To install NetBackup Snapshot Manager on CIS Level 2 v2 configured host

1. Prepare Red Hat Enterprise Linux 8 with CIS Level 2 v2 benchmarks.
2. For CIS host, iptables firewall is supported.
3. Ensure that you meet all the 'NetBackup Snapshot Manager host requirements' provided in the following section:

4. Ensure that IPv4 and IPv6 forwarding are enabled.
5. Use OpenScap tool to remediate the machine with the following set of rules required for NetBackup Snapshot Manager:

   xccdf_org.ssgproject.content_rule_package_iptables-services_removed
   
   xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding
   
   xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward
   

   Following is an example for using the oscap command with the remediate option:

   # oscap xccdf eval --skip-rule xccdf_org.ssgproject.content_rule_accounts_tmout --results demo-remediate2.xml --profile xccdf_org.ssgproject.content_profile_cis --remediate /usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml

   The above command would skip the xccdf_org.ssgproject.content_rule_accounts_tmout rule and would generate a report with this skipped rule.

   For skipping more rules as mentioned below, use the --skip-rule argument:

   xccdf_org.ssgproject.content_rule_accounts_tmout  
   xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action  
   xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action  
   xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action  
   xccdf_org.ssgproject.content_rule_banner_etc_issue  
   xccdf_org.ssgproject.content_rule_banner_etc_issue_net  
   xccdf_org.ssgproject.content_rule_grub2_uefi_password  
   xccdf_org.ssgproject.content_rule_mount_option_var_noexec
   xccdf_org.ssgproject.content_rule_package_bind_removed  
   xccdf_org.ssgproject.content_rule_package_cups_removed  
   xccdf_org.ssgproject.content_rule_package_dhcp_removed  
   xccdf_org.ssgproject.content_rule_package_dovecot_removed  
   xccdf_org.ssgproject.content_rule_package_httpd_removed  
   xccdf_org.ssgproject.content_rule_package_mcstrans_removed  
   xccdf_org.ssgproject.content_rule_package_net-snmp_removed  
   xccdf_org.ssgproject.content_rule_package_openldap-clients_removed  
   xccdf_org.ssgproject.content_rule_package_rsync_removed  
   xccdf_org.ssgproject.content_rule_package_samba_removed  
   xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed  
   xccdf_org.ssgproject.content_rule_package_squid_removed  
   xccdf_org.ssgproject.content_rule_package_talk_removed  
   xccdf_org.ssgproject.content_rule_package_telnet-server_removed  
   xccdf_org.ssgproject.content_rule_package_tftp-server_removed  
   xccdf_org.ssgproject.content_rule_package_vsftpd_removed  
   xccdf_org.ssgproject.content_rule_package_xinetd_removed  
   xccdf_org.ssgproject.content_rule_package_xorg-x11-server-common_removed  
   xccdf_org.ssgproject.content_rule_package_ypserv_removed  
   xccdf_org.ssgproject.content_rule_rsyslog_files_permissions  
   xccdf_org.ssgproject.content_rule_selinux_state  
   xccdf_org.ssgproject.content_rule_service_firewalld_enabled  
   xccdf_org.ssgproject.content_rule_set_firewalld_default_zone  
   xccdf_org.ssgproject.content_rule_sudo_require_authentication  
   xccdf_org.ssgproject.content_rule_sudo_require_reauthentication

   For more information, refer to Red Hat System Design Guide.

6. Install NetBackup Snapshot Manager and register with NetBackup primary server.
7. Ensure that Podman communication is working properly. Refer to Red Hat knowledge base article.
8. When performing the agentless configuration for protecting CIS Level 2 v2 VM workload, ensure that you meet the requirements mentioned in the following section and delete the noexec permission from the /tmp folder on the agentless VM workload: