@calltelemetry/ct-lab-mcp 0.8.98 → 0.8.99

package/assets/stig/SHA256SUMS

@@ -0,0 +1,18 @@
+a5f48191effe1b243c4d4fc5565cbbe31b6a6085aedf9a3b924e68d0b9ae399c  files/ct-luks-firstboot.service
+5dc732b176181200ed18e6cf2448551d7c5e1a31cbd7bd9f4cbda4d30a4ad2eb  files/ct-luks-firstboot.sh
+dc035a0b24f24ff1a0e75fbbb9ff20262c1f83ef41d6c4e35a9bf7895ffd72e5  ks.cfg.pkrtpl
+97cda67f5851fcfd05a9a8dd4b0f885f9b5bad2ff85570935f14555356edbcdf  scripts/assess.sh
+7c8b9f536f7d2fa81b26b125a8edccf7bc64c9959e5d5ce6482bab231e21ecd2  scripts/errata.sh
+9780d258e74fb8eb997a27c6866ddc3fdd78f54c5e61eb616618c5a3445056ef  scripts/remediate.sh
+5e3760cfd6a752b5c97e6e1f6f557df385f4be3d2a4acc1b125480f785b0dbcb  scripts/seal.sh
+43560c40096a28b180685fe1383344a6d454a3a18666f2ead4a1ddd3d72ed7fd  tailoring.xml
+9a7e78eefcb3d8ce28dc137e56dc43ae6b6f3ba4bdecf9f3c0abe64658432105  template.pkr.hcl
+eb119e742a4791404ca298c962515ffe3492814dfc72aecac16c420ccb3b0ccc  guest/keyhash.sh
+3a964e9dc60fcb7492fabf2117fa04d91e0f5e34d0b3b1fe003aa7253f0daeeb  guest/read-recovery.sh
+921ce015bb3f5188ccd861aef30fb1aed2588e729c371c3c8379802ce0c24be1  guest/scan.sh
+9abadcf3c9a1334447a6f349c6c78105d090550d6e8c09adb0320fc1a73e5019  guest/shred-recovery.sh
+0af1b98d2acf8827ac3861a0ec25f507483a3dc902f00ed215ce13b6dc4db0dc  guest/test-recovery.sh
+6a63f43c312eed5941f0b86044ebe8b3457ce9412c5d9a1ceda67316d16a4209  guest/trim.sh
+6b3eab512392c9b68499cb3b4a753377bcc499b810e7259d8ede5e10861bf674  guest/verify-root.sh
+770cbf1c4ea374772d6e80734b1fe4d7d7f5826c8c528a5371f4dfea196479d7  guest/verify-user.sh
+b4a37a0425369c99dfe9b63086155b7ffaa0ef73f98b158143ecb0cd84d45d94  guest/scan-disa.sh

package/assets/stig/files/ct-luks-firstboot.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=CallTelemetry clone first boot: re-encrypt LUKS with a new volume key, bind TPM2
+ConditionPathExists=/etc/ct-luks-bootstrap.key
+After=cloud-final.service
+Wants=cloud-final.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/bash /usr/local/sbin/ct-luks-firstboot.sh
+TimeoutStartSec=0
+
+[Install]
+WantedBy=multi-user.target

package/assets/stig/files/ct-luks-firstboot.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# First boot of a clone (D-020). The template ships LUKS2 on the LVM PV unlocked by a
+# template-wide bootstrap key embedded in the initramfs. Here, once per clone:
+#   1. online re-encrypt (new volume key),
+#   2. add a per-clone recovery passphrase (controller escrows it, then removes the file),
+#   3. bind unlock to this clone's own TPM2 (clevis),
+#   4. remove the bootstrap keyslot and key from the initramfs, then reboot.
+set -euo pipefail
+exec >>/var/log/ct-luks-firstboot.log 2>&1
+echo "== $(date -u +%FT%TZ) ct-luks-firstboot start"
+key=/etc/ct-luks-bootstrap.key
+[ -f "$key" ] || { echo "bootstrap key absent; nothing to do"; exit 0; }
+[ -c /dev/tpmrm0 ] || { echo "ERROR: no TPM2 device (/dev/tpmrm0); clone needs its own tpmstate0"; exit 1; }
+dev="$(blkid -t TYPE=crypto_LUKS -o device | head -n1)"
+[ -n "$dev" ] || { echo "ERROR: no LUKS device"; exit 1; }
+
+cryptsetup reencrypt --key-file "$key" --pbkdf pbkdf2 --resilience none --batch-mode "$dev"
+echo "reencrypt done $(date -u +%FT%TZ)"
+
+umask 077
+openssl rand -base64 60 | tr -dc 'A-Za-z0-9' | head -c 40 > /root/.luks-recovery
+cryptsetup luksAddKey --key-file "$key" --pbkdf pbkdf2 --batch-mode "$dev" /root/.luks-recovery
+
+clevis luks bind -f -d "$dev" -k "$key" tpm2 '{"pcr_bank":"sha256","pcr_ids":"7"}'
+
+cryptsetup luksRemoveKey --batch-mode "$dev" "$key"
+sed -i "s#${key}#none#" /etc/crypttab
+rm -f /etc/dracut.conf.d/ct-luks-bootstrap.conf
+shred -u "$key"
+dracut -f --regenerate-all
+fstrim -av || true   # give the fully re-encrypted thin disk back (discards pass through LUKS)
+touch /var/lib/ct-luks-firstboot.done
+systemctl disable ct-luks-firstboot.service
+echo "== $(date -u +%FT%TZ) done; rebooting to prove unattended TPM unlock"
+systemctl reboot

package/assets/stig/guest/keyhash.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+# sha256 of the LUKS volume key (never printed): proves two clones have different keys.
+# The recovery passphrase arrives on stdin after the sudo password line.
+o=$(cryptsetup luksDump --dump-master-key --batch-mode --key-file - $(blkid -t TYPE=crypto_LUKS -o device|head -n1)) && grep -q "MK dump" <<<"$o" && printf "%s" "$o" | sha256sum | cut -d" " -f1

package/assets/stig/guest/read-recovery.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+test -f /root/.luks-recovery && cat /root/.luks-recovery

package/assets/stig/guest/scan-disa.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Second scan of a v3 clone: DISA's official V2R8 SCAP benchmark (profile MAC-1_Classified), next to the SSG scan.
+# Writes into /var/tmp/ct-scan (created by scan.sh). Templates built before the dual-scan recipe do not carry the
+# benchmark; then only a marker is written and the caller decides whether that is acceptable.
+set -e
+e=/var/tmp/ct-scan
+ev=/root/stig-evidence
+b=$ev/U_RHEL_8_V2R8_STIG_SCAP_1-3_Benchmark.xml
+mkdir -p $e
+if [ ! -f "$b" ]; then echo absent > $e/clone-disa-absent; chown -R ctadmin $e; exit 0; fi
+drc=0
+oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-1_Classified --results-arf $e/clone-disa-arf.xml --report $e/clone-disa-report.html $b > $e/clone-disa-stdout.txt 2>&1 || drc=$?
+echo oscap_disa_exit=$drc
+for r in pass fail notapplicable notchecked informational error unknown; do echo result_$r=$(grep -c "^Result.*$r\$" $e/clone-disa-stdout.txt || true); done > $e/clone-disa-summary.txt
+grep -B2 -E '^Result.*(fail|error)$' $e/clone-disa-stdout.txt | grep '^Rule' > $e/clone-disa-failed-rules.txt || true
+sha256sum $b | cut -d' ' -f1 > $e/clone-disa-benchmark.sha256
+chown -R ctadmin $e

package/assets/stig/guest/scan.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# oscap on the clone itself (pinned datastream + tailoring baked into the template). Run as root.
+# Output goes to /var/tmp/ct-scan, never under /home: root-owned scan output there would itself trip the
+# home-file ownership rules. Faithful to the `do_scan` block of the known-good clone.sh.
+set -e
+e=/var/tmp/ct-scan
+mkdir -p $e; ev=/root/stig-evidence; rc=0
+oscap xccdf eval --tailoring-file $ev/tailoring.xml --profile xccdf_com.calltelemetry_profile_stig_ct --results-arf $e/clone-arf.xml --report $e/clone-report.html $ev/ssg-rhel8-ds.xml > $e/clone-stdout.txt 2>&1 || rc=$?
+echo oscap_exit=$rc
+for r in pass fail notapplicable notchecked informational error; do echo result_$r=$(grep -c "^Result.*$r\$" $e/clone-stdout.txt || true); done > $e/clone-summary.txt
+grep -B2 -E '^Result.*(fail|error)$' $e/clone-stdout.txt | grep '^Rule' > $e/clone-failed-rules.txt || true
+grep -B3 -E '^Result.*notchecked$' $e/clone-stdout.txt | grep -E '^(Title|Rule)' > $e/clone-notchecked.txt || true
+{ echo '## encrypt_partitions: lsblk -f'; lsblk -f
+  echo; echo '## encrypt_partitions: LUKS header (no key material)'; cryptsetup luksDump $(blkid -t TYPE=crypto_LUKS -o device|head -n1) | grep -vE '^[[:space:]]+(Salt|Digest|Key material|AF stripes|AF hash):' | head -60
+  echo; echo '## security_patches_up_to_date: outstanding security advisories'; dnf -q updateinfo list security 2>&1 | grep -c . || true
+  echo; echo '## selinux_user_login_roles: semanage login -l'; semanage login -l
+  echo; echo '## configured_firewalld_default_deny / configure_firewalld_ports'; firewall-cmd --get-default-zone; firewall-cmd --zone=drop --list-all
+  echo; echo '## account_temp_expire_date: accounts with an expiry'; awk -F: '$1!="root"{print $1}' /etc/passwd | while read u; do chage -l $u | grep -H --label=$u 'Account expires'; done | grep -v never || echo 'none (no temporary accounts)'
+  echo; echo '## auditd partition size'; df -h /var/log/audit | tail -n1
+  echo; echo '## ssh_keys_passphrase_protected: private keys in user homes'; find /home /root -maxdepth 3 -name 'id_*' ! -name '*.pub' 2>/dev/null | grep . || echo 'none'
+  echo; echo '## sssd certmap trust anchor'; grep -c certmap /etc/sssd/sssd.conf; } > $e/clone-manual-evidence.txt 2>&1
+chown -R ctadmin $e

package/assets/stig/guest/shred-recovery.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+shred -u /root/.luks-recovery

package/assets/stig/guest/test-recovery.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Reads the recovery passphrase from stdin (after the sudo password line) and proves it opens the LUKS volume.
+cryptsetup open --test-passphrase --key-file - $(blkid -t TYPE=crypto_LUKS -o device|head -n1) && echo ok

package/assets/stig/guest/trim.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Discards pass through LUKS: give the re-encrypted (fully allocated) thin disk back.
+fstrim -av

package/assets/stig/guest/verify-root.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Privileged half of the clone verification. Prints key=value lines; never key material.
+dev=$(blkid -t TYPE=crypto_LUKS -o device|head -n1)
+echo sudo_id=$(id -Z)
+echo luks_type=$(cryptsetup isLuks -v $dev >/dev/null && cryptsetup luksDump $dev | sed -n "s/^Version:[[:space:]]*//p")
+echo luks_passphrase_slots=$(cryptsetup luksDump $dev | grep -cE "^  [0-9]+: luks2")
+echo clevis_tpm2_tokens=$(cryptsetup luksDump $dev | grep -c "clevis")
+echo bootstrap_key_file=$(test -e /etc/ct-luks-bootstrap.key && echo present || echo absent)
+echo tpm_bound=$(clevis luks list -d $dev | grep -c tpm2)

package/assets/stig/guest/verify-user.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Unprivileged half of the clone verification (known-good clone.sh `verify`).
+echo fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
+echo selinux=$(getenforce)
+echo host=$(hostname)
+echo context=$(id -Z)
+ls /dev/tpmrm0 >/dev/null 2>&1 && echo tpm=present
+grep ^PRETTY_NAME= /etc/os-release
+echo kernel=$(uname -r)

package/assets/stig/ks.cfg.pkrtpl

@@ -0,0 +1,95 @@
+# RHEL 8.10 STIG template install. The installer applies the DISA STIG profile
+# from the DVD's scap-security-guide; Packer then re-remediates and assesses with
+# the pinned SSG release. The PV is LUKS2 with a template-wide bootstrap key; each clone
+# re-encrypts with a new volume key and binds its own TPM2 at first boot (D-020).
+text --non-interactive
+cdrom
+lang en_US.UTF-8
+keyboard --xlayouts=us
+timezone UTC --utc
+rootpw --lock
+selinux --enforcing
+firewall --enabled --service=ssh
+network --bootproto=dhcp --device=link --onboot=yes --activate --hostname=${hostname}
+services --enabled=sshd,qemu-guest-agent,chronyd,auditd --disabled=kdump
+firstboot --disable
+eula --agreed
+skipx
+
+zerombr
+clearpart --all --initlabel --disklabel=gpt
+bootloader --location=mbr --iscrypted --password=${grub_pbkdf2}
+part /boot/efi --fstype=efi --size=1024 --fsoptions="umask=0077,shortname=winnt,nosuid,nodev"
+part /boot --fstype=xfs --size=2048 --fsoptions="nosuid,nodev"
+part pv.01 --size=1 --grow --encrypted --luks-version=luks2 --pbkdf=pbkdf2 --passphrase=${luks_bootstrap}
+volgroup vg_root pv.01
+logvol /              --vgname=vg_root --name=root     --fstype=xfs --size=24576
+logvol /home          --vgname=vg_root --name=home     --fstype=xfs --size=16384 --fsoptions="nodev,nosuid,noexec"
+logvol /tmp           --vgname=vg_root --name=tmp      --fstype=xfs --size=8192  --fsoptions="nodev,nosuid,noexec"
+logvol /var           --vgname=vg_root --name=var      --fstype=xfs --size=24576 --fsoptions="nodev"
+logvol /var/log       --vgname=vg_root --name=log      --fstype=xfs --size=16384 --fsoptions="nodev,nosuid,noexec"
+logvol /var/log/audit --vgname=vg_root --name=audit    --fstype=xfs --size=8192  --fsoptions="nodev,nosuid,noexec"
+logvol /var/tmp       --vgname=vg_root --name=vartmp   --fstype=xfs --size=8192  --fsoptions="nodev,nosuid,noexec"
+logvol /opt           --vgname=vg_root --name=opt      --fstype=xfs --size=8192
+logvol swap           --vgname=vg_root --name=swap     --size=8192
+
+# Temporary build-only administrator (D-019). Removed by seal.sh.
+user --name=${ssh_username} --groups=wheel --iscrypted --password=${build_password_hash}
+sshkey --username=${ssh_username} "${ssh_public_key}"
+
+%packages --excludedocs
+@^minimal-environment
+openssh-server
+openssh-clients
+qemu-guest-agent
+sudo
+chrony
+dracut-fips
+crypto-policies-scripts
+cloud-init
+cloud-utils-growpart
+openscap-scanner
+scap-security-guide
+aide
+audit
+rsyslog
+fapolicyd
+usbguard
+tmux
+cryptsetup
+clevis
+clevis-luks
+clevis-dracut
+tpm2-tools
+sssd
+sssd-tools
+openssl
+firewalld
+subscription-manager
+policycoreutils-python-utils
+%end
+
+%addon com_redhat_kdump --disable
+%end
+
+%addon org_fedora_oscap
+    content-type = scap-security-guide
+    profile = xccdf_org.ssgproject.content_profile_stig
+%end
+
+%post --erroronfail
+# Template-wide LUKS bootstrap key, embedded in the initramfs so the template boots
+# unattended. Replaced per clone by ct-luks-firstboot (new volume key + TPM2).
+printf '%s' '${luks_bootstrap}' > /etc/ct-luks-bootstrap.key
+chmod 0400 /etc/ct-luks-bootstrap.key
+sed -i 's#^\(luks-[^ ]* [^ ]* \)none#\1/etc/ct-luks-bootstrap.key#' /etc/crypttab
+cat > /etc/dracut.conf.d/ct-luks-bootstrap.conf <<'DRACUT'
+add_dracutmodules+=" crypt clevis "
+install_items+=" /etc/ct-luks-bootstrap.key "
+DRACUT
+dracut -f --regenerate-all
+# The build user must be usable over key-only SSH with no TTY (Packer): no expired password.
+chage -d "$(date +%F)" -M 99999 -E -1 ${ssh_username}
+%end
+
+reboot

package/assets/stig/scripts/assess.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Final STIG assessment of the rebooted image. Reports are copied to the controller.
+set -euo pipefail
+
+evidence=/root/stig-evidence
+out=/home/${BUILD_USER}/stig-report
+rc=0
+oscap xccdf eval \
+  --tailoring-file "$evidence/tailoring.xml" \
+  --profile xccdf_com.calltelemetry_profile_stig_ct \
+  --results-arf "$evidence/final-arf.xml" \
+  --report "$evidence/final-report.html" \
+  "$evidence/ssg-rhel8-ds.xml" > "$evidence/final-stdout.txt" 2>&1 || rc=$?
+echo "oscap eval exit=$rc"
+[ "$rc" -eq 0 ] || [ "$rc" -eq 2 ]
+
+{
+  echo "fips_enabled=$(cat /proc/sys/crypto/fips_enabled)"
+  echo "selinux=$(getenforce)"
+  echo "kernel=$(uname -r)"
+  grep -E '^(NAME|VERSION_ID)=' /etc/os-release
+  rpm -q scap-security-guide openscap-scanner
+  echo "tailoring_sha256=$(cut -d" " -f1 "$evidence/tailoring.sha256")"
+  echo "ds_sha256=$(sha256sum "$evidence/ssg-rhel8-ds.xml" | cut -d" " -f1)"
+  echo "dnf_security_outstanding=$(dnf -q updateinfo list security 2>/dev/null | grep -c . || true)"
+  lsblk -f > "$evidence/lsblk.txt"; cryptsetup luksDump "$(blkid -t TYPE=crypto_LUKS -o device | head -n1)" > "$evidence/luksdump-template.txt" 2>&1 || true
+  for r in pass fail notapplicable notchecked informational error; do
+    echo "result_${r}=$(grep -c "^Result.*${r}\$" "$evidence/final-stdout.txt" || true)"
+  done
+} > "$evidence/summary.txt"
+cat "$evidence/summary.txt"
+rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > "$evidence/rpm-qa-final.txt"
+grep -B2 -E '^Result.*fail$' "$evidence/final-stdout.txt" | grep '^Rule' | sed 's/^Rule[[:space:]]*//' > "$evidence/failed-rules.txt" || true
+
+rm -rf "$out"
+install -d -o "${BUILD_USER}" -g "${BUILD_USER}" -m 0700 "$out"
+cp "$evidence"/{lsblk.txt,luksdump-template.txt,tailoring.xml,tailoring.sha256,errata.txt,final-arf.xml,final-report.html,final-stdout.txt,summary.txt,failed-rules.txt,remediate-report.html,remediate-stdout.txt,rpm-qa-final.txt} "$out/"
+cp -r "$evidence/install-time-oscap" "$out/" 2>/dev/null || true
+chown -R "${BUILD_USER}:${BUILD_USER}" "$out"

package/assets/stig/scripts/errata.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Apply current RHEL 8.10 errata through RHSM, then reboot into the updated kernel.
+# Registration is removed again by seal.sh. Credentials arrive as environment variables
+# and are never echoed.
+set -euo pipefail
+
+: "${RHSM_ORG:?}" "${RHSM_KEY:?}"
+subscription-manager register --org "$RHSM_ORG" --activationkey "$RHSM_KEY" --force >/dev/null
+subscription-manager repos --list-enabled | grep -E '^Repo ID' || true
+dnf -y update
+install -d -m 0700 /root/stig-evidence
+rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /root/stig-evidence/rpm-qa-post-errata.txt
+{
+  echo "kernel_installed=$(rpm -q kernel --qf '%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -V | tail -n1)"
+  echo "security_advisories_outstanding=$(dnf -q updateinfo list security 2>/dev/null | grep -c . || true)"
+  echo "errata_applied=$(date -u +%FT%TZ)"
+} > /root/stig-evidence/errata.txt
+cat /root/stig-evidence/errata.txt
+(sleep 3; systemctl reboot) >/dev/null 2>&1 &

package/assets/stig/scripts/remediate.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+# CallTelemetry organization settings, then the pinned SSG STIG remediation with the
+# organization tailoring, then reboot. oscap exits 2 when rules still fail after
+# remediation; that is a finding, not a build failure.
+set -euo pipefail
+
+ds="$SSG_DATASTREAM"
+echo "${SSG_DATASTREAM_SHA256}  ${ds}" | sha256sum -c -
+profile=xccdf_com.calltelemetry_profile_stig_ct
+
+evidence=/root/stig-evidence
+install -d -m 0700 "$evidence"
+cp "$ds" "$evidence/ssg-rhel8-ds.xml"
+cp "$TAILORING" "$evidence/tailoring.xml"
+sha256sum "$evidence/tailoring.xml" > "$evidence/tailoring.sha256"
+rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > "$evidence/rpm-qa-pre-remediate.txt"
+cp /root/anaconda-ks.cfg "$evidence/" 2>/dev/null || true
+cp -r /root/openscap_data "$evidence/install-time-oscap" 2>/dev/null || true
+
+# --- clone first-boot encryption (D-020) ---
+install -m 0755 "$FILES_DIR/ct-luks-firstboot.sh" /usr/local/sbin/ct-luks-firstboot.sh
+install -m 0644 "$FILES_DIR/ct-luks-firstboot.service" /etc/systemd/system/ct-luks-firstboot.service
+systemctl daemon-reload
+systemctl enable ct-luks-firstboot.service
+restorecon -F /usr/local/sbin/ct-luks-firstboot.sh /etc/systemd/system/ct-luks-firstboot.service
+
+# --- GRUB: non-default superuser (grub2_uefi_admin_username), keep the PBKDF2 password ---
+sed -i 's/set superusers="root"/set superusers="grubadmin"/; s/password_pbkdf2 root /password_pbkdf2 grubadmin /' /etc/grub.d/01_users
+grep -q 'superusers="grubadmin"' /etc/grub.d/01_users
+grub2-mkconfig -o /boot/grub2/grub.cfg >/dev/null 2>&1
+grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg >/dev/null 2>&1 || true
+
+# --- DNS: two lab nameservers, independent of DHCP (network_configure_name_resolution) ---
+cat > /etc/NetworkManager/conf.d/90-ct-dns.conf <<NM
+[global-dns-domain-*]
+servers=${DNS_SERVERS}
+NM
+systemctl restart NetworkManager
+sleep 5
+
+# --- firewalld: default zone drop, ssh allowed (set_firewalld_default_zone) ---
+firewall-cmd --permanent --zone=drop --add-service=ssh >/dev/null
+firewall-cmd --zone=drop --add-service=ssh >/dev/null
+firewall-cmd --set-default-zone=drop >/dev/null
+
+# --- chrony: server directives only (chronyd_server_directive) ---
+sed -i '/^pool /d' /etc/chrony.conf
+for s in ${NTP_SERVERS//,/ }; do
+  grep -q "^server $s " /etc/chrony.conf || echo "server $s iburst maxpoll 16" >> /etc/chrony.conf
+done
+systemctl restart chronyd
+
+# --- SSSD with a certmap rule (sssd_enable_certmap); CAC matchrule is a placeholder ---
+cat > /etc/sssd/sssd.conf <<'SSSD'
+[sssd]
+config_file_version = 2
+services = nss, pam
+domains = ctlocal
+
+[domain/ctlocal]
+id_provider = files
+
+[pam]
+pam_cert_auth = True
+
+[certmap/ctlocal/dod_cac]
+matchrule = <SAN>.*EDIPI@mil
+maprule = (userCertificate;binary={cert!bin})
+domains = ctlocal
+SSSD
+chmod 0600 /etc/sssd/sssd.conf
+systemctl enable sssd
+
+# --- sudo: elevate SELinux context (selinux_context_elevation_for_sudo); password still required ---
+cat > /etc/sudoers.d/ct-selinux-elevation <<'SUDOERS'
+%wheel ALL=(ALL) TYPE=sysadm_t ROLE=sysadm_r ALL
+SUDOERS
+chmod 0440 /etc/sudoers.d/ct-selinux-elevation
+visudo -cf /etc/sudoers.d/ct-selinux-elevation
+
+# --- cloud-init default user: ctadmin in wheel, password sudo only (no NOPASSWD) ---
+cat > /etc/cloud/cloud.cfg.d/99-ct-stig.cfg <<'CLOUD'
+system_info:
+  default_user:
+    name: ctadmin
+    gecos: CallTelemetry administrator
+    groups: [wheel, adm, systemd-journal]
+    sudo: false
+    lock_passwd: false
+    shell: /bin/bash
+ssh_pwauth: false
+CLOUD
+
+# --- SELinux user mapping: administrators log in as staff_u and elevate to sysadm_r via sudo ---
+semanage login -m -s staff_u -r s0-s0:c0.c1023 __default__
+
+# --- init-file and host-key permissions that must also hold on clones ---
+# New users inherit /etc/skel; root's init files must be <= 0740 (file_permission_user_init_files*).
+# The build user (removed at seal) was created before /etc/skel was fixed.
+chmod 0740 /home/${BUILD_USER}/.bash_logout /home/${BUILD_USER}/.bash_profile /home/${BUILD_USER}/.bashrc
+# cloud-init already created ctadmin on the build VM's own first boot (removed again at seal).
+chmod 0740 /home/ctadmin/.bash_logout /home/ctadmin/.bash_profile /home/ctadmin/.bashrc 2>/dev/null || true
+chmod 0740 /etc/skel/.bash_logout /etc/skel/.bash_profile /etc/skel/.bashrc /root/.bash_logout /root/.bash_profile /root/.bashrc /root/.cshrc /root/.tcshrc 2>/dev/null || true
+# sshd-keygen creates host keys 0640 root:ssh_keys on every clone's first boot; the STIG
+# (file_permissions_sshd_private_key) requires 0600. Re-assert it whenever sshd starts.
+install -d /etc/systemd/system/sshd.service.d
+cat > /etc/systemd/system/sshd.service.d/10-ct-hostkey-perms.conf <<'DROPIN'
+[Service]
+ExecStartPre=/usr/bin/bash -c 'chmod 0600 /etc/ssh/ssh_host_*_key'
+DROPIN
+systemctl daemon-reload
+chmod 0600 /etc/ssh/ssh_host_*_key
+
+# --- SSG STIG remediation with the organization tailoring ---
+rc=0
+oscap xccdf eval \
+  --tailoring-file "$evidence/tailoring.xml" \
+  --profile "$profile" \
+  --remediate \
+  --results-arf "$evidence/remediate-arf.xml" \
+  --report "$evidence/remediate-report.html" \
+  "$evidence/ssg-rhel8-ds.xml" > "$evidence/remediate-stdout.txt" 2>&1 || rc=$?
+echo "oscap remediate exit=$rc"
+[ "$rc" -eq 0 ] || [ "$rc" -eq 2 ]
+
+fips-mode-setup --check
+(sleep 3; systemctl reboot) >/dev/null 2>&1 &

package/assets/stig/scripts/seal.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# Generalize the image for cloning and remove the temporary build access (D-019).
+set -euo pipefail
+
+# Drop the RHSM registration and entitlement certificates (errata step registered this build).
+subscription-manager unregister >/dev/null 2>&1 || true
+subscription-manager clean >/dev/null 2>&1 || true
+rm -rf /etc/pki/entitlement/* /etc/pki/consumer/* /var/lib/rhsm/*
+
+# cloud-init created ctadmin on this build VM; clones create their own (from the fixed /etc/skel).
+userdel --remove ctadmin 2>/dev/null || true
+
+# Per-instance identity is regenerated on each clone's first boot.
+rm -f /etc/ssh/ssh_host_*
+truncate -s 0 /etc/machine-id
+rm -f /var/lib/dbus/machine-id
+cloud-init clean --logs --seed
+rm -f /etc/NetworkManager/system-connections/*.nmconnection
+rm -rf /root/stig-evidence/*.xml.bak /var/tmp/* /tmp/* 2>/dev/null || true
+journalctl --rotate && journalctl --vacuum-time=1s >/dev/null
+find /var/log -type f -name '*.log' -exec truncate -s 0 {} +
+dnf clean all >/dev/null
+history -c || true
+
+# Clones authenticate with the claim's cloud-init key, never the build key.
+rm -rf "/home/${BUILD_USER}/.ssh" "/home/${BUILD_USER}/stig-report" "/home/${BUILD_USER}/ssg-rhel8-ds.xml"
+usermod --lock --expiredate 1 "${BUILD_USER}"
+# Delete the account when Packer shuts the VM down, after this session ends.
+unit=/etc/systemd/system/ct-remove-build-user.service
+cat > "$unit" <<EOF
+[Unit]
+Description=Remove temporary template build user at shutdown
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/true
+ExecStop=/usr/sbin/userdel --remove --force ${BUILD_USER}
+ExecStop=/bin/rm -f ${unit} /etc/systemd/system/multi-user.target.wants/ct-remove-build-user.service
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl daemon-reload
+systemctl enable --now ct-remove-build-user.service
+sync

package/assets/stig/tailoring.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Organization-defined values for the DISA RHEL 8 STIG profile (SSG 0.1.82).
+     Only values the STIG leaves to the organization are set; no rule is selected out.
+     accounts_authorized_local_users: the STIG requires the organization to define the
+     authorized local accounts. The list is the RHEL 8 minimal system accounts present on
+     the image, the CallTelemetry administrator (ctadmin, created by cloud-init on clones),
+     and ctbuild (temporary Packer build account, deleted when the template is sealed). -->
+<xccdf-1.2:Tailoring xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" id="xccdf_com.calltelemetry_tailoring_stig_ct">
+  <xccdf-1.2:benchmark href="ssg-rhel8-ds.xml"/>
+  <xccdf-1.2:version time="2026-10-16T00:00:00">1</xccdf-1.2:version>
+  <xccdf-1.2:Profile id="xccdf_com.calltelemetry_profile_stig_ct" extends="xccdf_org.ssgproject.content_profile_stig">
+    <xccdf-1.2:title>DISA RHEL 8 STIG - CallTelemetry organization-defined values</xccdf-1.2:title>
+    <xccdf-1.2:description>Extends the SSG STIG profile; sets only organization-defined variables.</xccdf-1.2:description>
+    <xccdf-1.2:set-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|dbus|systemd-coredump|systemd-resolve|tss|polkitd|clevis|unbound|sssd|fapolicyd|chrony|sshd|postfix|ctadmin|ctbuild)$</xccdf-1.2:set-value>
+  </xccdf-1.2:Profile>
+</xccdf-1.2:Tailoring>