RHEL8 kickstart hardening

Posted on

Hey folks, I thought it would be interesting to see if I can get a kickstart going for the RHEL8 beta. At the moment I can't seem to get past "Starting Terminate Plymouth Boot Screen", and I have built my first RHEL8 kickstart by going off a manual install. Ideally I would like to get it to boot before I start adding more settings off security guidelines.

###############################################################################
# Kickstart Configuration # RHEL8 Beta
###############################################################################
ignoredisk --only-use=sda

# Use graphical install
text
repo --name="AppStream" --baseurl=file:///run/install/repo/AppStream
# Use CDROM installation media
cdrom
# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8


# Root password Pa33w0rd
rootpw --iscrypted $6$4ef.MRK/MN8Za2X6$0qOE9yvguFoWD9S.52nq1//j/ChBPIQUqDDavDUr7IlsCUi9geKh0nYMrEeZGhnPNr0BLL.P1RWPgAMjXIxQr/
# Run the Setup Agent on first boot
firstboot --enable
# Do not configure the X Window System
skipx
# System services
services --enabled="chronyd"
# System timezone
timezone America/Chicago --isUtc
user --groups=wheel --name=ladmin --password=$6$lkBbrwF/FI7Zf7qC$kFCsXBoESCe5/EU1AVLJlRTacXKaQ8Wn9BM9FQW/I2RxfUBMtO2/vaoJSRqVfdhrLroQs9c2529DjJsR0YDhk. --iscrypted --gecos="ladmin"


# Initialize (format) all disks (optional)
zerombr
# Partition clearing information
clearpart --none --initlabel

# Create primary system partitions (required for installs)
part /boot --fstype=xfs --size=512
part pv.01 --grow --size=1

# Create a Logical Volume Management (LVM) group (optional)
volgroup VolGroup --pesize=4096 pv.01

# Create particular logical volumes (optional)
logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=12288 --grow
# CCE-26557-9: Ensure /home Located On Separate Partition
logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev"
# CCE-26435-8: Ensure /tmp Located On Separate Partition
logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid"
# CCE-26639-5: Ensure /var Located On Separate Partition
logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048 --fsoptions="nodev"
# CCE-26215-4: Ensure /var/log Located On Separate Partition
logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 --fsoptions="nodev"
# CCE-26436-6: Ensure /var/log/audit Located On Separate Partition
logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 --fsoptions="nodev"
logvol swap --name=lv_swap --vgname=VolGroup --size=2016


%packages
@^minimal-environment 

%end

%addon com_redhat_kdump --disable --reserve-mb='auto'

%end

# TODO add NIST hardening settings
%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end

Responses