Kickstart with SSG/fixes and More

Greg Elin gregelin at gitmachines.com
Fri May 15 02:15:24 UTC 2015


All,

This is really helpful! Thank you.  







Greg Elin
P: 917-304-3488
E:  gregelin at gitmachines.com

Sent from my iPhone

> On May 14, 2015, at 3:45 PM, Ted Brunell <tbrunell at redhat.com> wrote:
> 
> Greg,
> 
> As others have pointed out, the work that was done in kickstart that I put together has been superseded and should be used now in lieu of the kickstart that I created 2 years ago.
> 
> That being said...  The work itself was actually part of building a custom install DVD for RHEL 6 so that the system was more or less locked down before it ever rebooted.  The guts of the workflow (found in the %post section) was:
> 
> # Install SSG
> yum localinstall -y /tmp/scap-security-guide-0.1-14.el6.noarch.rpm
> 
> # Scan using SSG and save the results as HTML
> cd /root
> oscap xccdf eval --profile stig-rhel6-server --results BeforeFix-ssg-results.xml --report BeforeFix-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> 
> # Generate Fix Script
> oscap xccdf generate fix --result-id xccdf_org.open-scap_testresult_stig-rhel6-server BeforeFix-ssg-results.xml > /root/fix.sh
> 
> # Run Fix Script
> chmod +x fix.sh
> /bin/bash /root/fix.sh
> 
> # Re-Scan Server and save another report 
> oscap xccdf eval --profile stig-rhel6-server --results AfterFix-ssg-results.xml --report AfterFix-ssg-results.html --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> 
> 
> I hope that helps.
> 
> R/
> Ted
> 
> Ted Brunell - RHCDS, RHCE, RHCVA
> Senior Solution Architect
> DoD Cloud Specialist
> Red Hat, Inc.
> (c) 760-712-6837
> tbrunell at redhat.com
> 
> ----- Original Message -----
> From: "Frank Caviggia" <fcaviggi at redhat.com>
> To: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
> Sent: Thursday, May 14, 2015 11:29:14 AM
> Subject: Re: Kickstart with SSG/fixes and More
> 
> Greg,
> 
> Also feel free to check out:
> 
>  https://github.com/RedHatGov/ssg-el6-kickstart
> 
> It will re-master a RHEL 6 DVD into an SSG installer.
> 
> Regards,
> 
> Frank Caviggia
> 
> -- 
> Frank Caviggia
> Senior Consultant, Red Hat
> fcaviggi at redhat.com
> (M) (571) 295-4560
> 
> 
> ----- Original Message -----
> From: "Martin Preisler" <mpreisle at redhat.com>
> To: "Greg Elin" <gregelin at gitmachines.com>
> Cc: "SCAP Security Guide" <scap-security-guide at lists.fedorahosted.org>
> Sent: Thursday, May 14, 2015 11:00:18 AM
> Subject: Re: Kickstart with SSG/fixes and More
> 
> ----- Original Message -----
>> From: "Greg Elin" <gregelin at gitmachines.com>
>> To: scap-security-guide at lists.fedorahosted.org, "Ted Brunell" <tbrunell at redhat.com>
>> Sent: Thursday, May 14, 2015 4:29:46 PM
>> Subject: RE: Kickstart with SSG/fixes and More
>> 
>> Ted,
>> 
>> I was googling about and came across a 2013 email to SSG list regarding
>> kickstart with SSG fixes?
>> 
>> Can we get you to share that again? Thanks!
>> 
>> http://marc.info/?l=scap-security-guide&m=138031105712558&w=2
> 
> SSG has recently started shipping kickstarts, check out
> https://github.com/OpenSCAP/scap-security-guide/tree/master/RHEL/6/kickstart
> 
> -- 
> Martin Preisler
> Security Technologies | Red Hat, Inc.
> -- 
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
> 
> -- 
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
> -- 
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/


More information about the scap-security-guide mailing list