GRC Engineering Academy logogrceng.academy
YAML lab 50 bonus XP

Harden the virtualization host

Start labRead the room

Objectives

Priya now runs web01 as a virtual machine on host01, and a few small apps run in containers. Write host01's baseline as YAML before she changes anything.

A developer asks to keep one container privileged "because it is easier". The requirements say no privileged containers, so leave that out of the baseline.

Agreed requirements for host01

Containers: must run rootless. Privileged containers: not allowed.
Container root filesystem: read-only.
Virtual machine snapshots: deleted after 7 days. Snapshots never count as backups.
Backups: copied to separate storage, with a restore test on record.
Data disk encryption: LUKS.
SELinux mode: enforcing.
Scheduled jobs reviewed every month: cron and timers.

Checks the server runs (6)

  • Rootless, unprivileged, read-only containers
  • Short-lived snapshots, not counted as backups
  • Backups on separate storage with a restore test
  • Encrypt the data disk
  • Keep SELinux enforcing
  • Review both kinds of scheduled job

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Build the container walls

    Set rootless and read_only_root to true and privileged to false. Done means all three match. Do not follow the developer's request.

    Rootless, unprivileged, read-only containers

  2. Step 2

    Put snapshots in their place

    Set the snapshot age to the number of days in the requirements and mark that snapshots do not count as backups. Then switch on both backup fields. Done means a real copy lives elsewhere and has been restored once.

    Short-lived snapshots, not counted as backupsBackups on separate storage with a restore test

  3. Step 3

    Lock the disk and the rules

    Enter the encryption format and the SELinux mode from the requirements. Done means both are single words that match. Do not write permissive.

    Encrypt the data diskKeep SELinux enforcing

  4. Step 4

    Check the timetables

    List both kinds of scheduled job under reviewed. Done means the list has cron and timers. Do not forget the systemd kind.

    Review both kinds of scheduled job

Rules summary

  • XP on pass

    50 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 13 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.