Harden a fresh host and prove each control

applied · 50 min · Objective 3.3

Before you start — what this lab needs

A disposable virtual machine you can rebuild, ideally from a snapshot so you can compare before and after:

dnf install -y openscap-scanner scap-security-guide fail2ban

Task

Take a default install and apply a coherent set of hardening controls, proving each one works rather than assuming it. Then run a benchmark scan, read its remediation before applying it, and re-scan to show the score moved.

Steps

Baseline: run an OpenSCAP evaluation against a CIS or STIG profile and record the score. oscap xccdf eval --profile <profile> --results before.xml /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml.
Disable password SSH and root login, and prove each with a connection attempt as in the SSH lab.
Set noexec,nosuid,nodev on /tmp via a bind mount or fstab, and prove it: copy a binary to /tmp, mark it executable, and confirm it will not run.
Turn on fail2ban for sshd with ignoreip set first, and prove a ban from a non-exempt address.
Confirm SELinux is Enforcing and stays so across a reboot; if it was Permissive, fix it and relabel.
Generate the remediation for one failing rule with oscap xccdf generate fix, READ it before running it, apply it, and explain one change it made that you would not have wanted applied blindly.
Re-scan into after.xml and confirm the score improved. Diff the two result files to see exactly which rules changed state.

Verify

oscap xccdf eval --profile "$PROFILE" --results after.xml "$DS" | grep -i 'score'
sshd -T | grep -Ei 'passwordauthentication no|permitrootlogin no'
cp /bin/true /tmp/x && chmod +x /tmp/x && (/tmp/x && echo "EXEC ALLOWED -- fail") || echo "noexec holds"
getenforce
fail2ban-client status sshd | grep -i banned

The score in after.xml must be higher than in before.xml, and every proof in between must pass. The improvement is real only because each control was demonstrated, not merely configured.

Notes

Step 6 is the discipline that keeps automated remediation safe. oscap generate fix produces a script that will happily disable a service your application needs or tighten a setting that breaks a workload. It is a proposal to read, not an instruction to run.