|
| 1 | +From 8e43a6a6432a8cbeb5742771ddbd0856669a7878 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Watson Sato <wsato@redhat.com> |
| 3 | +Date: Wed, 17 Feb 2021 15:36:59 +0100 |
| 4 | +Subject: [PATCH] Remove kickstart for profile not shipped |
| 5 | + |
| 6 | +RHEL-8 ANSSI high is not shipped at the momment |
| 7 | +--- |
| 8 | + .../ssg-rhel8-anssi_bp28_high-ks.cfg | 167 ------------------ |
| 9 | + 1 file changed, 167 deletions(-) |
| 10 | + delete mode 100644 rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg |
| 11 | + |
| 12 | +diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg |
| 13 | +deleted file mode 100644 |
| 14 | +index b5c09253a..000000000 |
| 15 | +--- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg |
| 16 | ++++ /dev/null |
| 17 | +@@ -1,167 +0,0 @@ |
| 18 | +-# SCAP Security Guide ANSSI BP-028 (high) profile kickstart for Red Hat Enterprise Linux 8 |
| 19 | +-# Version: 0.0.1 |
| 20 | +-# Date: 2020-12-10 |
| 21 | +-# |
| 22 | +-# Based on: |
| 23 | +-# https://pykickstart.readthedocs.io/en/latest/ |
| 24 | +-# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg |
| 25 | +- |
| 26 | +-# Specify installation method to use for installation |
| 27 | +-# To use a different one comment out the 'url' one below, update |
| 28 | +-# the selected choice with proper options & un-comment it |
| 29 | +-# |
| 30 | +-# Install from an installation tree on a remote server via FTP or HTTP: |
| 31 | +-# --url the URL to install from |
| 32 | +-# |
| 33 | +-# Example: |
| 34 | +-# |
| 35 | +-# url --url=http://192.168.122.1/image |
| 36 | +-# |
| 37 | +-# Modify concrete URL in the above example appropriately to reflect the actual |
| 38 | +-# environment machine is to be installed in |
| 39 | +-# |
| 40 | +-# Other possible / supported installation methods: |
| 41 | +-# * install from the first CD-ROM/DVD drive on the system: |
| 42 | +-# |
| 43 | +-# cdrom |
| 44 | +-# |
| 45 | +-# * install from a directory of ISO images on a local drive: |
| 46 | +-# |
| 47 | +-# harddrive --partition=hdb2 --dir=/tmp/install-tree |
| 48 | +-# |
| 49 | +-# * install from provided NFS server: |
| 50 | +-# |
| 51 | +-# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] |
| 52 | +-# |
| 53 | +-# Set language to use during installation and the default language to use on the installed system (required) |
| 54 | +-lang en_US.UTF-8 |
| 55 | +- |
| 56 | +-# Set system keyboard type / layout (required) |
| 57 | +-keyboard us |
| 58 | +- |
| 59 | +-# Configure network information for target system and activate network devices in the installer environment (optional) |
| 60 | +-# --onboot enable device at a boot time |
| 61 | +-# --device device to be activated and / or configured with the network command |
| 62 | +-# --bootproto method to obtain networking configuration for device (default dhcp) |
| 63 | +-# --noipv6 disable IPv6 on this device |
| 64 | +-# |
| 65 | +-# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, |
| 66 | +-# "--bootproto=static" must be used. For example: |
| 67 | +-# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 |
| 68 | +-# |
| 69 | +-network --onboot yes --bootproto dhcp --noipv6 |
| 70 | +- |
| 71 | +-# Set the system's root password (required) |
| 72 | +-# Plaintext password is: server |
| 73 | +-# Refer to e.g. |
| 74 | +-# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw |
| 75 | +-# to see how to create encrypted password form for different plaintext password |
| 76 | +-rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 |
| 77 | +- |
| 78 | +-# The selected profile will restrict root login |
| 79 | +-# Add a user that can login and escalate privileges |
| 80 | +-# Plaintext password is: admin123 |
| 81 | +-user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted |
| 82 | +- |
| 83 | +-# Configure firewall settings for the system (optional) |
| 84 | +-# --enabled reject incoming connections that are not in response to outbound requests |
| 85 | +-# --ssh allow sshd service through the firewall |
| 86 | +-firewall --enabled --ssh |
| 87 | +- |
| 88 | +-# State of SELinux on the installed system (optional) |
| 89 | +-# Defaults to enforcing |
| 90 | +-selinux --enforcing |
| 91 | +- |
| 92 | +-# Set the system time zone (required) |
| 93 | +-timezone --utc America/New_York |
| 94 | +- |
| 95 | +-# Specify how the bootloader should be installed (required) |
| 96 | +-# Plaintext password is: password |
| 97 | +-# Refer to e.g. |
| 98 | +-# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw |
| 99 | +-# to see how to create encrypted password form for different plaintext password |
| 100 | +-bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 |
| 101 | +- |
| 102 | +-# Initialize (format) all disks (optional) |
| 103 | +-zerombr |
| 104 | +- |
| 105 | +-# The following partition layout scheme assumes disk of size 20GB or larger |
| 106 | +-# Modify size of partitions appropriately to reflect actual machine's hardware |
| 107 | +-# |
| 108 | +-# Remove Linux partitions from the system prior to creating new ones (optional) |
| 109 | +-# --linux erase all Linux partitions |
| 110 | +-# --initlabel initialize the disk label to the default based on the underlying architecture |
| 111 | +-clearpart --linux --initlabel |
| 112 | +- |
| 113 | +-# Create primary system partitions (required for installs) |
| 114 | +-part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" |
| 115 | +-part pv.01 --grow --size=1 |
| 116 | +- |
| 117 | +-# Create a Logical Volume Management (LVM) group (optional) |
| 118 | +-volgroup VolGroup --pesize=4096 pv.01 |
| 119 | +- |
| 120 | +-# Create particular logical volumes (optional) |
| 121 | +-logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow |
| 122 | +-# Ensure /usr Located On Separate Partition |
| 123 | +-logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" |
| 124 | +-# Ensure /opt Located On Separate Partition |
| 125 | +-logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" |
| 126 | +-# Ensure /srv Located On Separate Partition |
| 127 | +-logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" |
| 128 | +-# Ensure /home Located On Separate Partition |
| 129 | +-logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" |
| 130 | +-# Ensure /tmp Located On Separate Partition |
| 131 | +-logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" |
| 132 | +-# Ensure /var/tmp Located On Separate Partition |
| 133 | +-logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" |
| 134 | +-# Ensure /var Located On Separate Partition |
| 135 | +-logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" |
| 136 | +-# Ensure /var/log Located On Separate Partition |
| 137 | +-logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" |
| 138 | +-# Ensure /var/log/audit Located On Separate Partition |
| 139 | +-logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" |
| 140 | +-logvol swap --name=swap --vgname=VolGroup --size=2016 |
| 141 | +- |
| 142 | +-# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) |
| 143 | +-# content - security policies - on the installed system.This add-on has been enabled by default |
| 144 | +-# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this |
| 145 | +-# functionality will automatically be installed. However, by default, no policies are enforced, |
| 146 | +-# meaning that no checks are performed during or after installation unless specifically configured. |
| 147 | +-# |
| 148 | +-# Important |
| 149 | +-# Applying a security policy is not necessary on all systems. This screen should only be used |
| 150 | +-# when a specific policy is mandated by your organization rules or government regulations. |
| 151 | +-# Unlike most other commands, this add-on does not accept regular options, but uses key-value |
| 152 | +-# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. |
| 153 | +-# Values can be optionally enclosed in single quotes (') or double quotes ("). |
| 154 | +-# |
| 155 | +-# The following keys are recognized by the add-on: |
| 156 | +-# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. |
| 157 | +-# - If the content-type is scap-security-guide, the add-on will use content provided by the |
| 158 | +-# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. |
| 159 | +-# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. |
| 160 | +-# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. |
| 161 | +-# xccdf-id - ID of the benchmark you want to use. |
| 162 | +-# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. |
| 163 | +-# profile - ID of the profile to be applied. Use default to apply the default profile. |
| 164 | +-# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. |
| 165 | +-# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. |
| 166 | +-# |
| 167 | +-# The following is an example %addon org_fedora_oscap section which uses content from the |
| 168 | +-# scap-security-guide on the installation media: |
| 169 | +-%addon org_fedora_oscap |
| 170 | +- content-type = scap-security-guide |
| 171 | +- profile = xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 172 | +-%end |
| 173 | +- |
| 174 | +-# Packages selection (%packages section is required) |
| 175 | +-%packages |
| 176 | +- |
| 177 | +-# Require @Base |
| 178 | +-@Base |
| 179 | +- |
| 180 | +-%end # End of %packages section |
| 181 | +- |
| 182 | +-# Reboot after the installation is complete (optional) |
| 183 | +-# --eject attempt to eject CD or DVD media before rebooting |
| 184 | +-reboot --eject |
| 185 | +-- |
| 186 | +2.26.2 |
| 187 | + |
0 commit comments