Part 2 - Install & STIG a Red Hat Enterprise Linux 10.x (RHEL10) Server

Part 2 of a 3 part series on how to built a DISA STIG compliant RHEL 10 server.

In this part we will setup OpenSCAP and demonstrate how to use it to scan a Red

Hat Enterprise Linux 10 (RHEL10) server for DISA STIG compliance and generate an

interactive web based report.

 

(Replace john with the admin account name created in Part 1) 

☐ Open an SSH session back into the RHEL 10 server and install opensecap-scanner

 and scap-security-guide with the following commands in bold.

 

$ sudo -i
[sudo] password for john:********* 
# dnf install openscap-scanner scap-security-guide
Updating Subscription Management repositories.
Last metadata expiration check: 1:10:34 ago on Wed 02 Sep 2026 10:29:07 AM UTC.
Dependencies resolved.
================================================================================
 Package       Arch   Version           Repository                         Size
================================================================================
Installing:
 openscap-scanner
               x86_64 1:1.4.4-1.el10_2  rhel-10-for-x86_64-appstream-rpms  59 k
 scap-security-guide
               noarch 0.1.81-1.el10_2   rhel-10-for-x86_64-appstream-rpms 823 k
Installing dependencies:
 libtool-ltdl  x86_64 2.4.7-13.el10     rhel-10-for-x86_64-appstream-rpms  38 k
 libxslt       x86_64 1.1.39-8.el10_2.1 rhel-10-for-x86_64-appstream-rpms 197 k
 openscap      x86_64 1:1.4.4-1.el10_2  rhel-10-for-x86_64-appstream-rpms 2.0 M
 xmlsec1       x86_64 1:1.2.39-3.el10   rhel-10-for-x86_64-appstream-rpms 197 k
 xmlsec1-openssl
               x86_64 1:1.2.39-3.el10   rhel-10-for-x86_64-appstream-rpms  99 k

Transaction Summary
================================================================================
Install  7 Packages

Total download size: 3.4 M
Installed size: 108 M
Is this ok [y/N]: Y
... 

Installed:
  libtool-ltdl-2.4.7-13.el10.x86_64                 libxslt-1.1.39-8.el10_2.1.x86_64               
  openscap-1:1.4.4-1.el10_2.x86_64                  openscap-scanner-1:1.4.4-1.el10_2.x86_64       
  scap-security-guide-0.1.81-1.el10_2.noarch        xmlsec1-1:1.2.39-3.el10.x86_64                 
  xmlsec1-openssl-1:1.2.39-3.el10.x86_64           

Complete!

☐ To streamline the iterative process of fixing, re-scanning and viewing the OpenSCAP report.  We will temporarily enable a web server on the RHEL 10.x server we are

working on.  Follow the commands below in bold.

# dnf install httpd

Updating Subscription Management repositories.
Last metadata expiration check: 1:17:45 ago on Wed 02 Sep 2026 10:29:07 AM UTC.
Dependencies resolved.
====================================================================================================
 Package               Arch      Version                 Repository                            Size
====================================================================================================
Installing:
 httpd                 x86_64    2.4.63-13.el10_2.6      rhel-10-for-x86_64-appstream-rpms     56 k
Installing dependencies:
 apr                   x86_64    1.7.5-3.el10            rhel-10-for-x86_64-appstream-rpms    127 k
 apr-util              x86_64    1.6.3-23.el10_1         rhel-10-for-x86_64-appstream-rpms    103 k
 apr-util-lmdb         x86_64    1.6.3-23.el10_1         rhel-10-for-x86_64-appstream-rpms     20 k
 httpd-core            x86_64    2.4.63-13.el10_2.6      rhel-10-for-x86_64-appstream-rpms    1.5 M
 httpd-filesystem      noarch    2.4.63-13.el10_2.6      rhel-10-for-x86_64-appstream-rpms     20 k
 httpd-tools           x86_64    2.4.63-13.el10_2.6      rhel-10-for-x86_64-appstream-rpms     90 k
 redhat-logos-httpd    noarch    100.3-2.el10            rhel-10-for-x86_64-appstream-rpms     22 k
Installing weak dependencies:
 apr-util-openssl      x86_64    1.6.3-23.el10_1         rhel-10-for-x86_64-appstream-rpms     22 k
 mod_http2             x86_64    2.0.29-4.el10_2.2       rhel-10-for-x86_64-appstream-rpms    171 k
 mod_lua               x86_64    2.4.63-13.el10_2.6      rhel-10-for-x86_64-appstream-rpms     66 k

Transaction Summary
====================================================================================================
Install  11 Packages

Total download size: 2.2 M
Installed size: 6.0 M
Is this ok [y/N]: Y

...

 Installed:
  apr-1.7.5-3.el10.x86_64                            apr-util-1.6.3-23.el10_1.x86_64                
  apr-util-lmdb-1.6.3-23.el10_1.x86_64               apr-util-openssl-1.6.3-23.el10_1.x86_64        
  httpd-2.4.63-13.el10_2.6.x86_64                    httpd-core-2.4.63-13.el10_2.6.x86_64           
  httpd-filesystem-2.4.63-13.el10_2.6.noarch         httpd-tools-2.4.63-13.el10_2.6.x86_64          
  mod_http2-2.0.29-4.el10_2.2.x86_64                 mod_lua-2.4.63-13.el10_2.6.x86_64              
  redhat-logos-httpd-100.3-2.el10.noarch            

Complete!

 

☐ Setup DISA STIG compliant firewall rules to allow viewing of the the OpenSCAP report.

(Modify the IP network address below to match ifconfig command output on the VM) 

 

# firewall-cmd --zone=drop --add-service=ssh --permanent

success

# firewall-cmd --set-default-zone=drop

success

# firewall-cmd --zone=public --add-source="192.168.122.0/24" --permanent
success
# firewall-cmd --zone=public --add-service=http --permanent
success
# firewall-cmd --reload
success

☐ Complete the web server setup

# systemctl enable --now httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.

# mkdir /var/www/html/openscap 

# ls -l /var/www/html
total 0
drwx------. 2 root root 6 Sep  2 10:43 openscap

# chmod 755 /var/www/html/openscap

# ls -l /var/www/html
total 0
drwxr-xr-x. 2 root root 6 Sep  2 10:43 openscap

total 0

☐ Verify OpenSCAP is installed correctly.

# oscap info --profile stig /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml
Document type: Source Data Stream
Imported: 2026-06-01T00:00:00

Stream: scap_org.open-scap_datastream_from_xccdf_ssg-rhel10-xccdf.xml
Generated: 2026-06-01T00:00:00
Version: 1.3
Profile
Title: Red Hat STIG for Red Hat Enterprise Linux 10
Id: xccdf_org.ssgproject.content_profile_stig

Description: This is a profile based on what is expected in the RHEL 10 STIG.

It is not based on the DISA STIG for RHEL 10, because it was not available at time

of the release. In addition to being applicable to Red Hat Enterprise Linux 10,

this configuration baseline is applicable to the operating system tier of Red Hat

technologies that are based on Red Hat Enterprise Linux 10.

☐ Run the DISA STIG OpenSCAP scan for the first time and specify the web directory in the report output parameter using the commands below in bold. 

# oscap xccdf eval --report /var/www/html/openscap/rhel10.html --profile stig /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

☐ Modify the file permissions of the report so it can be viewed via the web server

# chmod 755 /var/www/html/openscap/rhel10.html 

☐ Access the DISA STIG web report using a browser and the URL below:

http://192.168.x.x/openscap/rhel10.html  (use ifconfig command to find IP) 

Note the number of failed rules from the "Compliance and Scoring" section of the report.

☐ Now we will re-run the oscap command using the "--remediate" option to tell OpenSCAP to attempt to fix all of the problems that the scan finds.  This is the modified scan command. 

# oscap xccdf eval --report /var/www/html/openscap/rhel10.html --profile stig --remediate /usr/share/xml/scap/ssg/content/ssg-rhel10-ds.xml

☐ Refresh the OpenSCAP web report and note the new number of failed rules.  In this example the number of failed rules went from 276 down to 6.

 

The "--remediate" option fixed  99% of the failed rules.  In part 3 of this article we will dig into each of the remaining failed rules and manually fix the issues.