|
 |
44eea6 |
From 3cf5caec6f0705d24bc3f285e19d1831714bca16 Mon Sep 17 00:00:00 2001
|
|
|
44eea6 |
From: Watson Sato <wsato@redhat.com>
|
|
|
44eea6 |
Date: Wed, 13 Nov 2019 18:05:32 +0100
|
|
|
44eea6 |
Subject: [PATCH 1/4] Add simple kickstart file for e8 profiles
|
|
|
44eea6 |
|
|
|
44eea6 |
As the profile doesn't require a particular disk partition layout, I
|
|
|
44eea6 |
went for the 'autopart' feature.
|
|
|
44eea6 |
---
|
|
|
44eea6 |
rhel7/kickstart/ssg-rhel7-e8-ks.cfg | 122 ++++++++++++++++++++++++++++
|
|
|
44eea6 |
rhel8/kickstart/ssg-rhel8-e8-ks.cfg | 122 ++++++++++++++++++++++++++++
|
|
|
44eea6 |
2 files changed, 244 insertions(+)
|
|
|
44eea6 |
create mode 100644 rhel7/kickstart/ssg-rhel7-e8-ks.cfg
|
|
|
44eea6 |
create mode 100644 rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
|
|
|
44eea6 |
diff --git a/rhel7/kickstart/ssg-rhel7-e8-ks.cfg b/rhel7/kickstart/ssg-rhel7-e8-ks.cfg
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..9e44a87a86
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/rhel7/kickstart/ssg-rhel7-e8-ks.cfg
|
|
|
44eea6 |
@@ -0,0 +1,122 @@
|
|
|
44eea6 |
+# SCAP Security Guide Essential Eight profile kickstart for Red Hat Enterprise Linux 7 Server
|
|
|
44eea6 |
+# Version: 0.0.1
|
|
|
44eea6 |
+# Date: 2019-11-13
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Based on:
|
|
|
44eea6 |
+# http://fedoraproject.org/wiki/Anaconda/Kickstart
|
|
|
44eea6 |
+# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Install a fresh new system (optional)
|
|
|
44eea6 |
+install
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Specify installation method to use for installation
|
|
|
44eea6 |
+# To use a different one comment out the 'url' one below, update
|
|
|
44eea6 |
+# the selected choice with proper options & un-comment it
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Install from an installation tree on a remote server via FTP or HTTP:
|
|
|
44eea6 |
+# --url the URL to install from
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Example:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# url --url=http://192.168.122.1/image
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Modify concrete URL in the above example appropriately to reflect the actual
|
|
|
44eea6 |
+# environment machine is to be installed in
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Other possible / supported installation methods:
|
|
|
44eea6 |
+# * install from the first CD-ROM/DVD drive on the system:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# cdrom
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# * install from a directory of ISO images on a local drive:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# * install from provided NFS server:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set language to use during installation and the default language to use on the installed system (required)
|
|
|
44eea6 |
+lang en_US.UTF-8
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set system keyboard type / layout (required)
|
|
|
44eea6 |
+keyboard us
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Configure network information for target system and activate network devices in the installer environment (optional)
|
|
|
44eea6 |
+# --onboot enable device at a boot time
|
|
|
44eea6 |
+# --device device to be activated and / or configured with the network command
|
|
|
44eea6 |
+# --bootproto method to obtain networking configuration for device (default dhcp)
|
|
|
44eea6 |
+# --noipv6 disable IPv6 on this device
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
|
|
|
44eea6 |
+# "--bootproto=static" must be used. For example:
|
|
|
44eea6 |
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set the system's root password (required)
|
|
|
44eea6 |
+# Plaintext password is: server
|
|
|
44eea6 |
+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
|
|
|
44eea6 |
+# encrypted password form for different plaintext password
|
|
|
44eea6 |
+rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# The selected profile will restrict root login
|
|
|
44eea6 |
+# Add a user that can login and escalate privileges
|
|
|
44eea6 |
+# Plaintext password is: admin123
|
|
|
44eea6 |
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Configure firewall settings for the system (optional)
|
|
|
44eea6 |
+# --enabled reject incoming connections that are not in response to outbound requests
|
|
|
44eea6 |
+# --ssh allow sshd service through the firewall
|
|
|
44eea6 |
+firewall --enabled --ssh
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set up the authentication options for the system (required)
|
|
|
44eea6 |
+# --enableshadow enable shadowed passwords by default
|
|
|
44eea6 |
+# --passalgo hash / crypt algorithm for new passwords
|
|
|
44eea6 |
+# See the manual page for authconfig for a complete list of possible options.
|
|
|
44eea6 |
+authconfig --enableshadow --passalgo=sha512
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# State of SELinux on the installed system (optional)
|
|
|
44eea6 |
+# Defaults to enforcing
|
|
|
44eea6 |
+selinux --enforcing
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set the system time zone (required)
|
|
|
44eea6 |
+timezone --utc America/New_York
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Specify how the bootloader should be installed (required)
|
|
|
44eea6 |
+# Plaintext password is: password
|
|
|
44eea6 |
+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
|
|
|
44eea6 |
+# encrypted password form for different plaintext password
|
|
|
44eea6 |
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Initialize (format) all disks (optional)
|
|
|
44eea6 |
+zerombr
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# The following partition layout scheme assumes disk of size 20GB or larger
|
|
|
44eea6 |
+# Modify size of partitions appropriately to reflect actual machine's hardware
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Remove Linux partitions from the system prior to creating new ones (optional)
|
|
|
44eea6 |
+# --linux erase all Linux partitions
|
|
|
44eea6 |
+# --initlabel initialize the disk label to the default based on the underlying architecture
|
|
|
44eea6 |
+clearpart --linux --initlabel
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Create primary system partitions (required for installs)
|
|
|
44eea6 |
+autopart
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+%addon org_fedora_oscap
|
|
|
44eea6 |
+ content-type = scap-security-guide
|
|
|
44eea6 |
+ profile = xccdf_org.ssgproject.content_profile_e8
|
|
|
44eea6 |
+%end
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Packages selection (%packages section is required)
|
|
|
44eea6 |
+%packages
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Require @Base
|
|
|
44eea6 |
+@Base
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+%end # End of %packages section
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Reboot after the installation is complete (optional)
|
|
|
44eea6 |
+# --eject attempt to eject CD or DVD media before rebooting
|
|
|
44eea6 |
+reboot --eject
|
|
|
44eea6 |
diff --git a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
new file mode 100644
|
|
|
44eea6 |
index 0000000000..3555f528cb
|
|
|
44eea6 |
--- /dev/null
|
|
|
44eea6 |
+++ b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
@@ -0,0 +1,122 @@
|
|
|
44eea6 |
+# SCAP Security Guide Essential Eight profile kickstart for Red Hat Enterprise Linux 8 Server
|
|
|
44eea6 |
+# Version: 0.0.1
|
|
|
44eea6 |
+# Date: 2019-11-13
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Based on:
|
|
|
44eea6 |
+# http://fedoraproject.org/wiki/Anaconda/Kickstart
|
|
|
44eea6 |
+# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Install a fresh new system (optional)
|
|
|
44eea6 |
+install
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Specify installation method to use for installation
|
|
|
44eea6 |
+# To use a different one comment out the 'url' one below, update
|
|
|
44eea6 |
+# the selected choice with proper options & un-comment it
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Install from an installation tree on a remote server via FTP or HTTP:
|
|
|
44eea6 |
+# --url the URL to install from
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Example:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# url --url=http://192.168.122.1/image
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Modify concrete URL in the above example appropriately to reflect the actual
|
|
|
44eea6 |
+# environment machine is to be installed in
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Other possible / supported installation methods:
|
|
|
44eea6 |
+# * install from the first CD-ROM/DVD drive on the system:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# cdrom
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# * install from a directory of ISO images on a local drive:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# harddrive --partition=hdb2 --dir=/tmp/install-tree
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# * install from provided NFS server:
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set language to use during installation and the default language to use on the installed system (required)
|
|
|
44eea6 |
+lang en_US.UTF-8
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set system keyboard type / layout (required)
|
|
|
44eea6 |
+keyboard us
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Configure network information for target system and activate network devices in the installer environment (optional)
|
|
|
44eea6 |
+# --onboot enable device at a boot time
|
|
|
44eea6 |
+# --device device to be activated and / or configured with the network command
|
|
|
44eea6 |
+# --bootproto method to obtain networking configuration for device (default dhcp)
|
|
|
44eea6 |
+# --noipv6 disable IPv6 on this device
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration,
|
|
|
44eea6 |
+# "--bootproto=static" must be used. For example:
|
|
|
44eea6 |
+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+network --onboot yes --device eth0 --bootproto dhcp --noipv6
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set the system's root password (required)
|
|
|
44eea6 |
+# Plaintext password is: server
|
|
|
44eea6 |
+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
|
|
|
44eea6 |
+# encrypted password form for different plaintext password
|
|
|
44eea6 |
+rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# The selected profile will restrict root login
|
|
|
44eea6 |
+# Add a user that can login and escalate privileges
|
|
|
44eea6 |
+# Plaintext password is: admin123
|
|
|
44eea6 |
+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Configure firewall settings for the system (optional)
|
|
|
44eea6 |
+# --enabled reject incoming connections that are not in response to outbound requests
|
|
|
44eea6 |
+# --ssh allow sshd service through the firewall
|
|
|
44eea6 |
+firewall --enabled --ssh
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set up the authentication options for the system (required)
|
|
|
44eea6 |
+# --enableshadow enable shadowed passwords by default
|
|
|
44eea6 |
+# --passalgo hash / crypt algorithm for new passwords
|
|
|
44eea6 |
+# See the manual page for authconfig for a complete list of possible options.
|
|
|
44eea6 |
+authconfig --enableshadow --passalgo=sha512
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# State of SELinux on the installed system (optional)
|
|
|
44eea6 |
+# Defaults to enforcing
|
|
|
44eea6 |
+selinux --enforcing
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Set the system time zone (required)
|
|
|
44eea6 |
+timezone --utc America/New_York
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Specify how the bootloader should be installed (required)
|
|
|
44eea6 |
+# Plaintext password is: password
|
|
|
44eea6 |
+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
|
|
|
44eea6 |
+# encrypted password form for different plaintext password
|
|
|
44eea6 |
+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Initialize (format) all disks (optional)
|
|
|
44eea6 |
+zerombr
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# The following partition layout scheme assumes disk of size 20GB or larger
|
|
|
44eea6 |
+# Modify size of partitions appropriately to reflect actual machine's hardware
|
|
|
44eea6 |
+#
|
|
|
44eea6 |
+# Remove Linux partitions from the system prior to creating new ones (optional)
|
|
|
44eea6 |
+# --linux erase all Linux partitions
|
|
|
44eea6 |
+# --initlabel initialize the disk label to the default based on the underlying architecture
|
|
|
44eea6 |
+clearpart --linux --initlabel
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Create primary system partitions (required for installs)
|
|
|
44eea6 |
+autopart
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+%addon org_fedora_oscap
|
|
|
44eea6 |
+ content-type = scap-security-guide
|
|
|
44eea6 |
+ profile = xccdf_org.ssgproject.content_profile_e8
|
|
|
44eea6 |
+%end
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Packages selection (%packages section is required)
|
|
|
44eea6 |
+%packages
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Require @Base
|
|
|
44eea6 |
+@Base
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+%end # End of %packages section
|
|
|
44eea6 |
+
|
|
|
44eea6 |
+# Reboot after the installation is complete (optional)
|
|
|
44eea6 |
+# --eject attempt to eject CD or DVD media before rebooting
|
|
|
44eea6 |
+reboot --eject
|
|
|
44eea6 |
|
|
|
44eea6 |
From 94249bce4b61c33e52f59efdb112e2082b4acf46 Mon Sep 17 00:00:00 2001
|
|
|
44eea6 |
From: Watson Sato <wsato@redhat.com>
|
|
|
44eea6 |
Date: Fri, 15 Nov 2019 11:19:51 +0100
|
|
|
44eea6 |
Subject: [PATCH 2/4] Use authselect for el8 kickstart
|
|
|
44eea6 |
|
|
|
44eea6 |
auth and authconfig are deprecated
|
|
|
44eea6 |
---
|
|
|
44eea6 |
rhel8/kickstart/ssg-rhel8-e8-ks.cfg | 8 ++++----
|
|
|
44eea6 |
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
44eea6 |
|
|
|
44eea6 |
diff --git a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
index 3555f528cb..e814024e2e 100644
|
|
|
44eea6 |
--- a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
+++ b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
@@ -72,10 +72,10 @@ user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUaf
|
|
|
44eea6 |
firewall --enabled --ssh
|
|
|
44eea6 |
|
|
|
44eea6 |
# Set up the authentication options for the system (required)
|
|
|
44eea6 |
-# --enableshadow enable shadowed passwords by default
|
|
|
44eea6 |
-# --passalgo hash / crypt algorithm for new passwords
|
|
|
44eea6 |
-# See the manual page for authconfig for a complete list of possible options.
|
|
|
44eea6 |
-authconfig --enableshadow --passalgo=sha512
|
|
|
44eea6 |
+# sssd profile sets sha512 to hash passwords
|
|
|
44eea6 |
+# passwords are shadowed by default
|
|
|
44eea6 |
+# See the manual page for authselect-profile for a complete list of possible options.
|
|
|
44eea6 |
+authselect select sssd
|
|
|
44eea6 |
|
|
|
44eea6 |
# State of SELinux on the installed system (optional)
|
|
|
44eea6 |
# Defaults to enforcing
|
|
|
44eea6 |
|
|
|
44eea6 |
From 1ff6ab4ec0449074c4608eed0194903123eda34b Mon Sep 17 00:00:00 2001
|
|
|
44eea6 |
From: Watson Sato <wsato@redhat.com>
|
|
|
44eea6 |
Date: Fri, 15 Nov 2019 11:22:31 +0100
|
|
|
44eea6 |
Subject: [PATCH 3/4] Updated kickstart documenation link for el8
|
|
|
44eea6 |
|
|
|
44eea6 |
---
|
|
|
44eea6 |
rhel8/kickstart/ssg-rhel8-e8-ks.cfg | 2 +-
|
|
|
44eea6 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
44eea6 |
|
|
|
44eea6 |
diff --git a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
index e814024e2e..41d4b3d654 100644
|
|
|
44eea6 |
--- a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
+++ b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
@@ -4,7 +4,7 @@
|
|
|
44eea6 |
#
|
|
|
44eea6 |
# Based on:
|
|
|
44eea6 |
# http://fedoraproject.org/wiki/Anaconda/Kickstart
|
|
|
44eea6 |
-# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Installation_Guide/sect-kickstart-syntax.html
|
|
|
44eea6 |
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart
|
|
|
44eea6 |
|
|
|
44eea6 |
# Install a fresh new system (optional)
|
|
|
44eea6 |
install
|
|
|
44eea6 |
|
|
|
44eea6 |
From ef5edccc3ec58131644f31481ec3df20ab345229 Mon Sep 17 00:00:00 2001
|
|
|
44eea6 |
From: Watson Sato <wsato@redhat.com>
|
|
|
44eea6 |
Date: Mon, 18 Nov 2019 13:31:18 +0100
|
|
|
44eea6 |
Subject: [PATCH 4/4] Add link to oscap-anaconda-addon documentation
|
|
|
44eea6 |
|
|
|
44eea6 |
---
|
|
|
44eea6 |
rhel7/kickstart/ssg-rhel7-e8-ks.cfg | 3 +++
|
|
|
44eea6 |
rhel8/kickstart/ssg-rhel8-e8-ks.cfg | 3 +++
|
|
|
44eea6 |
2 files changed, 6 insertions(+)
|
|
|
44eea6 |
|
|
|
44eea6 |
diff --git a/rhel7/kickstart/ssg-rhel7-e8-ks.cfg b/rhel7/kickstart/ssg-rhel7-e8-ks.cfg
|
|
|
44eea6 |
index 9e44a87a86..23f1bad7e1 100644
|
|
|
44eea6 |
--- a/rhel7/kickstart/ssg-rhel7-e8-ks.cfg
|
|
|
44eea6 |
+++ b/rhel7/kickstart/ssg-rhel7-e8-ks.cfg
|
|
|
44eea6 |
@@ -104,6 +104,9 @@ clearpart --linux --initlabel
|
|
|
44eea6 |
# Create primary system partitions (required for installs)
|
|
|
44eea6 |
autopart
|
|
|
44eea6 |
|
|
|
44eea6 |
+# Harden installation with Essential Eight profile
|
|
|
44eea6 |
+# For more details and configuration options see command %addon org_fedora_oscap in
|
|
|
44eea6 |
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/installation_guide/sect-kickstart-syntax#sect-kickstart-commands
|
|
|
44eea6 |
%addon org_fedora_oscap
|
|
|
44eea6 |
content-type = scap-security-guide
|
|
|
44eea6 |
profile = xccdf_org.ssgproject.content_profile_e8
|
|
|
44eea6 |
diff --git a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
index 41d4b3d654..8380ea13a3 100644
|
|
|
44eea6 |
--- a/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
+++ b/rhel8/kickstart/ssg-rhel8-e8-ks.cfg
|
|
|
44eea6 |
@@ -104,6 +104,9 @@ clearpart --linux --initlabel
|
|
|
44eea6 |
# Create primary system partitions (required for installs)
|
|
|
44eea6 |
autopart
|
|
|
44eea6 |
|
|
|
44eea6 |
+# Harden installation with Essential Eight profile
|
|
|
44eea6 |
+# For more details and configuration options see
|
|
|
44eea6 |
+# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program
|
|
|
44eea6 |
%addon org_fedora_oscap
|
|
|
44eea6 |
content-type = scap-security-guide
|
|
|
44eea6 |
profile = xccdf_org.ssgproject.content_profile_e8
|