RHEL8 server bricked after STIG install

Latest response

I have run into this twice now.

I used the DISA STIG security profile to install RHEL 8.4.

During the installation I fully configured the connected NIC and told it to start automatically.

After the install finished, I rebooted and found that the network had not come up.

I tried to log into the console and the keyboard wouldn't work. It was a nice mechanical keyboard and I have seen issues at times with those, but mostly on KVMs. There was no KVM. I got a plain-jane Dell keyboard and attached it and got a message on the console that stated that the USB device was unauthorized.

Usbguard is supposed to start at boot and block unauthorized devices per this STIG finding:

https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2021-03-04/finding/V-230524

The key phrase there is unauthorized.

That would have been fine if the installer had run the usbguard configure routine, but it did not. Usbguard was running unconfigured and it was blocking everything, including the keyboard I had done the install with.

After installation of the usbguard package the installer should have run this command:

usbguard generate-policy > /etc/usbguard/rules.conf

That would have allowed the currently attached peripherals to work after a reboot.

The network failed to start because every NIC had ONBOOT=no set. Not sure if that is a STIG or a bug but it does seem to happen every time.

So, no ssh and no keyboard. I had to use a recovery CD to go in and fix the NIC and reboot to get SSH working. That allowed me to run the usbguard configuration and get the server fully operational.

So to my question: Is this the intended behavior of the installer, and if not, is it going to be fixed?

Responses