Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4

PRELINKING=no

$ sudo /usr/sbin/prelink -ua

• GnuTLS library
• OpenSSL library
• NSS library
• OpenJDK
• Libkrb5
• BIND
• OpenSSH

part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE
        

Partitioning Red Hat CoreOS is a Day 1 operation and cannot be changed afterwards. For documentation on how to add a MachineConfig manifest that specifies a separate /var/log partition, follow: https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic

Note that the Red Hat OpenShift documentation often references a block device, such as /dev/vda. The name of the available block devices depends on the underlying infrastructure (bare metal vs cloud), and often the specific instance type. For example in AWS, some instance types have NVMe drives (/dev/nvme*), others use /dev/xvda*. You will need to look for relevant documentation for your infrastructure around this. In many cases, the simplest thing is to boot a single machine with an Ignition configuration that just gives you SSH access, and inspect the block devices via e.g. the lsblk command. For physical hardware, a good best practice is to reference devices via the /dev/disk/by-id/ or /dev/disk/by-path links.

Partitioning Red Hat CoreOS is a Day 1 operation and cannot be changed afterwards. For documentation on how to add a MachineConfig manifest that specifies a separate /var/log/audit partition, follow: https://docs.openshift.com/container-platform/latest/installing/installing_platform_agnostic/installing-platform-agnostic.html#installation-user-infra-machines-advanced_disk_installing-platform-agnostic

Note that the Red Hat OpenShift documentation often references a block device, such as /dev/vda. The name of the available block devices depends on the underlying infrastructure (bare metal vs cloud), and often the specific instance type. For example in AWS, some instance types have NVMe drives (/dev/nvme*), others use /dev/xvda*. You will need to look for relevant documentation for your infrastructure around this. In many cases, the simplest thing is to boot a single machine with an Ignition configuration that just gives you SSH access, and inspect the block devices via e.g. the lsblk command. For physical hardware, a good best practice is to reference devices via the /dev/disk/by-id/ or /dev/disk/by-path links.

$ sudo dnf install sudo

$ sudo chgrp root /etc/sudoers.d

$ sudo chown root /etc/sudoers.d 

$ sudo chmod 0750 /etc/sudoers.d

$ sudo chgrp root /etc/sudoers

$ sudo chown root /etc/sudoers 

$ sudo chmod 0440 /etc/sudoers

$ sudo chmod 4111 /usr/bin/sudo

$ sudo dnf install gnutls-utils

$ sudo dnf install nss-tools

$ sudo subscription-manager register

$ sudo rpm --import /media/cdrom/RPM-GPG-KEY

sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

To address this, please create a MachineConfig object with the appropriate text in a drop-in file in /etc/issue.d/. You can also use the supplied remediation, which will be available based on scan results using `oc get remediations`. The default remediation is opinionated and you may need to adjust the MachineConfig accordingly for your use case. Do not try to edit /etc/issue directly as this is a symlink provided by the Operating System.

For example, if you're using the DoD required text, the manifest would look as follows:

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-etc-issue
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,You%20are%20accessing%20a%20U.S.%20Government%20%28USG%29%20Information%20System%20%28IS%29%20that%20is%20%0Aprovided%20for%20USG-authorized%20use%20only.%20By%20using%20this%20IS%20%28which%20includes%20any%20%0Adevice%20attached%20to%20this%20IS%29%2C%20you%20consent%20to%20the%20following%20conditions%3A%0A%0A-The%20USG%20routinely%20intercepts%20and%20monitors%20communications%20on%20this%20IS%20for%20%0Apurposes%20including%2C%20but%20not%20limited%20to%2C%20penetration%20testing%2C%20COMSEC%20monitoring%2C%20%0Anetwork%20operations%20and%20defense%2C%20personnel%20misconduct%20%28PM%29%2C%20law%20enforcement%20%0A%28LE%29%2C%20and%20counterintelligence%20%28CI%29%20investigations.%0A%0A-At%20any%20time%2C%20the%20USG%20may%20inspect%20and%20seize%20data%20stored%20on%20this%20IS.%0A%0A-Communications%20using%2C%20or%20data%20stored%20on%2C%20this%20IS%20are%20not%20private%2C%20are%20subject%20%0Ato%20routine%20monitoring%2C%20interception%2C%20and%20search%2C%20and%20may%20be%20disclosed%20or%20used%20%0Afor%20any%20USG-authorized%20purpose.%0A%0A-This%20IS%20includes%20security%20measures%20%28e.g.%2C%20authentication%20and%20access%20controls%29%20%0Ato%20protect%20USG%20interests--not%20for%20your%20personal%20benefit%20or%20privacy.%0A%0A-Notwithstanding%20the%20above%2C%20using%20this%20IS%20does%20not%20constitute%20consent%20to%20PM%2C%20LE%20%0Aor%20CI%20investigative%20searching%20or%20monitoring%20of%20the%20content%20of%20privileged%20%0Acommunications%2C%20or%20work%20product%2C%20related%20to%20personal%20representation%20or%20services%20%0Aby%20attorneys%2C%20psychotherapists%2C%20or%20clergy%2C%20and%20their%20assistants.%20Such%20%0Acommunications%20and%20work%20product%20are%20private%20and%20confidential.%20See%20User%20%0AAgreement%20for%20details.
        mode: 0644
        path: /etc/issue.d/legal-notice
        overwrite: true

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

$ sudo chgrp root /etc/issue

$ sudo chgrp root /etc/issue.net

$ sudo chown root /etc/issue 

$ sudo chown root /etc/issue.net 

$ sudo chmod 0644 /etc/issue

$ sudo chmod 0644 /etc/issue.net

$ sudo grep pam_succeed_if /etc/pam.d/sudo

session     [default=1]    pam_lastlog.so showfailed

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-debug-shell-disable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: debug-shell.service
        enabled: false
        mask: true
      - name: debug-shell.socket
        enabled: false
        mask: true

This will disable the debug-shell service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-disable-ctrlaltdel-burstaction
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,CtrlAltDelBurstAction%3Dnone
        mode: 0644
        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
        overwrite: true
EOF

This will add the relevant configuration to /etc/systemd/system.conf.d/, thus configuring Systemd apropriately.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-disable-ctrlaltdel-reboot
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: ctrl-alt-del.target
        mask: true
EOF

This will mask the ctrl-alt-del.target systemd target for all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

systemd.confirm_spawn=(1|yes|true|on)

/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

grub2-mkconfig -o /boot/grub2/grub.cfg

[Login]

StopIdleSessionSec=
        

$ sudo chage -I NUM_DAYS USER
        

$ sudo chage -M 180 -m 7 -W 7 USER

FAIL_DELAY 
        

* hard maxlogins 
        

$ sudo mkdir --mode 000 /tmp/tmp-inst

/tmp     /tmp/tmp-inst/            level      root,adm

$ sudo mkdir --mode 000 /var/tmp/tmp-inst

/var/tmp /var/tmp/tmp-inst/    level      root,adm

typeset -xr TMOUT=
        

declare -xr TMOUT=
        

# ls -ld /home/USER
        

# chmod g-w /home/USER
# chmod o-rwx /home/USER
        

# echo $PATH

/etc/passwd

$ sudo chgrp USER_GROUP /home/USER/.INIT_FILE
        

$ sudo chown USER /home/USER/.*

$ sudo chgrp USER_GROUP /home/USER/FILE_DIR
        

$ sudo chown -R USER /home/USER
        

$ sudo chmod 0750 /home/USER/FILE_DIR
        

$ sudo chmod 0740 /home/USER/.INIT_FILE
        

$ sudo chgrp root /boot/grub2/grub.cfg

$ sudo chgrp root /boot/grub2/user.cfg

$ sudo chown root /boot/grub2/grub.cfg 

$ sudo chown root /boot/grub2/user.cfg 

$ sudo chmod 600 /boot/grub2/grub.cfg

$ sudo chmod 600 /boot/grub2/user.cfg

$ sed -i 's/\(set superusers=\).*/\1"<unique user ID>"/g' /etc/grub.d/01_users

grubby --update-kernel=ALL

# grub2-setpassword

$ sudo chgrp root /boot/grub2/grub.cfg

$ sudo chgrp root /boot/grub2/user.cfg

$ sudo chown root /boot/grub2/grub.cfg 

$ sudo chown root /boot/grub2/user.cfg 

$ sudo chmod 700 /boot/grub2/grub.cfg

$ sudo chmod 600 /boot/grub2/user.cfg

$ActionSendStreamDriverAuthMode x509/name

action(type="omfwd" Target="some.example.com" StreamDriverAuthMode="x509/name")

$ActionSendStreamDriverMode 1

action(type="omfwd" ... StreamDriverMode="1")

$DefaultNetstreamDriver gtls

global(DefaultNetstreamDriver="gtls")

$ ls -l LOGFILE
        

$ sudo chgrp root LOGFILE
        

$ ls -l LOGFILE
        

$ sudo chown root LOGFILE
        

$ ls -l LOGFILE
        

$ sudo chmod 640 LOGFILE
        

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-systemd-journald-enable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: systemd-journald.service
        enabled: true

This will enable the systemd-journald service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

$ sudo chgrp systemd-journal /var/log/journal/.*/system.journal

$ sudo chown root /var/log/journal/.*/system.journal 

$ sudo chmod 0640 /var/log/journal/.*/system.journal

 $ sudo dnf install logrotate

# rotate log files frequency
daily

$ sudo systemctl enable logrotate.timer

$ sudo dnf install syslog-ng-core

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-syslog-ng-enable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: syslog-ng.service
        enabled: true

This will enable the syslog-ng service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imudp
$UDPServerRun 514

*.* @
        

*.* @@
        

*.* :omrelp:
        

• drop
  

  Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.

• block
  

  Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.

• public
  

  For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

• external
  

  For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

• dmz
  

  For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.

• work
  

  For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

• home
  

  For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

• internal
  

  For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.

• trusted
  

  All network connections are accepted.

# firewall-cmd --zone=public --list-all

# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench

# firewall-cmd --get-service

# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https

# firewall-cmd --get-service --permanent

$ sudo dnf install libreswan

$ sudo chgrp root /etc/ipsec.d

$ sudo chown root /etc/ipsec.d 

$ sudo chmod 0700 /etc/ipsec.d

$ sudo chgrp root /etc/ipsec.conf

$ sudo chgrp root /etc/ipsec.secrets

$ sudo chown root /etc/ipsec.conf 

$ sudo chown root /etc/ipsec.secrets 

$ sudo chmod 0644 /etc/ipsec.conf

$ sudo chmod 0644 /etc/ipsec.secrets

$ sudo dnf install iptables-nft

$ sudo dnf install iptables

$ sudo iptables -nL --line-numbers

$ sudo service iptables restart

Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination

$ sudo chgrp root /etc/iptables

$ sudo chown root /etc/iptables 

$ sudo chmod 0700 /etc/iptables

$ sudo chgrp root /etc/nftables

$ sudo chown root /etc/nftables 

$ sudo chmod 0700 /etc/nftables

---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 75-master-ufw-enable
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: ufw.service
        enabled: true

This will enable the ufw service in all the nodes labeled with the "master" role.

Note that this needs to be done for each MachineConfigPool

For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.

install atm /bin/false

install can /bin/false

install firewire-core /bin/false

install rds /bin/false

install sctp /bin/false

install tipc /bin/false

$ sudo chmod +t DIR
        

$ sudo chmod 0600 /boot/System.map*

$ sudo sysctl -w fs.protected_hardlinks=1

fs.protected_hardlinks = 1

$ sudo sysctl -w fs.protected_symlinks=1

fs.protected_symlinks = 1