Hi all, Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way?
-Rob
Have you tried doing a manual install using the SCAP hardening in the install menu, and then stealing the code from the resulting anaconda.cfg that is generated in /root?
From: Robert Sanders [mailto:rsanders@forcepoint.com] Sent: Friday, February 10, 2017 2:48 PM To: scap-security-guide@lists.fedorahosted.org Subject: EXTERNAL: Kickstart from floppy wth SCAP and tailoring
Hi all, Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way?
-Rob
Yep, that's where I started, just making sure I could get a hardened image at install. But you can't (at least I didn't see a place on my RHEL7.3 box) to make changes to the selection of profiles included with the install RPM. I can bring up scap-workbench on a live box and make my changes there, and I was hoping to grab that customization and use it for the 'tailoring-path' option in the '%addon org_fedora_oscap' section. Anaconda yowls after installing stuff that it can't find the file. At the point where the error occurred it doesn't look like the floppy is mounted at all. This is my first dive into using kickstarts/anaconda like this and I'm not sure it is possible our of the box. I'm considering two workarounds -
1) Remaster the RHEL7.3 install ISO to include a new RPM with my customization tucked into the correct location 2) Standup a webserver to supply a datastream or archive of the desired profile, with my tailoring, and reference that via https
I'm still sorting out in my head where the remediation happens during install - if I understand it correctly the indicated profile is scanned early enough to pull the info about partitioning and the l like before much is done, and other bits happen after everything is installed. But I don't know if that later hardening is before or after the %post section happens.
-Rob
________________________________ From: Albrecht, Thomas C [thomas.c.albrecht@lmco.com] Sent: Friday, February 10, 2017 2:50 PM To: SCAP Security Guide Subject: EXTERNAL: RE: Kickstart from floppy wth SCAP and tailoring
Have you tried doing a manual install using the SCAP hardening in the install menu, and then stealing the code from the resulting anaconda.cfg that is generated in /root?
From: Robert Sanders [mailto:rsanders@forcepoint.com] Sent: Friday, February 10, 2017 2:48 PM To: scap-security-guide@lists.fedorahosted.org Subject: EXTERNAL: Kickstart from floppy wth SCAP and tailoring
Hi all, Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way?
-Rob
Scanned by Forcepoint Email Security Gateway Click herehttps://esgpem.websense.com:443/pem/pages/digestProcess/digestProcess.jsf?content=c3805c5951889c5e97054b396d5f8cda137d30c5fbf6f28f8250f6ee26070fdb2c0fe0e50f83ec29c6a066df750951d5228a8058902795e94fa86cc7c6e69f2b33db2c1092e76d7b08eb7b8efb3eb0469156ac51527d5859e4eec74d3f30db2c025e307ff8039af00030da46facf08e6a4fafe3343d12f0fe2fa51f5888792eab91860bb1b740d2cf63c0992c0430e8b to report this email as spam
Hey Rob,
In the past, for self-contained CD installers I’ve used /run/install/repo/base_folder_on_cd/somefile for kickstart includes. Depending on your setup that may or may not work for you.
Media with a /folder/file.xml
%addon org_fedora_oscap … tailoring-path = /run/install/repo/folder/file.xml … %end
Food for thought.
-Kevin
From: Robert Sanders rsanders@forcepoint.com Reply-To: SCAP Security Guide scap-security-guide@lists.fedorahosted.org Date: Friday, February 10, 2017 at 3:12 PM To: SCAP Security Guide scap-security-guide@lists.fedorahosted.org Subject: RE: Kickstart from floppy wth SCAP and tailoring
Yep, that's where I started, just making sure I could get a hardened image at install. But you can't (at least I didn't see a place on my RHEL7.3 box) to make changes to the selection of profiles included with the install RPM. I can bring up scap-workbench on a live box and make my changes there, and I was hoping to grab that customization and use it for the 'tailoring-path' option in the '%addon org_fedora_oscap' section. Anaconda yowls after installing stuff that it can't find the file. At the point where the error occurred it doesn't look like the floppy is mounted at all. This is my first dive into using kickstarts/anaconda like this and I'm not sure it is possible our of the box. I'm considering two workarounds -
1) Remaster the RHEL7.3 install ISO to include a new RPM with my customization tucked into the correct location 2) Standup a webserver to supply a datastream or archive of the desired profile, with my tailoring, and reference that via https
I'm still sorting out in my head where the remediation happens during install - if I understand it correctly the indicated profile is scanned early enough to pull the info about partitioning and the l like before much is done, and other bits happen after everything is installed. But I don't know if that later hardening is before or after the %post section happens.
-Rob
________________________________ From: Albrecht, Thomas C [thomas.c.albrecht@lmco.com] Sent: Friday, February 10, 2017 2:50 PM To: SCAP Security Guide Subject: EXTERNAL: RE: Kickstart from floppy wth SCAP and tailoring Have you tried doing a manual install using the SCAP hardening in the install menu, and then stealing the code from the resulting anaconda.cfg that is generated in /root?
From: Robert Sanders [mailto:rsanders@forcepoint.com] Sent: Friday, February 10, 2017 2:48 PM To: scap-security-guide@lists.fedorahosted.org Subject: EXTERNAL: Kickstart from floppy wth SCAP and tailoring
Hi all, Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way?
-Rob
Scanned by Forcepoint Email Security Gateway Click herehttps://esgpem.websense.com:443/pem/pages/digestProcess/digestProcess.jsf?content=c3805c5951889c5e97054b396d5f8cda137d30c5fbf6f28f8250f6ee26070fdb2c0fe0e50f83ec29c6a066df750951d5228a8058902795e94fa86cc7c6e69f2b33db2c1092e76d7b08eb7b8efb3eb0469156ac51527d5859e4eec74d3f30db2c025e307ff8039af00030da46facf08e6a4fafe3343d12f0fe2fa51f5888792eab91860bb1b740d2cf63c0992c0430e8b to report this email as spam
Kevin, Thank you for the reply. I've been banging my head on this for about a week now and either I'm doing something wrong or there is a bug in the org_fedora_oscap anaconda addon. I *have* made this work (mostly) if I skip the anaconda addon and simply run oscap from my %post section.
The initial work I was doing was just using a floppy to provide both the kickstart and the tailoring file from scap-workbench. We've migrated to having a full bootable ISO remastered from the RHEL 7.3 install media instead, with our tailoring file added as an extra RPM to be installed. I finally managed some syntax on the oscap addon that didn't raise an exception using this:
%addon org_fedora_oscap content-type = scap-security-guide profile = ospp-rhel7-server tailoring-path = ../../usr/share/xml/scap/custom/tailoring.xml %end
But after the system installs my modified banner is not present. Looking at the logs it appears that the tailoring path was completely ignored. I re-installed the system and dropped to one of the alternate windows to see exactly what oscap command was being executed and it was this:
oscap xccdf eval --remediate --results=/root/openscap_data/eval_remediate_results.xml --profile=ospp-rhel7-server tailoring-file=/usr/share/xml/scap/custom/tailoring.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml
While it runs apparently without error messages - I've noticed several things: 1) my tailoring is never used - just the steps from the profile 2) it looks like some of the 'kickstart actions' are not being done - if I understand the USGCB profile, it has an action for installing the 'screen' package if needed, but this is not happening at kickstart. I just found a bug in the oscap anacoonda addon (https://github.com/OpenSCAP/oscap-anaconda-addon/issues/16) that seems to confirm this, at least for RHEL 7.3 which we are using. 3) If I run the above command from a 'live' system (with or without the tailoring line) it still ignores the tailoring and there is an quick message is displayed - 'This content points out to the remote resources. Use `--fetch-remote-resources` option to download them.' If I provide an incorrect filename for the tailoring it does error without doing any other actions.
So far the only way I've been able to have my tailoring file used is to use a command similar to what scap-workbench displays in the 'dry-run' option - and that command uses the datastream flavor of commands not the xccdf flavor.
So it seems if I want to have tailoring done using the plugin I have to use the datastream content, which I can't because these systems will be totally isolated at configuration.
None of this is a hard show-stopper, but it means that the oscap plugin is not usable as it stands. Right now I don't have time to delve deeper into the plugin (although I have pulled the source to try and understand it better).
-Rob
________________________________ From: Kevin Spargur (kspargur) [kspargur@cisco.com] Sent: Friday, February 10, 2017 3:24 PM To: SCAP Security Guide Subject: EXTERNAL: Re: Kickstart from floppy wth SCAP and tailoring
Hey Rob,
In the past, for self-contained CD installers I’ve used /run/install/repo/base_folder_on_cd/somefile for kickstart includes. Depending on your setup that may or may not work for you.
Media with a /folder/file.xml
%addon org_fedora_oscap … tailoring-path = /run/install/repo/folder/file.xml … %end
Food for thought.
-Kevin
From: Robert Sanders rsanders@forcepoint.com Reply-To: SCAP Security Guide scap-security-guide@lists.fedorahosted.org Date: Friday, February 10, 2017 at 3:12 PM To: SCAP Security Guide scap-security-guide@lists.fedorahosted.org Subject: RE: Kickstart from floppy wth SCAP and tailoring
Yep, that's where I started, just making sure I could get a hardened image at install. But you can't (at least I didn't see a place on my RHEL7.3 box) to make changes to the selection of profiles included with the install RPM. I can bring up scap-workbench on a live box and make my changes there, and I was hoping to grab that customization and use it for the 'tailoring-path' option in the '%addon org_fedora_oscap' section. Anaconda yowls after installing stuff that it can't find the file. At the point where the error occurred it doesn't look like the floppy is mounted at all. This is my first dive into using kickstarts/anaconda like this and I'm not sure it is possible our of the box. I'm considering two workarounds -
1) Remaster the RHEL7.3 install ISO to include a new RPM with my customization tucked into the correct location 2) Standup a webserver to supply a datastream or archive of the desired profile, with my tailoring, and reference that via https
I'm still sorting out in my head where the remediation happens during install - if I understand it correctly the indicated profile is scanned early enough to pull the info about partitioning and the l like before much is done, and other bits happen after everything is installed. But I don't know if that later hardening is before or after the %post section happens.
-Rob
________________________________ From: Albrecht, Thomas C [thomas.c.albrecht@lmco.com] Sent: Friday, February 10, 2017 2:50 PM To: SCAP Security Guide Subject: EXTERNAL: RE: Kickstart from floppy wth SCAP and tailoring Have you tried doing a manual install using the SCAP hardening in the install menu, and then stealing the code from the resulting anaconda.cfg that is generated in /root?
From: Robert Sanders [mailto:rsanders@forcepoint.com] Sent: Friday, February 10, 2017 2:48 PM To: scap-security-guide@lists.fedorahosted.org Subject: EXTERNAL: Kickstart from floppy wth SCAP and tailoring
Hi all, Have a quick question - I'm looking at using a kickstart file to automate our OS install, but I also want to use the SCAP plugin to handle the initial lockdown of our images. Looking at the 'tailoring-path' option to the anaconda plugin looks promising, but the docs indicate that the path for this option is relative to the archive being used. Is there a way to specify the path so that it will the path from the 'floppy' image I'm using (currently booting by adding "linux ks=hd:fd0:ks.cfg"), or do I need to stand everything up as an http/https/ftp server and reference the SCAP contents and my tailoring file that way?
-Rob
Scanned by Forcepoint Email Security Gateway Click herehttps://esgpem.websense.com:443/pem/pages/digestProcess/digestProcess.jsf?content=c3805c5951889c5e97054b396d5f8cda137d30c5fbf6f28f8250f6ee26070fdb2c0fe0e50f83ec29c6a066df750951d5228a8058902795e94fa86cc7c6e69f2b33db2c1092e76d7b08eb7b8efb3eb0469156ac51527d5859e4eec74d3f30db2c025e307ff8039af00030da46facf08e6a4fafe3343d12f0fe2fa51f5888792eab91860bb1b740d2cf63c0992c0430e8b to report this email as spam
Scanned by Forcepoint Email Security Gateway Click herehttps://esgpem.websense.com:443/pem/pages/digestProcess/digestProcess.jsf?content=c3805c5951889c5e6f58ac29a45fe225e1aed11428b5a496b4281c43a94040082c0fe0e50f83ec29c6a066df750951d5228a8058902795e94fa86cc7c6e69f2b33db2c1092e76d7b08eb7b8efb3eb0469156ac51527d5859e4eec74d3f30db2c025e307ff8039af00030da46facf08e69d426f8d2508cac4a168f052b2f6ca76f981b597adcb6279f2a8db3d9f162da7 to report this email as spam
scap-security-guide@lists.fedorahosted.org
-
Albrecht, Thomas C -
Kevin Spargur (kspargur) -
Robert Sanders