Introduction

Red Hat Identity Management Server provides is a centralized identity management server for Linux, Mac, Windows.

In this post we are going to setup and configure a HA deployment of Red Hat IDM on two RHEL 7.x servers.

Red Hat Identity Management Server is based on the upstream project, FreeIPA.

Prerequisites

Only a couple of prerequisites for a simple lab setup

You need working dns with forward and reverse entries for both IDM servers
NSCD needs to be disabled on each IDM server
Proper hostname needs to be set on each IDM node (cannot use localhost)
IPV6 needs to be enabled, but you do not need to have an IPV6 address on external interfaces

(more…)

OpenSCAP Part 4: Integration with Red Hat Satellite 6.5

Linux rhel7 satellite virtualization

07/31/2019

openscap-base

Introduction

This is the 4th installment of a series of posts focusing on OpenSCAP. Previous posts in this series can be found below.

OpenSCAP Part 1: Introduction and Basic Usage for RHEL 7/CentOS 7/Fedora
OpenSCAP Part 2: SCAP Content for RHEL 7
OpenSCAP Part 3: Running Scans from the Command Line in RHEL 7

This time around we are going to work on integrating OpenSCAP functionality into Red Hat Satellite 6.5

Installing SCAP Content on Satellite Server

SSH into your satellite server and run the command below as root.

# foreman-rake foreman_openscap:bulk_upload:default

Screenshot from 2019-07-26 17-02-22.png

By default only a few content files are added.

Installing Additional SCAP Content

This can be done via the UI (and possibly via the CLI, however I have not attempted this).

In this example I have already downloaded RHEL 8 content from here.

Log into the Satellite UI, and navigate to “Hosts” > “SCAP content”

Select “Upload New SCAP Content”

Screenshot from 2019-07-26 17-09-14.png

And select Choose File to select a file from your local machine.

Screenshot from 2019-07-26 17-20-54.png

(more…)

OpenSCAP Part 3: Running Scans from the Command Line in RHEL 7

centos Compliance Linux Redhat rhel7 Security

07/25/2019

openscap-base

Introduction

In part 1 of this series we were introduced to OpenSCAP and the process of running scans via the SCAP workbench. In part 2, we explored concepts and components that define security/vulnerability scans. In this 3rd post we are going to dive into the command line operation.

Let’s get started with oscap.

Installing oscap

In RHEL 7 oscap can be installed with the following command

# yum -y install scap-security-guide openscap-scanner

Content is installed under the following directory. Note that ssg is short for SCAP Security Guide.

/usr/share/xml/scap/ssg/content

Lets change directories to the one listed above and view the installed files.

Screenshot from 2019-07-24 15-58-04

Using oscap we can view more info on each file shown above. In this example we are going to inspect the ssg-rhel7-ds.xml file.

# oscap info ssg-rhel7-ds.xml

(more…)

OpenSCAP Part 2: SCAP Content for RHEL 7

centos Compliance Redhat rhel7 Security

07/25/2019

openscap-base

Introduction

In part one of the OpenSCAP series we were introduced to the basic usage of the OpenSCAP toolset. In that post we learned how to run a basic scan via the scap-workbench in a desktop environment.

This post will focus on the Content, Profiles, and Targets.

Content

All content will be installed in the directory shown below. The content in this directory will vary based on the installed OS (the content on my Fedora differs from RHEL for example).

/usr/share/xml/scap/ssg/content

The screenshot below contains a list of content installed by default on RHEL 7.

Screenshot from 2019-07-24 15-58-04.png

Additional content can be obtained and added to the content directory shown above. For example, NIST content can be downloaded directly from the NIST website. Link below.

National Checklist Program Repository

In the screenshot below we have performed a search for all content that targets RHEL 7.6

Screenshot from 2019-07-25 11-45-44.png

(more…)

OpenSCAP Part 1: Introduction and Basic Usage for RHEL 7/CentOS 7/Fedora

centos Compliance Redhat rhel7 Security

07/23/2019

openscap-base

Introduction

OpenSCAP is a standardized compliance solution for Linux. It is comprised of policies (NIST, STIG, etc) and tooling (oscap, scap-workbench) that allow you to scan and evaluate Linux hosts in order to validate their compliance with industry defined standards.

In addition to providing industry standard compliance rules, OpenSCAP also allows administrators to create custom compliance standards using the scap-workbench.

Administrators can then generate remediation files in bash, ansible or puppet.

Let’s get familiar with OpenSCAP below.

Getting Started

Below is an overview of the “Getting Started” workflow. In this workflow we are gonna run through a very simple use-case, scanning your local Fedora workstation.

Install
Choose Policy
Modify/Adjust
Scan
Remediate

In the sections below we will walk through each of these steps in detail.

(more…)

Red Hat Satellite 6.x: Restarting Services

Redhat rhel7 satellite

07/03/2019

Introduction

Red Hat Satellite consists of a number of running services. Restarting each service manually can be painful. Luckily you can use the commands below to easily restart all services.

List Services

Run the command below to view a list of all Satellite services that are started at boot.

# katello-service list
Redirecting to ‘foreman-maintain service’
Running Service List
========================================================================
List applicable services:
dynflowd.service enabled
foreman-proxy.service enabled
httpd.service enabled
postgresql.service enabled
pulp_celerybeat.service enabled
pulp_resource_manager.service enabled
pulp_streamer.service enabled
pulp_workers.service enabled
puppetserver.service enabled
qdrouterd.service enabled
qpidd.service enabled
rh-mongodb34-mongod.service enabled
smart_proxy_dynflow_core.service enabled
squid.service enabled
tomcat.service enabled

All services listed [OK]

Check Service Status

The command below will check the status of all Satellite services. The output is similar to running a systemctl status on all Satellite specific services. The output can be quite verbose.

# katello-service status

Stop Services

Use the command below to stop all Satellite services.

# katello-service stop

Start Services

Use the command below to start all Satellite services.

# katello-service start

Restart Services

The command below will restart all Satellite services.

# katello-service restart

RHEL7: Install RHV Guest Agent and Drivers

Redhat rhel7 RHEV

07/02/2019

howto-draw-octopuses-tutorials_html_101880e

About the Guest Agent

The RHEL 7.x virtual machine guest agent in RHV 4.x provides drivers, additional data, and functionality once installed on a RHEL virtual machine.

The guest agent includes:

virtio-net paravirtualized network driver
virtio-scsi paravirtualized HDD driver
virtio-balloon driver which improves memory overcommit (currently not used by RHV)
rhevm-guest-agent common which allows RHV to retrieve guest internal information such as IP addresses and allows RHV to gracefully reboot the guest

You can view the entire list here.

When spawning a virtual machine in RHV without the guest agent, a warning will appear as an exclamation mark in RHV.

Screenshot from 2019-07-02 16-11-58

Register with Satellite

You can skip this step if your guest is already registered

In order to install the guest agent, I must first register the virtual machine with my local satellite. If not using a local satellite server, you can register with RHN.

First we need to grab the katello rpm from satellite – an insecure satellite server in this case as we are using a self-signed cert.

# curl -Ok https://satellite.lab.localdomain/pub/katello-ca-consumer-latest.noarch.rpm

Then install the rpm.

# rpm -ivh katello-ca-consumer-latest.noarch.rpm

Now register with Satellite. In the example below, we are using a custom activation key and organization.

# subscription-manager register –activationkey=”auburn-lab-ak” –org=”lab”

Installing the Guest Agent

You will need to ensure that the RHEL 7 RH Common repo is enabled. If the repo is not available to the guest, you will need to enable.

# yum repolist | grep common
!rhel-7-server-rh-common-rpms/7Server/x86_64 Red Hat Enterprise Linux 234

If the proper repo is enabled, then run the following command.

Once installed, the orange exclamation point will disappear.

Start and Enable the Guest Agent Service

# systemctl enable ovirt-guest-agent.service
# systemctl start ovirt-guest-agent.service

Like this:

Like this:

Like this:

Like this:

Like this:

Like this:

Like this:

Category: rhel7

Red Hat: Identity Management Server Setup and HA on RHEL 7

Introduction

Prerequisites

Like this:

OpenSCAP Part 4: Integration with Red Hat Satellite 6.5

Introduction

Installing SCAP Content on Satellite Server

Installing Additional SCAP Content

Like this:

OpenSCAP Part 3: Running Scans from the Command Line in RHEL 7

Introduction

Installing oscap

Like this:

OpenSCAP Part 2: SCAP Content for RHEL 7

Introduction

Content

Like this:

OpenSCAP Part 1: Introduction and Basic Usage for RHEL 7/CentOS 7/Fedora

Introduction

Getting Started

Like this:

Red Hat Satellite 6.x: Restarting Services

Introduction

List Services

Check Service Status

Stop Services

Start Services

Restart Services

Like this:

RHEL7: Install RHV Guest Agent and Drivers

About the Guest Agent

Register with Satellite

Installing the Guest Agent

Start and Enable the Guest Agent Service

Like this: