Gecko [ 122.154.134.11 ]

Name	Size	Permission
ssg-rhel6-pci-dss-with-gui-ks....	6.35 KB	-rw-r--r--
ssg-rhel6-stig-ks.cfg	12.05 KB	-rw-r--r--
ssg-rhel6-usgcb-server-with-gu...	6.31 KB	-rw-r--r--

Code Editor : ssg-rhel6-usgcb-server-with-gui-ks.cfg

# SCAP Security Guide USGCB profile kickstart for Red Hat Enterprise Linux 6 Server
# Version: 0.0.2
# Date: 2015-12-15
#
# Based on:
# http://fedoraproject.org/wiki/Anaconda/Kickstart
# https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Installation_Guide/s1-kickstart2-options.html
# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg

# Install a fresh new system (optional)
install

# Specify installation method to use for installation
# To use a different one comment out the 'url' one below, update
# the selected choice with proper options & un-comment it
#
# Install from an installation tree on a remote server via FTP or HTTP:
# --url		the URL to install from
#
#url --url=http://192.168.122.1/image
#
# Other possible / supported installation methods:
# * install from the first CD-ROM/DVD drive on the system:
#
# cdrom
#
# * install from a directory of ISO images on a local drive:
#
# harddrive --partition=hdb2 --dir=/tmp/install-tree
#
# * install from provided NFS server:
#
# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>]
#

# Set language to use during installation and the default language to use on the installed system (required)
lang en_US.UTF-8

# Set system keyboard type / layout (required)
keyboard us

# Configure network information for target system and activate network devices in the installer environment (optional)
# --onboot	enable device at a boot time
# --device	device to be activated and / or configured with the network command
# --bootproto	method to obtain networking configuration for device (default dhcp)
# --noipv6	disable IPv6 on this device
network --onboot yes --device eth0 --bootproto dhcp --noipv6

# Set the system's root password (required)
# Plaintext password is: server
# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
# encrypted password form for different plaintext password
rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0

# Configure firewall settings for the system (optional)
# --enabled	reject incoming connections that are not in response to outbound requests
# --ssh		allow sshd service through the firewall
firewall --enabled --ssh

# Set up the authentication options for the system (required)
# --enableshadow	enable shadowed passwords by default
# --passalgo		hash / crypt algorithm for new passwords
# See the manual page for authconfig for a complete list of possible options.
authconfig --enableshadow --passalgo=sha512

# State of SELinux on the installed system (optional)
# Defaults to enforcing
selinux --enforcing

# Set the system time zone (required)
timezone --utc America/New_York

# Specify how the bootloader should be installed (required)
# Plaintext password is: password
# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create
# encrypted password form for different plaintext password
bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0

# Initialize (format) all disks (optional)
zerombr

# The following partition layout scheme assumes disk of size 20GB or larger
# Modify size of partitions appropriately to reflect actual machine's hardware
# 
# Remove Linux partitions from the system prior to creating new ones (optional)
# --linux	erase all Linux partitions
# --initlabel	initialize the disk label to the default based on the underlying architecture
clearpart --linux --initlabel

# Create primary system partitions (required for installs)
part /boot --fstype=ext4 --size=512
part pv.01 --grow --size=1

# Create a Logical Volume Management (LVM) group (optional)
volgroup VolGroup --pesize=4096 pv.01

# Create particular logical volumes (optional)
logvol / --fstype=ext4 --name=LogVol06 --vgname=VolGroup --size=12288 --grow
# CCE-26557-9: Ensure /home Located On Separate Partition
logvol /home --fstype=ext4 --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
# CCE-26435-8: Ensure /tmp Located On Separate Partition
logvol /tmp --fstype=ext4 --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
# CCE-26639-5: Ensure /var Located On Separate Partition
logvol /var --fstype=ext4 --name=LogVol03 --vgname=VolGroup --size=2048 --fsoptions="nodev"
# CCE-26215-4: Ensure /var/log Located On Separate Partition
logvol /var/log --fstype=ext4 --name=LogVol04 --vgname=VolGroup --size=1024 --fsoptions="nodev"
# CCE-26436-6: Ensure /var/log/audit Located On Separate Partition
logvol /var/log/audit --fstype=ext4 --name=LogVol05 --vgname=VolGroup --size=512 --fsoptions="nodev"
logvol swap --name=lv_swap --vgname=VolGroup --size=2016

# Packages selection (%packages section is required)
#
# Packages from the following package groups are installed by default when 'Desktop'
# Anaconda option is selected when installing Red Hat Enterprise Linux 6 Server
%packages
@additional-devel
@base
@basic-desktop
@desktop-debugging
@dial-up
@directory-client
@mail-server
@fonts
@general-desktop
@graphical-admin-tools
@hardware-monitoring
@input-methods
@internet-browser
@java-platform
@large-systems
@legacy-unix
@legacy-x
@nfs-file-server
@network-server
@network-file-system-client
@network-tools
@performance
@perl-runtime
@print-server
@print-client
@system-management-snmp
@server-platform
@web-server
@x11

# Install selected additional packages (required by USGCB profile)
# CCE-27024-9: Install AIDE
aide

# Install openscap-scanner so it's possible to perform remediation once the
# installation is complete
openscap-scanner

# Install the scap-security-guide package
scap-security-guide

%end # End of %packages section

%post --log /root/oscap.log

# Perform post installation system remediation according to the USGCB profile via the oscap tool
# To create a system compliant against different RHEL-6 SCAP Security Guide profile specify selected
# profile name after the --profile oscap tool option

oscap xccdf eval --remediate --profile usgcb-rhel6-server \
--results /root/oscap_usgcb_remediation_result.xml \
--report /root/oscap_usgcb_remediation_report.html \
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

%end # End of %post section

# Reboot after the installation is complete (optional)
# --eject	attempt to eject CD or DVD media before rebooting
reboot --eject

${this.title}

Code Editor : ssg-rhel6-usgcb-server-with-gui-ks.cfg