From 42dacd2ae69a55fc5db020844e1150edc59a0955 Mon Sep 17 00:00:00 2001 From: Sven Vermeulen Date: Thu, 19 Sep 2013 21:26:16 +0200 Subject: Finish off old document --- xml/SCAP/gentoo-oval.xml | 55 +++++++ xml/SCAP/gentoo-xccdf.xml | 381 ++++++++++++++++++++++++---------------------- 2 files changed, 252 insertions(+), 184 deletions(-) diff --git a/xml/SCAP/gentoo-oval.xml b/xml/SCAP/gentoo-oval.xml index 4fe52b9..8cc1398 100644 --- a/xml/SCAP/gentoo-oval.xml +++ b/xml/SCAP/gentoo-oval.xml @@ -396,6 +396,37 @@ + + + + Verify that /etc/hosts.allow exists + + Gentoo Linux + + + This definition tests if /etc/hosts.allow exists. + + + + + + + + + + Verify that /etc/at/at.allow exists + + Gentoo Linux + + + This definition tests if /etc/at/at.allow exists. + + + + + + + @@ -587,6 +618,20 @@ + + + + + + + + + + @@ -664,6 +709,16 @@ 1 + + /etc/hosts.allow + + + + /etc/at/at.allow + + diff --git a/xml/SCAP/gentoo-xccdf.xml b/xml/SCAP/gentoo-xccdf.xml index bc6d977..6b3172e 100644 --- a/xml/SCAP/gentoo-xccdf.xml +++ b/xml/SCAP/gentoo-xccdf.xml @@ -71,6 +71,11 @@ + + + Introduction @@ -161,14 +166,14 @@ To validate the tests, the following commands can be used: # oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default gentoo-xccdf.xml - To generate a full report in HTML as well, you can use the next command: + To generate a full report in HTML as well, use the next command: # oscap xccdf eval --profile xccdf_org.gentoo.dev.swift_profile_default --results xccdf-results.xml --report report.html gentoo-xccdf.xml Finally, this benchmark will suggest some settings that do not reflect the will of the reader. That is perfectly fine - even more, some settings might even - raise eyebrows left and right. We will try to document the reasoning behind - the settings but you are free to deviate from them. If that is the case, + raise eyebrows left and right. This document will explain the reasoning behind + the settings but deviations are always possible. If that is the case, disable the rules in the XCCDF document or, better yet, create a new profile and only refer to the tests that are required. @@ -278,9 +283,9 @@ Before we start deploying Gentoo Linux and start hardening it, it is wise to take a step back and think about what we want to accomplish. Setting up a more secured Gentoo Linux isn't a goal, but a means to reach - something. Most likely, you are considering setting up a Gentoo Linux - powered server. What is this server for? Where will you put it? What other - services will you want to run on the same OS? Etc. + something. Most likely the system will become a Gentoo Linux powered server. + What is this server for? Where will it be hosted? What services are scheduled to run + on this operating system? Etc. Infrastructure architecturing @@ -298,10 +303,10 @@ Security is about reducing risks, not about harassing people or making work for a system administrator harder. And reducing risks also means - that you need to keep a clear eye out on your architecture and all its - components. If you do not know what you are integrating, where you are - putting it or why, then you have more issues to consider than hardening - a system. + that a clear eye needs to be kept on the architecture and all its + components. If there is no knowledge as to what is being integrated, where + it is going to be installed or why, then hardening by itself will probably not + do much to the secure state of the system. @@ -406,7 +411,7 @@ Let's start with the disadvantages: - Separate file systems mean that you need to do better disk space control + Separate file systems mean that better disk space control is needed (governing free space). A file system that is given too much free space means that disk space is being wasted, but a file system that is not given enough free disk space will need to be grown quickly - if possibile. This @@ -548,7 +553,7 @@ Use a Hardened Toolchain - When you install Gentoo, use the hardened stages and hardened toolchain. + When Gentoo is installed, use the hardened stages and hardened toolchain. The hardened toolchain includes additional security patches, such as support for non-executable program stacks and buffer overflow detection. @@ -839,19 +844,18 @@ mount -o remount,noexec /dev/shm Disk quota support Most file systems support the notion of quotas - limits - on the amount of data / files you are allowed to have on that - particular file system. + on the amount of data / files that are allowed on that particular file system. - To enable quotas, first configure your Linux kernel to include + To enable quotas, first configure the Linux kernel to include CONFIG_QUOTA. Next, install the sys-fs/quota package. # emerge quota Then add usrquota and grpquota to - the partitions (in /etc/fstab) where you want to - enable quotas on. For instance, the following snippet from + the partitions (in /etc/fstab) where quotas need to be + enabled on. For instance, the following snippet from /etc/fstab enables quotas on /var and /home. /dev/mapper/volgrp-home /home ext4 noatime,nodev,nosuid,usrquota,grpquota 0 0 @@ -861,8 +865,8 @@ mount -o remount,noexec /dev/shm # rc-update add quota boot Reboot the system so that the partitions are mounted with the correct - mount options and that the quota service is running. Then you can - setup quotas for users and groups. + mount options and that the quota service is running. Then the quotas for + users and groups can be set up. Managing @@ -970,7 +974,9 @@ sed -i -e 's:^rc_shell=.*:rc_shell="/sbin/sulogin":g' /etc/rc.conf Test if sulogin is used for single-user boot (/etc/inittab) - Set /sbin/sulogin or '/sbin/rc single' for single-user boot + + Set /sbin/sulogin or '/sbin/rc single' for single-user boot in /etc/inittab + @@ -990,49 +996,82 @@ sed -i -e 's:^rc_shell=.*:rc_shell="/sbin/sulogin":g' /etc/rc.conf More information on the format of these files can be obtained through man 5 hosts_access. + + Tests if /etc/hosts.allow exists + + Create and properly configure /etc/hosts.allow + + + + + - SSH Service + SSH service The SSH service is used for secure remote access towards a system, but also to provide secure file transfers. It is very commonly found on Unix/Linux - systems to proper hardening is definitely in place. + systems so proper hardening is definitely in place. Please use the "Hardening OpenSSH" guide for the necessary instructions. - Cron Service + Cron service A cron service is used to schedule tasks and processes on predefined times. Cron is most often used for regular maintenance tasks. - Only Allow Trusted Accounts Cron Access + Only allow trusted accounts cron access - Only allow trusted accounts to use cron. You should list trusted - accounts in /etc/cron.allow. + Only allow trusted accounts to use cron. How to achieve this depends on the cron service + installed. + + + If vixie-cron is installed, then have (only) those users that need cron access take part in the + cron unix group. + + + If dcron is used, then make sure /usr/sbin/crontab is only executable by + root and the cron unix group, and make sure (only) those users that need cron access take part + in the cron unix group. - At Service + At service The at service allows users to execute a task once on a given time. Unlike cron, this is not scheduled repeatedly - once executed, the task is considered completed and at will not invoke it again. - Only Allow Trusted Accounts At Access + Only allow trusted accounts at access - Only allow trusted accounts to use at. You should list trusted - accounts in /etc/at.allow. + Only allow trusted accounts to use at. Unlike cron access, at access is governed through + the /etc/at/at.allow file. If the at.allow file does not + exist but /etc/at/at.deny does, then all names not mentioned in + the file are allowed to run at. The most secure method is to use the at.allow + method. + + + The format of these files is one username per line. + + Tests if /etc/at/at.allow exists + + Create and properly configure /etc/at/at.allow + + + + + - NTP Service + NTP service With NTP, systems can synchronise their clocks, ensuring correct date and time information. This is important as huge clock drift could @@ -1040,26 +1079,21 @@ sed -i -e 's:^rc_shell=.*:rc_shell="/sbin/sulogin":g' /etc/rc.conf commands. - Synchronise The System Clock + Synchronise the system clock - Synchronise your systems' clock with an authorative NTP server, and - use the same NTP service for all your systems. + Synchronise the systems' clock with an authorative NTP server, and + use the same NTP service for all other systems. - You can accomplish this by regularly executing ntpdate, - but you can also use a service like net-misc/ntp's + This can be accomplished by regularly executing ntpdate, + but can also be handled using a service like net-misc/ntp's ntpd. - - + + Data flows - Clearly map out how data flows in and out of your server (and which data - this is). You will need this anyhow when you want to add firewalls, but it + Clearly map out how data flows in and out of the server (and which data + this is). This will be needed anyhow when firewalls are configured, but it also improves integration of the server in a larger infrastructure. - - Backup Your Data + + Backup the data - Make sure that your data is backed up. This is not only in case of - server loss, but also when you accidentally remove files or have an + Make sure that the data is backed up. This is not only in case of + server loss, but also to protect against accidental file removal or an awkward bug in a service that deleted important information. - - Automated Backups + + Automated backups - Automate backups on the system. If you need to perform a backup - manually, then you are doing it wrong and will start forgetting it. + Automate backups on the system. If the backups are performed manually + then they are done wrong and someone will eventually forget it. - You can use scheduling software like cron to + Use scheduling software like cron to automatically take backups on regular intervals, or use a central backup solution like bacula. - - Full Data Coverage + + Full data coverage Many users that do take backups only do this on what they seem as important files. However, it is wise to make full system backups too @@ -1509,22 +1526,21 @@ session required pam_unix.so or even weeks. - + Retention - Ensure that your backups use a long enough retention. It is not wise + Ensure that the backups use a long enough retention. It is not wise to take a single backup and overwrite this one over and over again, as - you might want to recover a file that was corrupted long before you - took your last backup. + there will be a time that a file needs to be recovered that was corrupted + long before the last backup was taken. - There is no perfect retention period however, as the more backups you - keep, the more storage you require and the more you need to invest in - managing your backups. + There is no perfect retention period however, as the more backups are + kept, the more storage is required and the more money or time needs to be invested in + managing the backups. - In most cases, you will want to introduce a "layered" approach on - retention. For instance, you can + In most cases, introduce a "layered" approach on retention. For instance: keep daily backups for a week @@ -1539,38 +1555,38 @@ session required pam_unix.so - - Off-site Backups + + Off-site backups - Keep your backups off-site in case of disaster. But consider this - location carefully. Investigate how fast you can put the backup there, - but also retrieve it in case you need it. Also investigate if this - location is juridically sane (are you allowed to put your location - there, and do you trust this off-site location). + Keep the backups off-site in case of disaster. But consider this + location carefully. Investigate how fast the backup can be put there, + but also how fast it can be retrieved it in case of need. Also investigate if this + location is juridically sane (is it allowed to put the data on this location + and is this off-site location trusted). Also ensure that the backups are stored securely. If necessary, - encrypt your backups. + encrypt the backups. - - Validate and Test + + Validate and test - Validate that your backup system works. Try recovering files (for + Validate that the backup system works. Try recovering files (for instance on a second server or different location) or even entire systems (virtualization is a great help here) and do this regularly. - - - Decommissioning Servers + + + Decommissioning servers - When you want to decommission a server, you should take care that its data + When a server needs to be decommissioned, make sure that its data is safeguarded from future extraction. - - Wipe Disks + + Wipe disks Clear all data from the disks on the server in a secure manner. Applications like shred (part of @@ -1579,14 +1595,11 @@ session required pam_unix.so It is recommended to perform full disk wipes rather than file wipes. - If you need to do this on file level, see if you can disable file system - journaling during the wipe session as journaling might "buffer" the + If this needs to be done on file level, see if the file system + journaling can be disabled during the wipe session as journaling might "buffer" the secure writes and only write the end result to the disk. - NIST - Publication "Guidelines for Media Sanitization" (PDF) + NIST Publication "Guidelines for Media Sanitization" (PDF) - - --> + -- cgit v1.2.3-65-gdbad