The RHEL Compliance Lab
Harden a Red Hat server to the standard — and prove it, the way the job actually asks you to.Nine modules, 166 pages, and a compliance package almost no junior candidate has ever produced.---## The gapEverybody teaches Linux.There are ten thousand free tutorials on chmod, on systemctl, on standing up a web server. You've probably done a few. Maybe you've got Security+. Maybe you can move around a terminal just fine.And then you sit down in a government tech interview and somebody asks:> "Walk me through how you'd bring a system into compliance."That's the question. That's the whole job. And it's the one thing the free internet does not teach.Almost nobody teaches the part of the job where you have to prove the box is secure to somebody whose entire role is to doubt you.That's what this is.---## What you'll actually doYou'll take a stock Red Hat 9 box and:- Scan it against the real DISA STIG — downloaded from public.cyber.mil, the actual standard, not a summary of one- Learn to read the report honestly — including why a "92%" is usually a lie- Master SELinux from zero — labels, denials, booleans, custom policy, and why setenforce 0 is the most résumé-limiting habit in Linux- Harden it by hand — SSH, boot chain, crypto policy, FIPS, firewalld, kernelparameters — so you understand what the automation does before you let it run- Lock down access — password policy, lockout, authselect, sudo least privilege,and a live demonstration of escalating to root through a "small" sudo grant- Instrument audit and file integrity — auditd rules, retention that actuallyretains, AIDE catching a modified binary- Patch it properly — advisories, CVE mapping, credentialed vs uncredentialedscanning, and backported fixes (the #1 false positive in the field)- Break it on purpose — every remediation in this book that can lock you out ofyour own server, done deliberately, with the recovery path- Produce the compliance package — annotated checklist, POA&M, before/after scan delta, change rec
