Part 1 - Install & STIG a Red Hat Enterprise Linux 10.x (RHEL10) Server

Part 1 of a 3 part series on how to built a DISA STIG compliant RHEL 10 server. 

These instructions will walk you through building a virtual RHEL 10.x server and applying the DISA (Defense Information Systems Agency) STIG (Security Technical Implementation Guide).  We will use OpenSCAP, an open-source tool designed for automated security auditing and compliance management based on the Security Content Automation Protocol (SCAP).

All this will be demonstrated using the KVM (Kernel-based Virtual Machine) hypervisor module and QEMU (Quick Emulator), a free open-source hypervisor and machine emulator, all running on a Debian based version of Linux.  This article will show you how to get QEMU, KVM and virt-manager up and running.

Setting Up Virtual Machines with QEMU, KVM, and Virt-Manager on Debian/Ubuntu 

You should also be proficient in editing text files using the standard VIsual editor (vi)

or the VI Improved editor (vim). 

You will need a bootable ISO file of RHEL 10.x which you can obtain by creating a free account on https://developers.redhat.com/ and downloading the latest x86_64 DVD ISO from :

https://developers.redhat.com/products/rhel/download#downloadsbyrelease.

In this example the ISO file will be saved in a folder named 'ISO' in the /opt directory on the host/hypervisor system.

The STIG requires separate disk partitions, or volumes, be created for different functional parts of the operating system.  At a minimum this will insure that if a rouge process overloads the system with logging it will not fill up the root volume and crash the system, thus enabling you to still be able to login and fix the problem.

The Disk partitioning layout is presented here for virtual disk space requirements and will be referred back to later during the operating system (OS) install.

Recommended disk partition/volume sizes:

Mount Point	Recommended Size	Minimum Size	Notes
/boot	1G	1G	Use '/boot' from Mount Point menu
/boot/efi	1G	512M	Use '/boot/efi' from Mount Point menu
/	20G	10G	Use '/' from Mount Point menu
/home	20G	5G	Use '/home' from Mount Point menu
/var	20G	8G	Use '/var' from Mount Point menu
Swap	8G	4G	Use 'swap' from Mount Point menu Up to 1/2 size of RAM
/tmp	10G	8G	Enter '/tmp' for the Mount Point
/var/tmp	2G	1G	Enter '/var/tmp' for the Mount Point
/var/log	2G	1G	Enter '/var/log' for the Mount Point
/var/log/audit	2G	1.5G	Enter '/var/log/audit' for the Mount Point
Total	86G	40G	disk space

(Yes the swap sizes are overkill for the small test system presented here, but most of the production RHEL systems I manage have way more than 16G of RAM.)

Assuming you have KVM and QEMU installed and working correctly, let's get started.

To change things up we will use the qemu-img and virt-instal commands to create out virtual machine instead of doing it through the Virtual Machine manager GUI.

Open a terminal session to your hypervisor system and run the following command to create the QEMU virtual disk we will install RHEL on.

☐ Create virtual disk image 

$ sudo qemu-img create -f qcow2 /var/lib/libvirt/images/rhel10.qcow2 86G
Formatting '/var/lib/libvirt/images/rhel10.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=92341796864 lazy_refcounts=off refcount_bits=16

☐ Verify virtual disk image 

$ sudo qemu-img info /var/lib/libvirt/images/rhel10.qcow2
image: /var/lib/libvirt/images/rhel10.qcow2
file format: qcow2
virtual size: 86 GiB (92341796864 bytes)
disk size: 196 KiB
cluster_size: 65536
Format specific information:
    compat: 1.1
    compression type: zlib
    lazy refcounts: false
    refcount bits: 16
    corrupt: false
    extended l2: false
Child node '/file':
    filename: /var/lib/libvirt/images/rhel10.qcow2
    protocol type: file
    file length: 194 KiB (198144 bytes)
    disk size: 196 KiB

☐ Create the VM. This command will launch the virtual machine

viewer application on the host hypervisor system. 

 

$ sudo virt-install \
--name rhel10 \
--vcpus 2 \
--ram 2048 \
--disk path=/var/lib/libvirt/images/rhel10.qcow2 \
--os-variant rhel10.0 \
--network network=default \
--boot uefi \
--cdrom /opt/ISO/rhel-10.2-x86_64-dvd.iso \
--graphics spice

 

NOTE: If the hypervisor system truly does not have a GUI/desktop environment,

you can set the --graphical option to "none" along with some extra parameters

to allow fully text based install. The RHEL install program does support a 

text only mode of installation. You could also use the --graphics option to

configure the VM to listen for a virtual network console (VNC) connection and 

run the GUI installer remotely. 

 

☐ Select "Install Red Hat Enterprise Linux 10.x in FIPS mode" to start the install.  

 

 ☐ On the following screen select "English (United States)" and press the "Continue" button.

 

☐ This is the "Installation Summary" screen. After configuring each item below the installation 

program will return here.  

 

☐ Select "Network & Host Name", take note of the IP Address of the server, and enter a hostname

and click the "Apply" button followed by the "Done" button. 

☐ Back on the "Installation Summary" screen select "Time & Date" and set the Time zone to

Region: "Etc" and City: "Coordinated Universal Time".

☐ Now click on the "Configure NTP" button

☐ Click the "+ Add" button and enter "time.google.com" in the input field and press enter.

Highlight the rhel.pool.ntp.org entry and click the "- Remove" button and then click the "OK"

button followed by the "Done" button on the "Time & Date" screen.

 

 

(In a production environment enter your local timeserver instead of the one from Google.)

☐ Back on the "Installation Summary" screen select "Root Account" and the "Enable root account"

radio button. Enter and confirm the root account password and click the "Done" button. 

 

☐ Back on the "Installation Summary" screen select "User Creation" and enter your primary

admin user name and password and press the "Done" button.

 

 ☐ Back on the "Installation Summary" screen select "Software Selection" and choose the "Server" 

radio button followed by the "Done" button.

 

☐ Back on the "Installation Summary" screen select "Installation Destination" and on the

next screen verify the disk with the correct size is selected with a check mark. 

☐ Under "Storage Configuration" select the "Custom" option and click the "Done" button.

☐ On the Manual Partitioning screen use the "+" button to add the 1st partition.

☐ Select "/boot" from the drop-down menu for the "Mount Point", then enter "1G"

for the "Desired Capacity" and click the "Add mount point" button.

 

☐ Use the "+" button on the "Manual Partitioning" screen to repeat the above step for every partition listed in the "Recommended disk partition/volume sizes" table at top

of this document.

 

 ☐ After adding all of the partitions click the "Done" button. 

 

 

 ☐ Now click the "Accept Changes" button.

 

☐ Finally back on the "Installation Summary" screen click the "Begin Installation" button. 

 ☐ Installation will take several minutes to complete. 

 

 

 ☐ Click the "Reboot system" button.

 

 

 ☐ Login to the console that pops up with your admin user account. 

 

☐ For the system to get updates, register it with Red Hat using your developer account and the following command.

 

    $ sudo subscription-manager register

 

☐ Enter your password for sudo and then your Red Hat developer login ID followed by your password.

(You may need to go back to the Red Hat site and create a login ID to use with subscription-manager.)

☐ After successful registration the subscription-manager command should return an ID and state "The registered system name is: hostname" .

 

 

☐ Run the following commands to update/patch the system.

$ sudo -i 

# dnf repolist

# dnf update

 

☐ Answer "Y" to go ahead and patch the system. 

 

☐ Answer "Y" when prompted to import GPG keys. 

 

☐ Now let's reboot the system (just for good measure) using this command.

$ shutdown -r now 

 

 

☐ Log back in using your administrator account and run this command to find the system's IP address.

$ ifconfig

 

 

☐ Now that we can see what the IP address is, we should be able to ssh to the RHEL10 virtual server from the host/hypervisor.  Open a local terminal window and try logging in using SSH with your admin account.

$ ssh admin@192.168.x.x (see ifconfig output for IP address)  

 

☐ Now by using SSH from a terminal window we can cut and paste to and from the session, whereas we could not do that using the virtual console.

☐ Logout of the virtual machine console by typing "exit" and pressing enter, then 

close the window using the "x" at the top right.

☐ Using the SSH terminal session you opened earlier lets install the Extra Packages 

for Enterprise Linux (EPEL).  This provides an additional repository of packages that

are not strictly speaking necessary or essential to the OS, but contains a lot of 

'nice to have' stuff.  Use the following commands in bold to install EPEL for RHEL 10.

$ sudo -i
# subscription-manager repos --enable codeready-builder-for-rhel-10-$(arch)-rpms
# curl -fsSL https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10 -o /tmp/RPM-GPG-KEY-EPEL-10
# rpm --import /tmp/RPM-GPG-KEY-EPEL-10
# dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm 

☐ Answer 'Y' to install the "epel-release" package. 

☐ Lets check status of our current repos and then install and run 'htop' to test if EPEL

is working.  Use the following commands in bold.

# yum repolist 

☐ Test EPEL access by installing htop 

 

# yum install htop  (answer 'Y' when prompted)  

Updating Subscription Management repositories.
Extra Packages for Enterprise Linux 10 - x86_64                     6.6 MB/s | 6.6 MB     00:01    
Last metadata expiration check: 0:00:01 ago on Tue 01 Sep 2026 08:12:59 PM UTC.
Dependencies resolved.
====================================================================================================
 Package           Architecture  Version                Repository                             Size
====================================================================================================
Installing:
 htop              x86_64        3.3.0-5.el10_0         epel                                  196 k
Installing dependencies:
 hwloc-libs        x86_64        2.11.1-4.el10          rhel-10-for-x86_64-baseos-rpms        2.1 M
 ocl-icd           x86_64        2.3.2-8.el10           rhel-10-for-x86_64-baseos-rpms         69 k

Transaction Summary
====================================================================================================
Install  3 Packages

Total download size: 2.3 M
Installed size: 3.5 M
Is this ok [y/N]: y

# htop  (press F10 or 'q' to exit)

 

 ☐ You might see an error after exiting htop, which can be easily fixed by creating

 a '.config' directory in the root user's home directory.

# htop
Can not save configuration to /root/.config/htop/htoprc: No such

file or directory
# mkdir .config
# htop
#

# exit
logout
$ exit
logout
Connection to 192.168.122.166 closed.

In Part 2 we will setup OpenSCAP and demonstrate how to use it to create a STIG

check web report.