Skip to content

Commit

Permalink
rocky-linux#1867 fix markdown violation in books
Browse files Browse the repository at this point in the history
  • Loading branch information
nishaaaaaant committed Apr 9, 2024
1 parent 0fae6c5 commit 2ef09d8
Show file tree
Hide file tree
Showing 37 changed files with 828 additions and 816 deletions.
4 changes: 2 additions & 2 deletions docs/books/disa_stig/disa_stig_part1.md
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ DISA STIG partitioning scheme for a 30G disk. My use case is as a simple web ser

![Accept Changes](images/disa_stig_pt1_img9.jpg)

### Step 5: Configure software for your environment: Server install without a GUI.
### Step 5: Configure software for your environment: Server install without a GUI

This will matter in **Step 6**, so if you are using a UI or a workstation configuration the security profile will be different.

Expand Down Expand Up @@ -132,7 +132,7 @@ In later tutorials we can get into joining this to a FreeIPA enterprise configur

![Reboot](images/disa_stig_pt1_img18.jpg)

### Step 11: Log in to your STIG'd Rocky Linux 8 System!
### Step 11: Log in to your STIG'd Rocky Linux 8 System

![DoD Warning](images/disa_stig_pt1_img19.jpg)

Expand Down
29 changes: 17 additions & 12 deletions docs/books/disa_stig/disa_stig_part2.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Over time, these things could change and you will want to keep an eye on it. Fre

To list the security profiles available, we need to use the command `oscap info` provided by the `openscap-scanner` package. This should already be installed in your system if you've been following along since Part 1. To obtain the security profiles available:

```
```bash
oscap info /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml
```

Expand All @@ -48,11 +48,11 @@ DISA is just one of many Security Profiles supported by the Rocky Linux SCAP def
There are two types to choose from here:

* stig - Without a GUI
* stig_gui - With a GUI
* stig_gui - With a GUI

Run a scan and create an HTML report for the DISA STIG:

```
```bash
sudo oscap xccdf eval --report unit-test-disa-scan.html --profile stig /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml
```

Expand All @@ -69,15 +69,18 @@ And will output an HTML report:
Next, we will generate a scan, and then use the results of the scan to generate a bash script to remediate the system based on the DISA stig profile. I do not recommend using automatic remediation, you should always review the changes before actually running them.

1) Generate a scan on the system:
```

```bash
sudo oscap xccdf eval --results disa-stig-scan.xml --profile stig /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml
```

2) Use this scan output to generate the script:
```
sudo oscap xccdf generate fix --output draft-disa-remediate.sh --profile stig disa-stig-scan.xml

```bash
sudo oscap xccdf generate fix --output draft-disa-remediate.sh --profile stig disa-stig-scan.xml
```

The resulting script will include all the changes it would make the system.
The resulting script will include all the changes it would make the system.

!!! warning

Expand All @@ -90,12 +93,15 @@ The resulting script will include all the changes it would make the system.
You can also generate remediation actions in ansible playbook format. Let's repeat the section above, but this time with ansible output:
1) Generate a scan on the system:
```bash
sudo oscap xccdf eval --results disa-stig-scan.xml --profile stig /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml
```
sudo oscap xccdf eval --results disa-stig-scan.xml --profile stig /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml
```
2) Use this scan output to generate the script:
```
sudo oscap xccdf generate fix --fix-type ansible --output draft-disa-remediate.yml --profile stig disa-stig-scan.xml
```bash
sudo oscap xccdf generate fix --fix-type ansible --output draft-disa-remediate.yml --profile stig disa-stig-scan.xml
```
!!! warning
Expand All @@ -109,4 +115,3 @@ You can also generate remediation actions in ansible playbook format. Let's repe
Scott Shinn is the CTO for Atomicorp, and part of the Rocky Linux Security team. He has been involved with federal information systems at
the White House, Department of Defense, and Intelligence Community since 1995. Part of that was creating STIG’s and the requirement
that you use them and I am so very sorry about that.
Loading

0 comments on commit 2ef09d8

Please sign in to comment.