd -m -c "Local User" localuser Remote Access (Unprivileged) # useradd -m -c "Remote User" -G sshusers remoteuser System Administrator (SA) (Privileged User) # useradd -m -c "System Administrator" -G sshusers,wheel admin 9. Wireless is disabled in a number of ways with Network Manager including: a.) `nmcli radio all off` command in /etc/rc.local b.) Dconf configurations to disable the creation of wireless networks: /etc/dconf/db/gdm.d/99-gnome-hardening [org.gnome.nm-applet] disable-wifi-create=true /etc/dconf/db/gdm.d/locks/99-gnome-hardening /org/gnome/nm-applet/disable-wifi-create /usr/share/glib-2.0/schemas/99_custom_settings.gschema.override [org.gnome.nm-applet] disable-wifi-create=true Generally, wireless should not be used on a DoD/IC system. EXAMPLE ======= # ./createiso.sh rhel-server-7.1-x86_64-dvd.iso Mounting RHEL DVD Image... mount: /dev/loop0 is write-protected, mounting read-only Done. Copying RHEL DVD Image... Done. Modifying RHEL DVD Image... Done. Remastering RHEL DVD Image... I: -input-charset not specified, using utf-8 (detected in locale settings) Using RELEA000.HTM;1 for /RELEASE-NOTES-ja-JP.html (RELEASE-NOTES-ta-IN.html) <..........................................> Using POLIC003.RPM;1 for ./Packages/policycoreutils-python-2.0.83-19.39.el6.x86_64.rpm (policycoreutils-newrole-2.0.83-19.39.el6.x86_64.rpm) Size of boot image is 4 sectors -> No emulation 0.27% done, estimate finish Tue Jan 21 22:04:41 2014 <...........................................> 99.86% done, estimate finish Tue Jan 21 22:06:46 2014 Total translation table size: 976326 Total rockridge attributes bytes: 430528 Total directory bytes: 661504 Path table size(bytes): 286 Max brk space used 3ee000 1882600 extents written (3676 MB) Done. Signing RHEL DVD Image... Inserting md5sum into iso image... md5 = ec4618f4ccc6ccac3cfed291ef341012 Inserting fragment md5sums into iso image... fragmd5 = e115ca49531d6adfee6caadeaf6a895cdc4c3e8b9341f58f5e11e9113a79 frags = 20 Setting supported flag to 0 Done. DVD Created. [ssg-rhel-7.1.iso]
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.