Guide to the Secure Configuration of Red Hat Enterprise Linux 8

• GnuTLS library
• OpenSSL library
• NSS library
• OpenJDK
• Libkrb5
• BIND
• OpenSSH

part / --fstype=ext4 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE

$ sudo yum remove gdm

dconf update

/etc/dconf/db/gdm.d

/etc/dconf/db/local.d

user-db:user
system-db:local
system-db:site
system-db:distro

$ sudo yum install sudo

$ sudo chmod 4110 /usr/bin/sudo

 sudo cvtsudoers -f sudoers /etc/sudoers | grep -E '^Defaults !?(rootpw|targetpw|runaspw)$' 

 Defaults !targetpw
      Defaults !rootpw
      Defaults !runaspw 

 sudo find /etc/sudoers /etc/sudoers.d \( \! -name '*~' -a \! -name '*.*' \) -exec grep -E --with-filename '^[[:blank:]]*Defaults[[:blank:]](.*[[:blank:]])?!?\b(rootpw|targetpw|runaspw)' -- {} \; 

 /etc/sudoers:Defaults !targetpw
      /etc/sudoers:Defaults !rootpw
      /etc/sudoers:Defaults !runaspw 

$ sudo yum install binutils

$ sudo yum install dnf-plugin-subscription-manager

$ sudo yum install gnutls-utils

$ sudo yum install libcap-ng-utils

$ sudo yum install nss-tools

$ sudo yum install openscap-scanner

$ sudo yum install rear

$ sudo yum install rng-tools

$ sudo yum install scap-security-guide

$ sudo yum install subscription-manager

$ sudo yum install tar

$ sudo yum install vim-enhanced

$ sudo yum erase abrt-addon-ccpp

$ sudo yum erase abrt-addon-kerneloops

$ sudo yum erase abrt-cli

$ sudo yum erase abrt-plugin-logger

$ sudo yum erase abrt-plugin-rhtsupport

$ sudo yum erase abrt-plugin-sosreport

$ sudo yum erase geolite2-city

$ sudo yum erase geolite2-country

$ sudo yum erase gssproxy

$ sudo yum erase iprutils

$ sudo yum erase krb5-workstation

$ sudo yum erase libreport-plugin-logger

$ sudo yum erase libreport-plugin-rhtsupport

$ sudo yum erase pigz

$ sudo yum erase python3-abrt-addon

$ sudo yum erase tuned

$ sudo yum install dnf-automatic

gpgcheck=1

gpgcheck=0

$ sudo subscription-manager register

$ sudo rpm --import /media/cdrom/RPM-GPG-KEY

sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

$ sudo yum update

$ sudo systemctl enable dnf-automatic.timer

$ sudo chgrp root /etc/issue

$ sudo chgrp root /etc/issue.net

$ sudo chgrp root /etc/motd

$ sudo chown root /etc/issue 

$ sudo chown root /etc/issue.net 

$ sudo chown root /etc/motd 

$ sudo chmod 0644 /etc/issue

$ sudo chmod 0644 /etc/issue.net

$ sudo chmod 0644 /etc/motd

$ sudo yum install libpwquality

$ sudo grep pam_succeed_if /etc/pam.d/sudo

session     [default=1]    pam_lastlog.so showfailed

session    required     pam_namespace.so

$ sudo systemctl mask --now debug-shell.service

CtrlAltDelBurstAction=none

ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target

systemctl mask ctrl-alt-del.target

systemd.confirm_spawn=(1|yes|true|on)

/sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"

grub2-mkconfig -o /boot/grub2/grub.cfg

[Login]

StopIdleSessionSec=

$ sudo userdel unauthorized_user

$ sudo chage -I NUM_DAYS USER

$ sudo chage -M 180 -m 7 -W 7 USER

CREATE_HOME yes

FAIL_DELAY 

* hard maxlogins 

$ sudo mkdir --mode 000 /tmp/tmp-inst

/tmp     /tmp/tmp-inst/            level      root,adm

$ sudo mkdir --mode 000 /var/tmp/tmp-inst

/var/tmp /var/tmp/tmp-inst/    level      root,adm

typeset -xr TMOUT=

declare -xr TMOUT=

/etc/passwd

$ sudo chgrp USER_GROUP /home/USER/.INIT_FILE

$ sudo chmod o-w FILE

$ sudo chown USER /home/USER/.*

$ sudo mkdir /home/USER

$ sudo chgrp USER_GROUP /home/USER/FILE_DIR

$ sudo chown -R USER /home/USER

$ sudo chmod 0750 /home/USER/FILE_DIR

$ sudo chgrp USER_GROUP /home/USER

$ sudo chown USER /home/USER

$ sudo chmod 0740 /home/USER/.INIT_FILE

$ sudo chmod 0750 /home/USER

# ls -ld /home/USER

# chmod g-w /home/USER
# chmod o-rwx /home/USER

# echo $PATH

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/group -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/gshadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/passwd -F auid>=1000 -F auid!=unset -F key=modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b64 -S open -F a1&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b64 -S open_by_handle_at -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b32 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-a always,exit -F arch=b64 -S openat -F a2&03 -F path=/etc/shadow -F auid>=1000 -F auid!=unset -F key=user-modify

-e 2

-e 2

--loginuid-immutable

--loginuid-immutable

-w /etc/selinux/ -p wa -k MAC-policy

-w /etc/selinux/ -p wa -k MAC-policy

-w /usr/share/selinux/ -p wa -k MAC-policy

-w /usr/share/selinux/ -p wa -k MAC-policy

-a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export

-a always,exit -F arch=ARCH -S mount -F auid>=1000 -F auid!=unset -F key=export

-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session

-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session

-w /etc/sudoers -p wa -k actions

-w /etc/sudoers -p wa -k actions

-w /etc/sudoers.d/ -p wa -k actions

-w /etc/sudoers.d/ -p wa -k actions

$ sudo grep execve /etc/audit/audit.rules

$ sudo grep -r execve /etc/audit/rules.d

-a always,exit -F arch=b32 -S execve -C euid!=uid -F auid!=unset -k user_emulation

-a always,exit -F arch=b64  S execve -C euid!=uid -F auid!=unset -k user_emulation

$ sudo grep execve /etc/audit/audit.rules

$ sudo grep -r execve /etc/audit/rules.d

-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid

-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid

-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid

-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid

-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions

-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions

-f 

-f 

-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

-w /etc/group -p wa -k audit_rules_usergroup_modification

-w /etc/group -p wa -k audit_rules_usergroup_modification

-w /etc/gshadow -p wa -k audit_rules_usergroup_modification

-w /etc/gshadow -p wa -k audit_rules_usergroup_modification

-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

-w /etc/passwd -p wa -k audit_rules_usergroup_modification

-w /etc/passwd -p wa -k audit_rules_usergroup_modification

-w /etc/shadow -p wa -k audit_rules_usergroup_modification

-w /etc/shadow -p wa -k audit_rules_usergroup_modification

$ sudo auditctl -l | grep sudo.log
-w /var/log/sudo.log -p wa -k maintenance

-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=unset -F key=access-audit-trail

/var/log/audit/

$ sudo chgrp root /var/log/audit

/var/log/audit/

$ sudo chown root /var/log/audit 

$ sudo grep -iw log_file /etc/audit/auditd.conf

log_file = /var/log/audit/audit.log

$ sudo chmod 0700 audit_log_directory

/etc/audit/auditd.conf

/var/log/audit/

$ sudo chgrp root /var/log/audit/*

chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*

$ sudo chown root /etc/audit/ 

$ sudo chown root /etc/audit/rules.d/ 

/var/log/audit/

$ sudo chown root /var/log/audit 

$ sudo chown root /var/log/audit/* 

/etc/audit/auditd.conf

/var/log/audit/

$ sudo chown root /var/log/audit/* 

chmod 0640 /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*

$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

$ sudo chmod 0600 audit_log_file

-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod

-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod