RHEL 8 STIG

17 items · Security · Hard difficulty · 1 day

Practical steps to implement the RHEL 8 STIG and track compliance.

• Download SCAP 1.3 content for RHEL 8 STIG (Ver 2, Rel 6)

  Get the official DISA SCAP 1.3 benchmark content for automated scanning.

• Download Standalone XCCDF and XCCDF-for-Ansible/Chef content

  Grab XCCDF files and automation content for your configuration management tool.

• Import SCAP/XCCDF content into your compliance tool

  Use OpenSCAP, SCC, or your SCAP-compatible scanner to load the content.

• Run an automated STIG scan against target RHEL 8 systems

  Scan desktops and servers to generate findings and severity ratings.

• Review scan results and prioritize high-severity findings

  Identify vulnerabilities and configuration deviations that require immediate remediation.

• Apply available security patches and package updates

  Install vendor updates and reboot systems if required to remediate CVEs.

• Harden SSH configuration per STIG

  Implement STIG SSH best-practices in /etc/ssh/sshd_config.

• Set PermitRootLogin to no

  Disable direct root SSH login to enforce account-based access.

• Disable SSH protocol 1 and weak ciphers/KEX algorithms

  Ensure only secure algorithms and Protocol 2 are allowed.

• Configure system authentication and password policies per STIG

  Set complexity, history, lockout, and max password age in PAM and /etc/login.defs.

• Enable and configure auditd to collect required logs

  Ensure audit rules capture login, privilege use, and system changes.

• Enable SELinux in enforcing mode and verify policies

  Confirm SELinux status and resolve AVC denials before production enforcement.

• Disable unnecessary services and remove unused packages

  Reduce attack surface by stopping and uninstalling nonessential services.

• Restrict access to cron, at, and scheduled task controls

  Lock down cron.allow/cron.deny and limit privileged scheduling.

• Verify and secure firewall and network configuration per STIG

  Configure nftables/iptables and host-based firewall rules to required policy.

• Document deviations, exceptions, and obtain formal acceptance

  Record any accepted waivers or mitigations with justification and approval.

• Schedule regular STIG rescans and update benchmark content

  Plan recurring scans and refresh SCAP/XCCDF content to stay current.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.