IT Monger: 2026

Wednesday, September 2, 2026

Part 3 - Install & STIG a Red Hat Enterprise Linux 10.x (RHEL10) Server

Part 3 of a 3 part series on how to built a DISA STIG compliant RHEL 10 server.

☐ Since we added an httpd server and made changes to the firewall in the last part, we need

to reboot the server and re-run the OpenSCAP scan just to be sure the scan picks up all the

changes.

# shutdown -r now

☐ SSh back into the RHEL10 server and re-run the scan with the --remediate option,

and then again without the --remediate option. (sometimes the remediation does not

work as expected)

$ sudo -i
[sudo] password for john: ********

# oscap xccdf eval --report /var/www/html/openscap/rhel10.html --profile stig --remediate /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

# oscap xccdf eval --report /var/www/html/openscap/rhel10.html --profile stig /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

☐ Refresh the RHEL 10 OpenSCAP evaluation report and note the change to the number

of failed rules.

☐ The first red highlighted fail we come to in the OpenSCAP evaluation report is:

"Only Authorized Local User Accounts Exist on Operating System". Click on the entry and

read through what the rule is looking for.

☐ We can use a "tailoring.xml" file with the oscap scan command to modify the test

criteria and override the authorized local users test. This will allow for our admin

user and the other default accounts that were created during the install. On our test

system we will add the following as authorized accounts: "yggdrasil-worker", "yggdrasil",

"john", "apache", "unbound", "fapolicyd", and "postfix". (replace john with the admin

username you added in part 1)

# cd /usr/share/xml/scap/ssg/content

# vim rhel10-tailoring.xml

<?xml version="1.0" encoding="UTF-8"?>

<title xml:lang="en">RHEL 10 STIG with Authorized Local Users Customization</title>

<description xml:lang="en">Customized local user account rules.</description>

</Profile>

</Tailoring>

☐ Re-run the scan using the --tailoring-file option. (From now on we need to use the --tailoring-file option when we run the OpenSCAP scan.)

# oscap xccdf eval --tailoring-file /usr/share/xml/scap/ssg/content/rhel10-tailoring.xml --report /var/www/html/openscap/rhel10.html --profile xccdf_org.ssgproject.content_profile_stig_customized /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

☐ Refresh the RHEL 10 OpenSCAP evaluation report and notice that the medium (cat 2) rules

dropped from 5 to 4 and that the "Only Authorized Local User Accounts Exist on Operating System"

rule passed.

☐ Now the first red highlighted failed rule we come to in the OpenSCAP evaluation report is:

"Set the Boot Loader Admin Username to a Non-Default Value" followed by

"Set Boot Loader Password in grub2". Click on each entry and read through what the rules

are looking for.

Here is a simplified solution to fix both of these Cat 1 findings:

☐ Edit the /etc/grub.d/01_users file and replace the root user account name with something else (in this example csadm means cybersecurity admin):

# vi /etc/grub.d/01_users

#!/bin/sh -e

cat << EOF

if [ -f \${prefix}/user.cfg ]; then

source \${prefix}/user.cfg

if [ -n "\${GRUB2_PASSWORD}" ]; then

set superusers="csadm"

export superusers

password_pbkdf2 csadm \${GRUB2_PASSWORD}

EOF

<ESC>:wq

☐ Set the UEFI Boot Loader Password

# grub2-setpassword

Enter password: **********

Confirm password: **********

☐ Generate a new GRUB configuration file

# grub2-mkconfig -o /boot/grub2/grub.cfg
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done

☐ Reboot the system, log back in and re-run the scan as the root user and view the new report and check to make sure the high (Cat 1) violations were taken care of.

# shutdown -r now

...

$ sudo -i

Good Job, we are down to just 4 medium (cat2) findings and no high (cat 1) findings.

☐ The next red highlighted failed rule we come to is: "Configure Multiple DNS Servers

in /etc/resolve.conf". Click on the entry and read through what the rule is looking for.

☐ In a production environment these should be internal DNS server entries, for our test system

we can just add google's DNS server (8.8.8.8) or Cloud flare's (1.1.1.1) using the Network Manager

Command Line Interface (nmcli).

# nmcli connection show --active

NAME UUID TYPE DEVICE

enp1s0 cd739700-07ed-3ca8-b971-637c1a013e21 ethernet enp1s0
lo 3c155504-c9bf-4e6d-903f-7a10e45239cb loopback lo

# nmcli connection show enp1s0|grep -i ip4.dns
IP4.DNS[1]: 192.168.122.1
# nmcli connection modify enp1s0 +ipv4.dns "8.8.8.8"

# nmcli connection up enp1s0
Connection successfully activated (D-Bus active path:

/org/freedesktop/NetworkManager/ActiveConnection/3)
# nmcli connection show enp1s0|grep -i ip4.dns
IP4.DNS[1]: 8.8.8.8
IP4.DNS[2]: 192.168.122.1

☐ Re-run the oscap scan and examine the results.

☐ We should now be down to 3 medium (cat 2) failed rules. the next highlighted failed

rule is: "Elevate The SELinux Context When An Administrator Calls The Sudo Command". Click on the entry and read through what the rule is looking for.

The fix:

# cd /etc/sudoers.d

# visudo -f selinux.conf
%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL

<ESC>
:wq

# chmod 755 selinux.conf
(note this can break your ability to sudo if it is wrong, and you will need to login as root from the console and delete the file and start over, ask me how I know)

☐ Re-run the oscap scan and examine the results.

☐ We should now be down to 2 medium (cat 2) failed rules. the next highlighted failed

rule is: "Enable the SSSD Service" followed by "Enable Certmap in SSSD".

We need to modify the /etc/sssd/sssd.conf so that it exactly matches the following:

# vim /etc/sssd/sssd.conf
[sssd]
services = nss, pam
domains = local_files
certificate_verification = ocsp_dgst=sha512

[domain/local_files]
# RHEL 10 replacement for legacy 'files' provider
id_provider = proxy
proxy_lib_name = files

# Use proxy module pointing to standard system pam loops instead of legacy
auth_provider = proxy
proxy_pam_target = sssd-shadowutils

access_provider = permit
cache_credentials = true

[certmap/local_files/rule_name]
matchrule = <SAN>.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = local_files

[pam]
offline_credentials_expiration=1
pam_cert_auth=True

<ESC>:wq

# systemctl enable sssd --now
# systemctl status sssd
● sssd.service - System Security Services Daemon
Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; preset: enabled)
Active: active (running) since Wed 2026-09-02 16:03:01 UTC; 5s ago
Invocation: 6d8c9ab5dfb54ec8bb415b40c66585d9

...

☐ Re-run the oscap scan and examine the results.

☐ OK, the report now says we passed all tests, but just to be sure, we need to reboot and re-run the scan one last time (hopefully)/

# shutdown -r now

☐ SSh back into the RHEL10 server and re-run the scan

# sudo -i

CONGRATULATIONS!

You have built a DISA STIG'd Red Hat Enterprise Linux 10 server.

It is a good idea to read through all of the rules marked "notchecked" on the report so

you are familiar with potential issues that could come up in an audit/inspection. For instance the STIG calls for disk partitions to be encrypted, but the OpenSCAP tool does not check for it. In this example build we didn't bother doing it, but in typical production environments the underlying hypervisor would be configured to encrypt it's physical hard drives, making encrypting virtual disks redundant.

Part 2 - Install & STIG a Red Hat Enterprise Linux 10.x (RHEL10) Server

Part 2 of a 3 part series on how to built a DISA STIG compliant RHEL 10 server.

In this part we will setup OpenSCAP and demonstrate how to use it to scan a Red

Hat Enterprise Linux 10 (RHEL10) server for DISA STIG compliance and generate an

interactive web based report.

(Replace john with the admin account name created in Part 1)

☐ Open an SSH session back into the RHEL 10 server and install opensecap-scanner

and scap-security-guide with the following commands in bold.

$ sudo -i
[sudo] password for john:*********
# dnf install openscap-scanner scap-security-guide
Updating Subscription Management repositories.
Last metadata expiration check: 1:10:34 ago on Wed 02 Sep 2026 10:29:07 AM UTC.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
openscap-scanner
x86_64 1:1.4.4-1.el10_2 rhel-10-for-x86_64-appstream-rpms 59 k
scap-security-guide
noarch 0.1.81-1.el10_2 rhel-10-for-x86_64-appstream-rpms 823 k
Installing dependencies:
libtool-ltdl x86_64 2.4.7-13.el10 rhel-10-for-x86_64-appstream-rpms 38 k
libxslt x86_64 1.1.39-8.el10_2.1 rhel-10-for-x86_64-appstream-rpms 197 k
openscap x86_64 1:1.4.4-1.el10_2 rhel-10-for-x86_64-appstream-rpms 2.0 M
xmlsec1 x86_64 1:1.2.39-3.el10 rhel-10-for-x86_64-appstream-rpms 197 k
xmlsec1-openssl
x86_64 1:1.2.39-3.el10 rhel-10-for-x86_64-appstream-rpms 99 k

Transaction Summary
================================================================================
Install 7 Packages

Total download size: 3.4 M
Installed size: 108 M
Is this ok [y/N]: Y
...

Installed:
libtool-ltdl-2.4.7-13.el10.x86_64 libxslt-1.1.39-8.el10_2.1.x86_64
openscap-1:1.4.4-1.el10_2.x86_64 openscap-scanner-1:1.4.4-1.el10_2.x86_64
scap-security-guide-0.1.81-1.el10_2.noarch xmlsec1-1:1.2.39-3.el10.x86_64
xmlsec1-openssl-1:1.2.39-3.el10.x86_64

Complete!

☐ To streamline the iterative process of fixing, re-scanning and viewing the OpenSCAP report. We will temporarily enable a web server on the RHEL 10.x server we are

working on. Follow the commands below in bold.

# dnf install httpd

Updating Subscription Management repositories.
Last metadata expiration check: 1:17:45 ago on Wed 02 Sep 2026 10:29:07 AM UTC.
Dependencies resolved.
====================================================================================================
Package Arch Version Repository Size
====================================================================================================
Installing:
httpd x86_64 2.4.63-13.el10_2.6 rhel-10-for-x86_64-appstream-rpms 56 k
Installing dependencies:
apr x86_64 1.7.5-3.el10 rhel-10-for-x86_64-appstream-rpms 127 k
apr-util x86_64 1.6.3-23.el10_1 rhel-10-for-x86_64-appstream-rpms 103 k
apr-util-lmdb x86_64 1.6.3-23.el10_1 rhel-10-for-x86_64-appstream-rpms 20 k
httpd-core x86_64 2.4.63-13.el10_2.6 rhel-10-for-x86_64-appstream-rpms 1.5 M
httpd-filesystem noarch 2.4.63-13.el10_2.6 rhel-10-for-x86_64-appstream-rpms 20 k
httpd-tools x86_64 2.4.63-13.el10_2.6 rhel-10-for-x86_64-appstream-rpms 90 k
redhat-logos-httpd noarch 100.3-2.el10 rhel-10-for-x86_64-appstream-rpms 22 k
Installing weak dependencies:
apr-util-openssl x86_64 1.6.3-23.el10_1 rhel-10-for-x86_64-appstream-rpms 22 k
mod_http2 x86_64 2.0.29-4.el10_2.2 rhel-10-for-x86_64-appstream-rpms 171 k
mod_lua x86_64 2.4.63-13.el10_2.6 rhel-10-for-x86_64-appstream-rpms 66 k

Transaction Summary
====================================================================================================
Install 11 Packages

Total download size: 2.2 M
Installed size: 6.0 M
Is this ok [y/N]: Y

...

Installed:
apr-1.7.5-3.el10.x86_64 apr-util-1.6.3-23.el10_1.x86_64
apr-util-lmdb-1.6.3-23.el10_1.x86_64 apr-util-openssl-1.6.3-23.el10_1.x86_64
httpd-2.4.63-13.el10_2.6.x86_64 httpd-core-2.4.63-13.el10_2.6.x86_64
httpd-filesystem-2.4.63-13.el10_2.6.noarch httpd-tools-2.4.63-13.el10_2.6.x86_64
mod_http2-2.0.29-4.el10_2.2.x86_64 mod_lua-2.4.63-13.el10_2.6.x86_64
redhat-logos-httpd-100.3-2.el10.noarch

Complete!

☐ Setup DISA STIG compliant firewall rules to allow viewing of the the OpenSCAP report.

(Modify the IP network address below to match ifconfig command output on the VM)

# firewall-cmd --zone=drop --add-service=ssh --permanent

success

# firewall-cmd --set-default-zone=drop

success

# firewall-cmd --zone=public --add-source="192.168.122.0/24" --permanent
success
# firewall-cmd --zone=public --add-service=http --permanent
success
# firewall-cmd --reload
success

☐ Complete the web server setup

# systemctl enable --now httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.

# mkdir /var/www/html/openscap

# ls -l /var/www/html
total 0
drwx------. 2 root root 6 Sep 2 10:43 openscap

# chmod 755 /var/www/html/openscap

# ls -l /var/www/html
total 0
drwxr-xr-x. 2 root root 6 Sep 2 10:43 openscap

total 0

☐ Verify OpenSCAP is installed correctly.

# oscap info --profile stig /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml
Document type: Source Data Stream
Imported: 2026-06-01T00:00:00

Stream: scap_org.open-scap_datastream_from_xccdf_ssg-rhel10-xccdf.xml
Generated: 2026-06-01T00:00:00
Version: 1.3
Profile
Title: Red Hat STIG for Red Hat Enterprise Linux 10
Id: xccdf_org.ssgproject.content_profile_stig

Description: This is a profile based on what is expected in the RHEL 10 STIG.

It is not based on the DISA STIG for RHEL 10, because it was not available at time

of the release. In addition to being applicable to Red Hat Enterprise Linux 10,

this configuration baseline is applicable to the operating system tier of Red Hat

technologies that are based on Red Hat Enterprise Linux 10.

☐ Run the DISA STIG OpenSCAP scan for the first time and specify the web directory in the report output parameter using the commands below in bold.

# oscap xccdf eval --report /var/www/html/openscap/rhel10.html --profile stig /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

☐ Modify the file permissions of the report so it can be viewed via the web server

# chmod 755 /var/www/html/openscap/rhel10.html

☐ Access the DISA STIG web report using a browser and the URL below:

http://192.168.x.x/openscap/rhel10.html (use ifconfig command to find IP)

Note the number of failed rules from the "Compliance and Scoring" section of the report.

☐ Now we will re-run the oscap command using the "--remediate" option to tell OpenSCAP to attempt to fix all of the problems that the scan finds. This is the modified scan command.

# oscap xccdf eval --report /var/www/html/openscap/rhel10.html --profile stig --remediate /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

☐ Refresh the OpenSCAP web report and note the new number of failed rules. In this example the number of failed rules went from 276 down to 6.

The "--remediate" option fixed 99% of the failed rules. In part 3 of this article we will dig into each of the remaining failed rules and manually fix the issues.

Part 1 - Install & STIG a Red Hat Enterprise Linux 10.x (RHEL10) Server

Part 1 of a 3 part series on how to built a DISA STIG compliant RHEL 10 server.

These instructions will walk you through building a virtual RHEL 10.x server and applying the DISA (Defense Information Systems Agency) STIG (Security Technical Implementation Guide). We will use OpenSCAP, an open-source tool designed for automated security auditing and compliance management based on the Security Content Automation Protocol (SCAP).

All this will be demonstrated using the KVM (Kernel-based Virtual Machine) hypervisor module and QEMU (Quick Emulator), a free open-source hypervisor and machine emulator, all running on a Debian based version of Linux. This article will show you how to get QEMU, KVM and virt-manager up and running.

Setting Up Virtual Machines with QEMU, KVM, and Virt-Manager on Debian/Ubuntu

You should also be proficient in editing text files using the standard VIsual editor (vi)

or the VI Improved editor (vim).

You will need a bootable ISO file of RHEL 10.x which you can obtain by creating a free account on https://developers.redhat.com/ and downloading the latest x86_64 DVD ISO from :

https://developers.redhat.com/products/rhel/download#downloadsbyrelease.

In this example the ISO file will be saved in a folder named 'ISO' in the /opt directory on the host/hypervisor system.

The STIG requires separate disk partitions, or volumes, be created for different functional parts of the operating system. At a minimum this will insure that if a rouge process overloads the system with logging it will not fill up the root volume and crash the system, thus enabling you to still be able to login and fix the problem.

The Disk partitioning layout is presented here for virtual disk space requirements and will be referred back to later during the operating system (OS) install.

Recommended disk partition/volume sizes:

Mount Point	Recommended Size	Minimum Size	Notes
/boot	1G	1G	Use '/boot' from Mount Point menu
/boot/efi	1G	512M	Use '/boot/efi' from Mount Point menu
/	20G	10G	Use '/' from Mount Point menu
/home	20G	5G	Use '/home' from Mount Point menu
/var	20G	8G	Use '/var' from Mount Point menu
Swap	8G	4G	Use 'swap' from Mount Point menu Up to 1/2 size of RAM
/tmp	10G	8G	Enter '/tmp' for the Mount Point
/var/tmp	2G	1G	Enter '/var/tmp' for the Mount Point
/var/log	2G	1G	Enter '/var/log' for the Mount Point
/var/log/audit	2G	1.5G	Enter '/var/log/audit' for the Mount Point
Total	86G	40G	disk space

(Yes the swap sizes are overkill for the small test system presented here, but most of the production RHEL systems I manage have way more than 16G of RAM.)

Assuming you have KVM and QEMU installed and working correctly, let's get started.

To change things up we will use the qemu-img and virt-instal commands to create out virtual machine instead of doing it through the Virtual Machine manager GUI.

Open a terminal session to your hypervisor system and run the following command to create the QEMU virtual disk we will install RHEL on.

☐ Create virtual disk image

$ sudo qemu-img create -f qcow2 /var/lib/libvirt/images/rhel10.qcow2 86G
Formatting '/var/lib/libvirt/images/rhel10.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=92341796864 lazy_refcounts=off refcount_bits=16

☐ Verify virtual disk image

$ sudo qemu-img info /var/lib/libvirt/images/rhel10.qcow2
image: /var/lib/libvirt/images/rhel10.qcow2
file format: qcow2
virtual size: 86 GiB (92341796864 bytes)
disk size: 196 KiB
cluster_size: 65536
Format specific information:
compat: 1.1
compression type: zlib
lazy refcounts: false
refcount bits: 16
corrupt: false
extended l2: false
Child node '/file':
filename: /var/lib/libvirt/images/rhel10.qcow2
protocol type: file
file length: 194 KiB (198144 bytes)
disk size: 196 KiB

☐ Create the VM. This command will launch the virtual machine

viewer application on the host hypervisor system.

$ sudo virt-install \
--name rhel10 \
--vcpus 2 \
--ram 2048 \
--disk path=/var/lib/libvirt/images/rhel10.qcow2 \
--os-variant rhel10.0 \
--network network=default \
--boot uefi \
--cdrom /opt/ISO/rhel-10.2-x86_64-dvd.iso \
--graphics spice

NOTE: If the hypervisor system truly does not have a GUI/desktop environment,

you can set the --graphical option to "none" along with some extra parameters

to allow fully text based install. The RHEL install program does support a

text only mode of installation. You could also use the --graphics option to

configure the VM to listen for a virtual network console (VNC) connection and

run the GUI installer remotely.

☐ Select "Install Red Hat Enterprise Linux 10.x in FIPS mode" to start the install.

☐ On the following screen select "English (United States)" and press the "Continue" button.

☐ This is the "Installation Summary" screen. After configuring each item below the installation

program will return here.

☐ Select "Network & Host Name", take note of the IP Address of the server, and enter a hostname

and click the "Apply" button followed by the "Done" button.

☐ Back on the "Installation Summary" screen select "Time & Date" and set the Time zone to

Region: "Etc" and City: "Coordinated Universal Time".

☐ Now click on the "Configure NTP" button

☐ Click the "+ Add" button and enter "time.google.com" in the input field and press enter.

Highlight the rhel.pool.ntp.org entry and click the "- Remove" button and then click the "OK"

button followed by the "Done" button on the "Time & Date" screen.

(In a production environment enter your local timeserver instead of the one from Google.)

☐ Back on the "Installation Summary" screen select "Root Account" and the "Enable root account"

radio button. Enter and confirm the root account password and click the "Done" button.

☐ Back on the "Installation Summary" screen select "User Creation" and enter your primary

admin user name and password and press the "Done" button.

☐ Back on the "Installation Summary" screen select "Software Selection" and choose the "Server"

radio button followed by the "Done" button.

☐ Back on the "Installation Summary" screen select "Installation Destination" and on the

next screen verify the disk with the correct size is selected with a check mark.

☐ Under "Storage Configuration" select the "Custom" option and click the "Done" button.

☐ On the Manual Partitioning screen use the "+" button to add the 1st partition.

☐ Select "/boot" from the drop-down menu for the "Mount Point", then enter "1G"

for the "Desired Capacity" and click the "Add mount point" button.

☐ Use the "+" button on the "Manual Partitioning" screen to repeat the above step for every partition listed in the "Recommended disk partition/volume sizes" table at top

of this document.

☐ After adding all of the partitions click the "Done" button.

☐ Now click the "Accept Changes" button.

☐ Finally back on the "Installation Summary" screen click the "Begin Installation" button.

☐ Installation will take several minutes to complete.

☐ Click the "Reboot system" button.

☐ Login to the console that pops up with your admin user account.

☐ For the system to get updates, register it with Red Hat using your developer account and the following command.

$ sudo subscription-manager register

☐ Enter your password for sudo and then your Red Hat developer login ID followed by your password.

(You may need to go back to the Red Hat site and create a login ID to use with subscription-manager.)

☐ After successful registration the subscription-manager command should return an ID and state "The registered system name is: hostname" .

☐ Run the following commands to update/patch the system.

$ sudo -i

# dnf repolist

# dnf update

☐ Answer "Y" to go ahead and patch the system.

☐ Answer "Y" when prompted to import GPG keys.

☐ Now let's reboot the system (just for good measure) using this command.

$ shutdown -r now

☐ Log back in using your administrator account and run this command to find the system's IP address.

$ ifconfig

☐ Now that we can see what the IP address is, we should be able to ssh to the RHEL10 virtual server from the host/hypervisor. Open a local terminal window and try logging in using SSH with your admin account.

$ ssh admin@192.168.x.x (see ifconfig output for IP address)

☐ Now by using SSH from a terminal window we can cut and paste to and from the session, whereas we could not do that using the virtual console.

☐ Logout of the virtual machine console by typing "exit" and pressing enter, then

close the window using the "x" at the top right.

☐ Using the SSH terminal session you opened earlier lets install the Extra Packages

for Enterprise Linux (EPEL). This provides an additional repository of packages that

are not strictly speaking necessary or essential to the OS, but contains a lot of

'nice to have' stuff. Use the following commands in bold to install EPEL for RHEL 10.

$ sudo -i
# subscription-manager repos --enable codeready-builder-for-rhel-10-$(arch)-rpms
# curl -fsSL https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 -o /tmp/RPM-GPG-KEY-EPEL-10
# rpm --import /tmp/RPM-GPG-KEY-EPEL-10
# dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm

☐ Answer 'Y' to install the "epel-release" package.

☐ Lets check status of our current repos and then install and run 'htop' to test if EPEL

is working. Use the following commands in bold.

# yum repolist

☐ Test EPEL access by installing htop

# yum install htop (answer 'Y' when prompted)

Updating Subscription Management repositories.
Extra Packages for Enterprise Linux 10 - x86_64 6.6 MB/s | 6.6 MB 00:01
Last metadata expiration check: 0:00:01 ago on Tue 01 Sep 2026 08:12:59 PM UTC.
Dependencies resolved.
====================================================================================================
Package Architecture Version Repository Size
====================================================================================================
Installing:
htop x86_64 3.3.0-5.el10_0 epel 196 k
Installing dependencies:
hwloc-libs x86_64 2.11.1-4.el10 rhel-10-for-x86_64-baseos-rpms 2.1 M
ocl-icd x86_64 2.3.2-8.el10 rhel-10-for-x86_64-baseos-rpms 69 k

Transaction Summary
====================================================================================================
Install 3 Packages

Total download size: 2.3 M
Installed size: 3.5 M
Is this ok [y/N]: y

# htop (press F10 or 'q' to exit)

☐ You might see an error after exiting htop, which can be easily fixed by creating

a '.config' directory in the root user's home directory.

# htop
Can not save configuration to /root/.config/htop/htoprc: No such

file or directory
# mkdir .config
# htop
#

# exit
logout
$ exit
logout
Connection to 192.168.122.166 closed.

In Part 2 we will setup OpenSCAP and demonstrate how to use it to create a STIG

check web report.