forked from lisenet/RHCA-study-notes
-
Notifications
You must be signed in to change notification settings - Fork 0
/
EX415_study_notes.txt
1085 lines (813 loc) · 36 KB
/
EX415_study_notes.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
######################################################################
## Tomas Nevar <[email protected]>
## Study notes for EX415 Security exam (RHEL 7)
######################################################################
## Exam objectives:
* Use Red Hat Ansible® Engine
- Install Red Hat Ansible Engine on a control node.
- Configure managed nodes.
- Configure simple inventories.
- Perform basic management of systems.
- Run a provided playbook against specified nodes.
* Configure intrusion detection
- Install AIDE.
- Configure AIDE to monitor critical system files.
* Configure encrypted storage
- Encrypt and decrypt block devices using LUKS.
- Configure encrypted storage persistence using NBDE.
- Change encrypted storage passphrases.
* Restrict USB devices
- Install USBGuard.
- Write device policy rules with specific criteria to manage devices.
- Manage administrative policy and daemon configuration.
* Manage system login security using pluggable authentication modules (PAMs)
- Configure password quality requirements.
- Configure failed login policy.
- Modify PAM configuration files and parameters.
* Configure system auditing
- Write rules to log auditable events.
- Enable prepackaged rules.
- Produce audit reports.
* Configure SELinux
- Enable SELinux on a host running a simple application.
- Interpret SELinux violations and determine remedial action.
- Restrict user activity with SELinux user mappings.
- Analyse and correct existing SELinux configurations.
* Enforce security compliance
- Install OpenSCAP and Workbench.
- Use OpenSCAP and Red Hat Insights to scan hosts for security compliance.
- Use OpenSCAP Workbench to tailor policy.
- Use OpenSCAP Workbench to scan an individual host for security compliance.
- Use Red Hat Satellite server to implement an OpenSCAP policy.
- Apply OpenSCAP remediation scripts to hosts.
## Check out my CentOS 7 Server Hardening Guide:
https://www.lisenet.com/2017/centos-7-server-hardening-guide/
#---------------------------------------------------------------------
## Configure encrypted storage with LUKS and NBDE.
## The cryptsetup luksFormat command reformats the target block device!
# cryptsetup luksFormat /dev/sdb1
# cryptsetup luksDump /dev/sdb1
LUKS header information for /dev/sdb1
Version: 1
Cipher name: aes
Cipher mode: xts-plain64
Hash spec: sha256
Payload offset: 4096
MK bits: 256
MK digest: 79 20 6a de a7 14 c2 22 73 84 cc 05 02 86 24 04 85 05 4c f9
MK salt: 3d 82 35 0b c4 45 8a 82 21 d7 76 29 99 c4 76 6f
90 02 68 f5 6e a0 85 a0 24 71 35 a5 11 ac 84 d6
MK iterations: 43000
UUID: efa0533d-a6a9-4203-8de7-7c6c6e846cbc
Key Slot 0: ENABLED
Iterations: 344548
Salt: 8a 9c 00 6b 99 c2 0c 7f a1 35 cc d9 69 b6 4b 53
f9 66 59 0d 22 c4 b1 e8 0c 2a 0b e3 4a 80 28 df
Key material offset: 8
AF stripes: 4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
# cryptsetup isLuks -v /dev/sdb1
Command successful.
# cryptsetup luksOpen /dev/sdb1 crypto1
# mkfs.xfs /dev/mapper/crypto1
# mount /dev/mapper/crypto1 /mnt
# echo test > /mnt/test.txt
# umount /mnt
# cryptsetup luksClose crypto1
#---------------------------------------------------------------------
## Network-bound Disk Encryption (NBDE) automates the decryption of
## encrypted disks without manually entering any passphrase at boot time
## in a secure way, by ensuring that certain criteria are met.
## NBDE uses two key components: the Clevis framework and the Tang server.
# yum install tang
# systemctl enable tangd.socket
# systemctl start tangd.socket
# firewall-cmd --permanent --add-service=http
# firewall-cmd --reload
## To rotate the signature and exchange keys used by a Tang server, use
## jose toolkit. Tang server stores keys in the /var/db/tang directory.
# jose
Usage: jose COMMAND [OPTIONS] [ARGUMENTS]
Commands:
jose alg Lists all supported algorithms
jose fmt Converts JSON between serialization formats
jose b64 dec Decodes URL-safe Base64 data to binary
jose b64 enc Encodes binary data to URL-safe Base64
jose jwe dec Decrypts a JWE using the supplied JWKs and outputs plaintext
jose jwe enc Encrypts plaintext using one or more JWKs and outputs a JWE
jose jwe fmt Converts a JWE between serialization formats
jose jwk eql Determines if two or more JWKs are equal
jose jwk exc Performs a key exchange using the two input keys
jose jwk gen Creates a random JWK for each input JWK template
jose jwk pub Cleans private keys from a JWK
jose jwk thp Calculates the JWK thumbprint
jose jwk use Validates the permissions of a key for the specified use(s)
jose jws fmt Converts a JWS between serialization formats
jose jws sig Signs a payload using one or more JWKs and outputs a JWS
jose jws ver Verifies a JWS using the supplied JWKs and outputs payload
## See EXAMPLES section of the man page:
# man jose-jwk-gen
## Generate five keys, each targeting a different algorithm:
# cd /var/db/tang
# jose jwk gen -i '{"alg":"ES512"}' -o sig.jwk
# jose jwk gen -i '{"alg":"ECMR"}' -o exc.jwk
# jose jwk gen -i '{"alg":"HS256"}' -o oct.jwk
# jose jwk gen -i '{"alg":"RS256"}' -o rsa.jwk
# jose jwk gen -i '{"alg":"ES256"}' -o ec.jwk
## Tang immediately picks up all changes. No restart is required.
## Note that you need to rename the old keys, adding a dot as a prefix
## to the old key name.
## To change Tang's port number, override the tangd.socket unit file:
# grep Listen /usr/lib/systemd/system/tangd.socket
ListenStream=8080
#---------------------------------------------------------------------
## Configure Clevis framework with LUKS support:
# yum install clevis clevis-luks clevis-dracut
# clevis
Usage: clevis COMMAND [OPTIONS]
clevis decrypt Decrypts using the policy defined at encryption time
clevis encrypt http Encrypts using a REST HTTP escrow server policy
clevis encrypt sss Encrypts using a Shamir's Secret Sharing policy
clevis encrypt tang Encrypts using a Tang binding server policy
clevis luks bind Binds a LUKSv1 device using the specified policy
clevis luks unlock Unlocks a LUKSv1 volume
# clevis luks bind --help
Usage: clevis luks bind [-f] [-s SLT] [-k KEY] -d DEV PIN CFG
Binds a LUKSv1 device using the specified policy:
-f Do not prompt for LUKSMeta initialization
-d DEV The LUKS device on which to perform binding
-s SLT The LUKSMeta slot to use for metadata storage
-k KEY Non-interactively read LUKS password from KEY file
-k - Non-interactively read LUKS password from standard input
# clevis luks bind -d /dev/sdb1 tang '{"url":"http://server4.hl.local"}'
The advertisement contains the following signing keys:
57t8_p7CVzcDY4IrkIzud7bVzvo
Do you wish to trust these keys? [ynYN] y
You are about to initialize a LUKS device for metadata storage.
Attempting to initialize it may result in data loss if data was
already written into the LUKS header gap in a different format.
A backup is advised before initialization is performed.
Do you wish to initialize /dev/sdb1? [yn] y
Enter existing LUKS password: **********
# luksmeta --help
Usage: luksmeta test -d DEVICE
or: luksmeta nuke -d DEVICE [-f]
or: luksmeta init -d DEVICE [-f] [-n]
or: luksmeta show -d DEVICE [-s SLOT]
or: luksmeta save -d DEVICE [-s SLOT] -u UUID < DATA
or: luksmeta load -d DEVICE -s SLOT [-u UUID] > DATA
or: luksmeta wipe -d DEVICE -s SLOT [-u UUID] [-f]
# luksmeta show -d /dev/sdb1
0 active empty
1 active cb6e8904-81ff-40da-a84a-07ab9ab5715e
2 inactive empty
3 inactive empty
4 inactive empty
5 inactive empty
6 inactive empty
7 inactive empty
## If the Tang server is not available, force the Clevis framework to
## prompt for the LUKS passphrase during the boot process:
# systemctl enable clevis-luks-askpass.path
## Add an entry to crypttab:
# vim /etc/crypttab
crypto1 /dev/sdb1 none _netdev
## The third field specifies the absolute path to a file containing the
## encryption password. It is set to none in our case, which has a
## special meaning. Either the boot process will pause to prompt for
## manual entry of the encryption password on the server's console, or
## it will trigger block device decryption with NBDE.
# vim /etc/fstab
/dev/mapper/crypto1 /mnt/crypto1 xfs _netdev 1 2
## The _netdev option is needed if we are using NBDE Tang servers as
## a condition to decrypt the devices. This is because NBDE needs to use
## the network to contact those servers, and so decryption cannot occur
## until the network is available.
## Restart the server, it should boot and mount the disk automatically:
server4.hl.local systemd[1]: Started Tang Server (10.11.1.72:45308).
server4.hl.local systemd[1]: Starting Tang Server (10.11.1.72:45308)...
server4.hl.local tangd[11582]: 10.11.1.72 POST /rec/b5lGSJ221X772PUouPklDCPJ6Uk => 200 (src/tangd.c:168)
## Deploy highly available systems with Shamir's Secret Sharing.
## Clients should be configured with the ability to bind to multiple
## Tang servers. Check the man page for a high-availability setup:
# man clevis-encrypt-sss
# Require two servers to be available for automatic decryption to occur:
# cfg='{"t":2,"pins":{"tang":[{"url":"http://server3.hl.local"},{"url":"server4.hl.local"}]}}'
# clevis luks bind -d /dev/sdb1 sss "$cfg"
#---------------------------------------------------------------------
## Restrict USB devices.
# yum install usbguard usbutils udisks2
# systemctl enable usbguard
# usbguard
Usage: usbguard [OPTIONS] <command> [COMMAND OPTIONS] ...
Options:
Commands:
get-parameter <name> Get the value of a runtime parameter.
set-parameter <name> <value> Set the value of a runtime parameter.
list-devices List all USB devices recognized by the USBGuard daemon.
allow-device <id> Authorize a device to interact with the system.
block-device <id> Deauthorize a device.
reject-device <id> Deauthorize and remove a device from the system.
list-rules List the rule set (policy) used by the USBGuard daemon.
append-rule <rule> Append a rule to the rule set.
remove-rule <id> Remove a rule from the rule set.
generate-policy Generate a rule set (policy) based on the connected USB devices.
watch Watch for IPC interface events and print them to stdout.
read-descriptor Read a USB descriptor from a file and print it in human-readable form.
add-user <name> Add USBGuard IPC user/group (requires root privilges)
remove-user <name> Remove USBGuard IPC user/group (requires root privileges)
## Create an initial rule set and restart the service:
# usbguard generate-policy > /etc/usbguard/rules.conf
# systemctl restart usbguard
## List rules and devices:
# usbguard list-rules|cut -d" " -f1-6
1: allow id 1d6b:0001 serial "0000:00:01.2"
2: allow id 0627:0001 serial "42"
# usbguard list-devices|cut -d" " -f1-6
3: allow id 1d6b:0001 serial "0000:00:01.2"
4: allow id 0627:0001 serial "42"
# lsusb
Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
## If a USB device is attached to the system after the default policy
## is generated it is not authorised to access the system and is
## assigned a block rule target.
# usbguard list-devices|cut -d" " -f1-6
3: allow id 1d6b:0002 serial "0000:00:1d.7"
4: allow id 1d6b:0001 serial "0000:00:01.2"
5: allow id 1d6b:0001 serial "0000:00:1d.0"
6: allow id 1d6b:0001 serial "0000:00:1d.1"
7: allow id 1d6b:0001 serial "0000:00:1d.2"
8: allow id 0627:0001 serial "42"
9: block id 0a5c:5800 serial "0123456789ABCD"
## Dynamically authorise the USB device with device number 9:
# usbguard allow-device 9
## Use --permanent to make the change permanent:
# usbguard allow-device --permanent 9
# usbguard list-rules|cut -d" " -f1-6
1: allow id 1d6b:0001 serial "0000:00:01.2"
2: allow id 0627:0001 serial "42"
3: allow id 0a5c:5800 serial "0123456789ABCD"
## The usbguard daemon loads the usbguard-daemon.conf file, which it
## uses to configure runtime parameters of the daemon. We have to edit
## the usbguard-daemon.conf file to create a whitelist or blacklist.
# grep -ve ^# -ve ^$ /etc/usbguard/usbguard-daemon.conf
RuleFile=/etc/usbguard/rules.conf
ImplicitPolicyTarget=block
PresentDevicePolicy=apply-policy
PresentControllerPolicy=keep
InsertedDevicePolicy=apply-policy
RestoreControllerDeviceState=false
DeviceManagerBackend=uevent
IPCAllowedUsers=root
IPCAllowedGroups=
IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/
DeviceRulesWithPort=false
AuditBackend=FileAudit
AuditFilePath=/var/log/usbguard/usbguard-audit.log
## Man pages:
# man usbguard ;#(see EXAMPLES)
# man usbguard-rules.conf ;#(see Example Policies)
# man usbguard-daemon.conf ;#(see IPC ACCESS CONTROL)
# udisksctl help
Usage:
udisksctl COMMAND
Commands:
help Shows this information
info Shows information about an object
dump Shows information about all objects
status Shows high-level status
monitor Monitor changes to objects
mount Mount a filesystem
unmount Unmount a filesystem
unlock Unlock an encrypted device
lock Lock an encrypted device
loop-setup Set-up a loop device
loop-delete Delete a loop device
power-off Safely power off a drive
smart-simulate Set SMART data for a drive
Use "udisksctl COMMAND --help" to get help on each command.
# udisksctl status
MODEL REVISION SERIAL DEVICE
----------------------------------------------------------------------
QEMU QEMU HARDDISK 2.5+ drive-scsi0 sda
QEMU QEMU HARDDISK 2.5+ drive-scsi1 sdb
QEMU DVD-ROM 2.5+ QM00003 sr0
#---------------------------------------------------------------------
## Configure intrusion detection with AIDE.
# yum install aide
## The selection lines specify the files and directories that AIDE
## monitors, and the changes for which AIDE will watch. Selection lines
## can be regular, equals or negative.
# vim /etc/aide.conf
[...]
/etc/ PERMS
=/home DIR
!/var/log/httpd/
## Initialise the AIDE database and verify integrity:
# aide --init
# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
# aide --check
## Update the database after expected changes are made to the system:
# aide --update
## Configure AIDE daily scan:
# crontab -e
0 6 * * * root /usr/sbin/aide --check
## Man pages:
# man aide
# man aide.conf
#---------------------------------------------------------------------
## Manage system login security using PAMs.
## PAM manages both authentication and authorisation. PAM documentation:
$ man -k pam_
$ man pam_faildelay
$ man pam_time ;# (see /etc/security/time.conf)
$ man pam_access ;# (see /etc/security/access.conf)
$ man pam_pwquality ;# (see /etc/security/pwquality.conf)
$ man pam_sepermit ;# (see /etc/security/sepermit.conf)
$ man sepermit.conf
$ man pam_faillock ;# (does not a have a dedicated configuration file)
$ man pam_tty_audit
$ man pam.conf
## PAM rule types:
auth - users must pass these rules to validate their identity.
account - user account is valid and password has not expired.
password - control password changes (nothing to do with authentication).
session - manage tasks such as logging, device or console ownership.
## Note: PAM rules are parsed and executed from top to bottom!
## A dash (-) character in front of a type indicates to silently skip
## the rule if the module file is missing.
# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
## Common PAM controls:
required - the associated module must succeed.
requisite - similar to required but stops testing on error.
sufficient - returns success immediately if the associated module succeeds.
optional - ignore the result of the test, even if it fails.
include - include the rules from the provided PAM configuration file.
substack - works like include except that a failed test in the called
file gives back the control to the current file.
## Use the authconfig tool to configure PAM whenever possible!
## How to performan backup and restore:
# authconfig --savebackup=/root/pam_backup
# authconfig --restorebackup=/root/pam_backup
## Note that authconfig modifies two files:
/etc/pam.d/system-auth-ac
/etc/pam.d/password-auth-ac
## Most of the PAM service configuration files include the system-auth
## and password-auth files. These two files are symbolic links to the
## system-auth-ac and password-auth-ac files.
# ls -l system-auth password-auth
lrwxrwxrwx. 1 root root 16 Nov 12 2017 password-auth -> password-auth-ac
lrwxrwxrwx. 1 root root 14 Nov 12 2017 system-auth -> system-auth-ac
## When authconfig updates its *-ac files, the configuration changes
## take effect immediately.
## Prevent authconfig from overwriting local modifications:
# cd /etc/pam.d
# cp system-auth-ac system-auth-local
# cp password-auth-ac password-auth-local
# rm system-auth password-auth
# ln -s system-auth-local system-auth
# ln -s password-auth-local password-auth
# ls -l system-auth password-auth
lrwxrwxrwx. 1 root root 19 Jun 17 17:52 password-auth -> password-auth-local
lrwxrwxrwx. 1 root root 17 Jun 17 17:52 system-auth -> system-auth-local
## If you need to enable SSSD:
# yum -y install sssd
# authconfig --enablesssd --enablesssdauth --update
# grep pam_sss /etc/pam.d/*
#---------------------------------------------------------------------
## Configure system auditing.
/etc/audit/auditd.conf - main auditd confiugration file.
/etc/audit/audit.rules - the audit rules loaded by auditd.
/etc/audit/rules.d - folder containing manually configured audit rules.
/var/log/audit/audit.log - the default log file used by auditd.
## Documentation for auditd:
$ man auditd
$ man auditd.conf
$ man audit.rules
$ man audispd.conf
$ man ausearch
$ man aureport
$ man autrace
$ man auditctl
# grep -ve ^# /etc/audit/auditd.conf|sort -n
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_error_action = SUSPEND
disk_full_action = SUSPEND
dispatcher = /sbin/audispd
disp_qos = lossy
distribute_network = no
enable_krb5 = no
flush = INCREMENTAL_ASYNC
freq = 50
krb5_principal = auditd
local_events = yes
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
max_log_file = 8
max_log_file_action = ROTATE
name_format = NONE
num_logs = 5
priority_boost = 4
space_left = 75
space_left_action = SYSLOG
tcp_client_max_idle = 0
tcp_listen_queue = 5
tcp_max_per_addr = 1
use_libwrap = yes
verify_email = yes
write_logs = yes
## Write rules to log auditable events. Note that the order of rules
## is important. Audit rules work on first-match-wins basis.
## There are three types of audit rules:
1. File system rules (or watches) audit access to files and directories.
2. System call rules audit execution of system calls made by processes
communicating with the kernel to access system resources.
3. Control rules configure the audit system itself.
## The basic syntax of a file system rule is as follows:
# auditctl -w file -p permissions -k key
## The syntax of a system call rule is as follows:
# auditctl -a <list>,<action> \
[-F <filter-expression>] \
[-C <compare-expression>] \
[-S <system-call>]
## The man page of auditctl contains examples!
## Remove all rules:
# auditctl -D
## Set the currently loaded rules to be immutable.
# auditctl -e 2
## Enable prepackaged rules.
## These rules are available in the /usr/share/doc/audit-*/rules
## directory as files with the suffix .rules.
# ls -1 /usr/share/doc/audit-*/rules
10-base-config.rules
10-no-audit.rules
11-loginuid.rules
12-cont-fail.rules
12-ignore-error.rules
20-dont-audit.rules
21-no32bit.rules
22-ignore-chrony.rules
23-ignore-filesystems.rules
30-nispom.rules
30-pci-dss-v31.rules
30-stig.rules
31-privileged.rules
32-power-abuse.rules
40-local.rules
41-containers.rules
42-injection.rules
43-module-load.rules
70-einval.rules
71-networking.rules
99-finalize.rules
README-rules
## To use one of these prepackaged rule sets, copy the .rules file to
## the /etc/audit/rules.d directory, and run the "augenrules --load"
## command to reload the Audit rules.
# cp /usr/share/doc/audit-*/rules/30-stig.rules /etc/audit/rules.d/
# augenrules --load
# auditctl -l
## Make the configuration immutable by using a prepackaged rule, note
## that a system reboot is required to change audit rules:
# cat /usr/share/doc/audit-*/rules/99-finalize.rules
-e 2
## Produce audit reports.
## The aureport utility allows you to generate summary and columnar
## reports on the events recorded in Audit log files. Examples:
# aureport --start yesterday 00:00:00 --end today 00:00:00
# aureport -x --summary
# aureport -u --failed --summary -i
# aureport --tty
# aureport --help
usage: aureport [options]
-a,--avc Avc report
-au,--auth Authentication report
--comm Commands run report
-c,--config Config change report
-cr,--crypto Crypto report
-e,--event Event report
-f,--file File name report
--failed only failed events in report
-h,--host Remote Host name report
--help help
-i,--interpret Interpretive mode
-if,--input <Input File name> use this file as input
--input-logs Use the logs even if stdin is a pipe
--integrity Integrity event report
-l,--login Login report
-k,--key Key report
-m,--mods Modification to accounts report
-ma,--mac Mandatory Access Control (MAC) report
-n,--anomaly aNomaly report
-nc,--no-config Don't include config events
--node <node name> Only events from a specific node
-p,--pid Pid report
-r,--response Response to anomaly report
-s,--syscall Syscall report
--success only success events in report
--summary sorted totals for main object in report
-t,--log Log time range report
-te,--end [end date] [end time] ending date & time for reports
-tm,--terminal TerMinal name report
-ts,--start [start date] [start time] starting data & time for reports
--tty Report about tty keystrokes
-u,--user User name report
-v,--version Version
--virt Virtualization report
-x,--executable eXecutable name report
If no report is given, the summary report will be displayed
## Note: use the ausearch and aureport commands to analyse the audit log.
## Use autrace, ausearch and aureport to find info and generate a report:
# ausearch --start boot -m LOGIN --format csv
# autrace /bin/ls /root
Trace complete. You can locate the records with 'ausearch -i -p 1765'
# ausearch -i -p 1765
# ausearch -p 1765 --raw|aureport -i --file
File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 23/06/19 15:01:44 /bin/ls execve yes /usr/bin/ls root 802
2. 23/06/19 15:01:44 /etc/ld.so.preload access no /usr/bin/ls root 805
3. 23/06/19 15:01:44 /etc/ld.so.cache open yes /usr/bin/ls root 806
4. 23/06/19 15:01:44 /lib64/libselinux.so.1 open yes /usr/bin/ls root 810
5. 23/06/19 15:01:44 /lib64/libcap.so.2 open yes /usr/bin/ls root 818
6. 23/06/19 15:01:44 /lib64/libacl.so.1 open yes /usr/bin/ls root 825
7. 23/06/19 15:01:44 /lib64/libc.so.6 open yes /usr/bin/ls root 833
8. 23/06/19 15:01:44 /lib64/libpcre.so.1 open yes /usr/bin/ls root 841
9. 23/06/19 15:01:44 /lib64/libdl.so.2 open yes /usr/bin/ls root 848
10. 23/06/19 15:01:44 /lib64/libattr.so.1 open yes /usr/bin/ls root 856
11. 23/06/19 15:01:44 /lib64/libpthread.so.0 open yes /usr/bin/ls root 863
12. 23/06/19 15:01:44 /sys/fs/selinux statfs yes /usr/bin/ls root 891
13. 23/06/19 15:01:44 /sys/fs/selinux statfs yes /usr/bin/ls root 892
14. 23/06/19 15:01:44 /sys/fs/selinux stat yes /usr/bin/ls root 893
15. 23/06/19 15:01:44 /etc/selinux/config access yes /usr/bin/ls root 896
16. 23/06/19 15:01:44 /usr/lib/locale/locale-archive open yes /usr/bin/ls root 897
17. 23/06/19 15:01:44 /root stat yes /usr/bin/ls root 903
18. 23/06/19 15:01:44 /root openat yes /usr/bin/ls root 904
#---------------------------------------------------------------------
## Configure SELinux.
## SELinux works in one of three modes: enforcing, permissive, disabled.
# grep ^SELINUX /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted
# getenforce
Enforcing
# setenforce
usage: setenforce [ Enforcing | Permissive | 1 | 0 ]
## The most powerful way of getting SELinux information is by using man
## pages. On RHEL 7 SELinux man pages are not installed by default.
## We can install them and update the manual page index caches.
# yum provides *\sealert *\semanage *\sepolicy *\seinfo
# yum install -y policycoreutils-python policycoreutils-devel \
setroubleshoot-server setools-console
# sepolicy manpage -a -p /usr/share/man/man8
# mandb
## Use SELinux man pages:
$ man -k _selinux | less
$ man audit2allow
$ man semanage
$ man semanage-port
$ man semanage-fcontext
$ man semanage-user
$ man seinfo
$ man restorecon
## Listing various SElinux information:
# semanage fcontext -l
# semanage port -l
# semanage user -l
# semanage login -l
# semanage permissive -l
# getsebool -a
## Display the table that SELinux uses for this mapping:
# semanage login -l
Login Name SELinux User MLS/MCS Range Service
__default__ unconfined_u s0 *
root unconfined_u s0-s0:c0.c1023 *
sandy user_u s0 *
system_u system_u s0-s0:c0.c1023 *
tomcat staff_u s0-s0:c0.c1023 *
vince staff_u s0-s0:c0.c1023 *
## Confined SELinux users:
unconfined_u - do not have additional user-based SELinux restrictions.
user_u - non administrative users, no "su" or "sudo" is allowed.
staff_u - regular users, can use "sudo" but not "su".
sysadm_u - system admin users, "su" and "sudo" are allowed.
system_u - user for system services. Do not use it for Linux users.
## Note that Linux users are mapped to the SELinux user unconfined_u.
## To modify the default mapping to user_u: (see man semanage-login):
# semanage login -m -s user_u -r s0 __default__
## Map an existing Linux user to an SELinux user:
# semanage login -a -s sysadm_u vince
## Remove the mapping:
# semanage login -d -s sysadm_u vince
## SELinux usage examples.
## Add file-context for everything under /mnt/block1:
# semanage fcontext -a -t httpd_sys_content_t "/mnt/block1(/.*)?"
# restorecon -Rv /mnt/block1
## Allow Apache to listen on TCP port 8888:
# semanage port -a -t http_port_t -p tcp 8888
## Allow Apache to send emails (permanently):
# setsebool -P httpd_can_sendmail=1
## Interpret SELinux violations and determine remedial action:
# grep denied /var/log/audit/audit.log
# ausearch --start boot -m AVC
# sealert -a /var/log/audit/audit.log
## Restrict user activity with SELinux user mappings.
## At login time, SELinux maps Linux users to SELinux users.
## Note: Linux users mapped to unconfined_u do not have additional
## user-based SELinux restrictions! Do not use system_u for Linux users.
## SELinux prevents Linux users mapped to user_u from becoming root by
## using su or sudo:
# useradd -Z user_u sandy
## Linux users mapped to staff_u can use sudo but not su:
# useradd -Z staff_u tomcat
## SELinux allows Linux users mapped to sysadm_u to use su and sudo:
# useradd -Z sysadm_u vincent
## Note: by default users mapped to sysadm_u cannot use SSH to log in.
## Set the ssh_sysadm_login boolean to on if you need to allow it.
# setsebool -P ssh_sysadm_login on
## We can restrict whether or not users can run executables in their
## home directory or in /tmp:
# getsebool -a|grep exec_content
auditadm_exec_content --> on
dbadm_exec_content --> on
guest_exec_content --> on
logadm_exec_content --> on
secadm_exec_content --> on
staff_exec_content --> on
sysadm_exec_content --> on
user_exec_content --> on
xguest_exec_content --> on
## To prevent users from executing programs in their home directories
## and /tmp, set boolean user_exec_content to off:
# setsebool -P user_exec_content off
## IMPORTANT: SELinux allows staff_u users to change role to sysadm_r:
# semanage user -l
Labelling MLS/ MLS/
SELinux User Prefix MCS Level MCS Range SELinux Roles
guest_u user s0 s0 guest_r
root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r
staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r
sysadm_u user s0 s0-s0:c0.c1023 sysadm_r
system_u user s0 s0-s0:c0.c1023 system_r unconfined_r
unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r
user_u user s0 s0 user_r
xguest_u user s0 s0 xguest_r
## This comes in handy when a user needs to run commands with sudo. In
## such case the user needs to change his current role to sysadm_r:
# cat /etc/sudoers.d/users
vince ALL= ROLE=sysadm_r /bin/systemctl restart httpd
## Audit the SELinux policy.
## Retrieve the SELinux domain type of the systemd daemon:
# ps -Z -C systemd
LABEL PID TTY TIME CMD
system_u:system_r:init_t:s0 1 ? 00:00:03 systemd
## Retrieve the SELinux context type of the vsftpd executable:
# which vsftpd | xargs ls -Z
-rwxr-xr-x. root root system_u:object_r:ftpd_exec_t:s0 /usr/sbin/vsftpd
## Retrieve the SELinux domain transition rule for when a daemon of type
## init_t executes a program of type ftpd_exec_t:
# sesearch -T -s init_t -t ftpd_exec_t
Found 1 semantic te rules:
type_transition init_t ftpd_exec_t : process ftpd_t;
## Retrieve the SELinux domain type of the vsftpd daemon:
# ps -Z -C vsftpd
LABEL PID TTY TIME CMD
system_u:system_r:ftpd_t:s0-s0:c0.c1023 3394 ? 00:00:00 vsftpd
# touch /var/ftp/pub/test && ls -Z /var/ftp/pub/test
-rw-r--r--. root root unconfined_u:object_r:public_content_t:s0 /var/ftp/pub/test
## Retrieve the rule that allows the ftpd_t domain type to read files
## with the public_content_t type:
# sesearch -A -s ftpd_t -t public_content_t -c file
Found 2 semantic av rules:
allow ftpd_t public_content_t : file { ioctl read getattr lock open } ;
allow ftpd_t non_security_file_type : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
## More info:
# sesearch --help
Usage: sesearch [OPTIONS] RULE_TYPE [RULE_TYPE ...] [EXPESSION] [POLICY ...]
Search the rules in a SELinux policy.
RULE_TYPES:
-A, --allow allow rules
--neverallow neverallow rules
--auditallow auditallow rules
-D, --dontaudit dontaudit rules
-T, --type type_trans, type_member, and type_change
--role_allow role allow rules
--role_trans role_transition rules
--range_trans range_transition rules
--all all rules regardless of type, class, or perms
EXPRESSIONS:
-s NAME, --source=NAME rules with type/attribute NAME as source
-t NAME, --target=NAME rules with type/attribute NAME as target
--role_source=NAME rules with role NAME as source
--role_target=NAME rules with role NAME as target
-c NAME, --class=NAME rules with class NAME as the object class
-p P1[,P2,...], --perm=P1[,P2...]
rules with the specified permission
-b NAME, --bool=NAME conditional rules with NAME in the expression
OPTIONS:
-d, --direct do not search for type's attributes
-R, --regex use regular expression matching
-n, --linenum show line number for each rule if available
-S, --semantic search rules semantically instead of syntactically
-C, --show_cond show conditional expression for conditional rules
-h, --help print this help text and exit
-V, --version print version information and exit
If no expression is specified, then all rules are shown.
The default source policy, or if that is unavailable the default binary
policy, will be opened if no policy is provided.
#---------------------------------------------------------------------
## Enforce security compliance with OpenSCAP and Workbench.
## Install the SCAP Security Guide:
# yum install scap-security-guide
## The scap-security-guide package installs predefined profiles in the
## /usr/share/xml/scap/ssg/content/ directory.