text
authselect --passalgo=sha512 --useshadow
selinux --permissive
reboot
bootloader --append="video=640x480 net.ifnames=0"
repo --name="AppStream" --baseurl=http://rhel9repo.centralus.cloudapp.azure.com/rhel-9-for-x86_64-appstream-rpms
repo --name="BaseOS" --baseurl=http://rhel9repo.centralus.cloudapp.azure.com/rhel-9-for-x86_64-baseos-rpms
url --url=http://rhel9repo.centralus.cloudapp.azure.com/rhel-9-for-x86_64-baseos-rpms

%packages
@^minimal-environment
@system-tools
mlocate
aide
audispd-plugins
libreswan
sqlite
opensc
openscap
openscap-scanner
pcsc-lite
scap-security-guide
net-tools
java
perl
wget
procmail
bind-utils
ksh
expect
-firewalld
iptables
iptables-services
samba
cups
chrony
ntpstat
telnet
fetchmail
rsyslog
rear
java
sed
lrzsz
ncurses-term
rsync
grub2-efi-x64-modules
grub2-tools-efi
sendmail
crypto-policies-scripts
mutt
NetworkManager
dos2unix
nodejs
usbutils
lsof
telnet
chkconfig
audit
%end

# Not applying the entire set of pci-dss rules from openscap.
#%addon org_fedora_oscap      
#    content-type = scap-security-guide
#    datastream-id = scap_org.open-scap_datastream_from_xccdf_ssg-rhel9-xccdf-1.2.xml
#    xccdf-id = scap_org.open-scap_cref_ssg-rhel9-xccdf-1.2.xml
#    profile = xccdf_org.ssgproject.content_profile_pci-dss
#%end

# Keyboard layouts
keyboard --xlayouts='us'
# System language
lang en_US.UTF-8

# Network information
network  --bootproto=dhcp --device=tfeth0 --ipv6=no --activate
network  --hostname=rh9-rti.tf

# Run the Setup Agent on first boot
firstboot --disable

ignoredisk --only-use=sda
# Partition clearing information
zerombr
clearpart --all --initlabel
# Disk partitioning information
part /usr2 --fstype="xfs" --ondisk=sda --grow
part swap --fstype="swap" --ondisk=sda --recommended
part /boot/efi --fstype="efi" --ondisk=sda --size=600 --fsoptions="umask=0077,shortname=tflinux"
part / --fstype="xfs" --ondisk=sda --size=31024

# System timezone
timezone America/Chicago

# Root password
#rootpw --iscrypted $2b$10$jBk4hLcfILSSTDA5m7EjduMFKYKjBLfCppM4QUsWZF/JbXVmxpqbi
rootpw --iscrypted $6$G/P1TGIsGMWZ9aak$Sm/HZ1fcdfdmTdy4k2BTMv9Sw.mQOhrgtvMD5e8oo7t3uCtX2T005e/afw46a6TkODKkP8b9SrUgSAnjKxxfi1
user --groups=wheel --name=tfsupport --password=$6$G/P1TGIsGMWZ9aak$Sm/HZ1fcdfdmTdy4k2BTMv9Sw.mQOhrgtvMD5e8oo7t3uCtX2T005e/afw46a6TkODKkP8b9SrUgSAnjKxxfi1 --iscrypted --gecos="tfsupport"

%addon com_redhat_kdump --disable --reserve-mb='auto'
%end

%post
update-crypto-policies --set LEGACY
sed -i "s/enabled=1/enabled=0/g" /etc/yum/pluginconf.d/subscription-manager.conf
cd /usr/bin
curl -O http://rhel8repo.centralus.cloudapp.azure.com/ostools-1.17/updateos updateos
chmod +x /usr/bin/updateos
systemctl start sendmail
systemctl start smb
systemctl start cups
systemctl start iptables
systemctl enable sendmail
systemctl enable smb
systemctl enable cups
systemctl enable iptables
updatedb
openvt -s -w -- /usr/bin/updateos stage
%end