Bug 1461330

Additional info:
Profiles affected by this issue:
- PCI-DSS v3 Control Baseline for Red Hat Enterprise Linux 7
- DISA STIG for Red Hat Enterprise Linux 7
- STIG for Red Hat Virtualization Hypervisor
- United States Government Configuration Baseline (USGCB / STIG) - DRAFT
- Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)

The bug was fixed upstream in https://github.com/OpenSCAP/scap-security-guide/pull/2083

Verified manually on version scap-security-guide-0.1.33-5.el7, that anaconda kickstart is successfully updated to contain aide package. I was able to log in as an admin user defined during installation.

Anaconda kickstart:
%packages
@^minimal
@core
aide
chrony
dracut-fips
esc
kexec-tools
openscap
openscap-scanner
pam_pkcs11
screen
-rsh
-rsh-server
-talk
-talk-server
-telnet
-telnet-server
-xinetd
-ypbind
-ypserv

%end

Note: Profile selected in anaconda was xccdf_org.ssgproject.content_profile_nist-800-171-cui

Note a copy paste error in Comment 4, the important packages to be included were "pam_pkcs11" and "esc". Not aide.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2064

*** Bug 1404842 has been marked as a duplicate of this bug. ***

This is still not fixed in RHEL 7.5. The pam_pkcs11 is not being installed by the stig-rhel7-disa OSCAP profile.

Hello Kenyon,

Are you using the text based installation?
oscap-anaconda-addon fails to install packages when on TUI mode, see https://bugzilla.redhat.com/show_bug.cgi?id=1547609.

If not using TUI, could you check if using full ID of Profile resolves your issue? 

profile = xccdf_org.ssgproject.content_profile_stig-rhel7-disa

(In reply to Watson Yuuma Sato from comment #9)
> Hello Kenyon,
> 
> Are you using the text based installation?
> oscap-anaconda-addon fails to install packages when on TUI mode, see
> https://bugzilla.redhat.com/show_bug.cgi?id=1547609.
> 
> If not using TUI, could you check if using full ID of Profile resolves your
> issue? 
> 
> profile = xccdf_org.ssgproject.content_profile_stig-rhel7-disa

Yes, I am using the text installation mode. Thanks.

(In reply to Kenyon Ralph from comment #10)
> (In reply to Watson Yuuma Sato from comment #9)
> > Hello Kenyon,
> > 
> > Are you using the text based installation?
> > oscap-anaconda-addon fails to install packages when on TUI mode, see
> > https://bugzilla.redhat.com/show_bug.cgi?id=1547609.
> > 
> > If not using TUI, could you check if using full ID of Profile resolves your
> > issue? 
> > 
> > profile = xccdf_org.ssgproject.content_profile_stig-rhel7-disa
> 
> Yes, I am using the text installation mode. Thanks.

With graphical anaconda, with profile = xccdf_org.ssgproject.content_profile_stig-rhel7-disa, it says "misconfiguration detected" under Security Policy. With profile = stig-rhel7-disa, it says "error fetching and loading content". So this must be yet another bug.

Hello Kenyon,

I think this "misconfiguration detected" error might be related to partitioning of the disk. I believe that DISA STIG profile requires you to have at least /home partition separately.

And regarding "error fetching and loading content", I have filed https://bugzilla.redhat.com/show_bug.cgi?id=1567151.

A quick test with full profile ID of ospp-rhel7 worked. So error "misconfiguration detected" is very likely related to configuration of partitions.
As oscap-anaconda-addon cannot setup the partitions, only check them, your kickstart file should configure the partitions with "part" or "partitions" option.