Guide to the Secure Configuration of openEuler 2203

• GnuTLS library
• OpenSSL library
• NSS library
• OpenJDK
• Libkrb5
• BIND
• OpenSSH

gpgcheck=1

gpgcheck=0

$ sudo chgrp root /etc/issue

$ sudo chgrp root /etc/issue.net

$ sudo chgrp root /etc/motd

$ sudo chown root /etc/issue 

$ sudo chown root /etc/issue.net 

$ sudo chown root /etc/motd 

$ sudo chmod 0644 /etc/issue

$ sudo chmod 0644 /etc/issue.net

$ sudo chmod 0644 /etc/motd

$ sudo systemctl mask --now debug-shell.service

$ sudo chage -I NUM_DAYS USER
        

$ sudo chage -M 180 -m 7 -W 7 USER

typeset -xr TMOUT=
        

declare -xr TMOUT=
        

$ sudo mkdir /home/USER
        

# grub2-setpassword

# grub2-setpassword

cron.*                                                  /var/log/cron

cron.* action(type="omfile" file="/var/log/cron")

auth.*;authpriv.*;daemon.*                              /var/log/secure

$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imudp
$UDPServerRun 514

• drop
  

  Any incoming network packets are dropped, there is no reply. Only outgoing network connections are possible.

• block
  

  Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.

• public
  

  For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

• external
  

  For use on external networks with masquerading enabled especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

• dmz
  

  For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.

• work
  

  For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

• home
  

  For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

• internal
  

  For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.

• trusted
  

  All network connections are accepted.

# firewall-cmd --zone=public --list-all

# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench

# firewall-cmd --get-service

# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https

# firewall-cmd --get-service --permanent

$ sudo iptables -nL --line-numbers

$ sudo service iptables restart

Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination

$ sudo systemctl enable nftables.service

install sctp /bin/false

install tipc /bin/false

$ sudo chmod +t DIR
        

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null

$ sudo sysctl -w fs.protected_hardlinks=1

fs.protected_hardlinks = 1

$ sudo sysctl -w fs.protected_symlinks=1

fs.protected_symlinks = 1

install usb-storage /bin/false

$ sudo sysctl -w kernel.dmesg_restrict=1

kernel.dmesg_restrict = 1

$ sudo sysctl -w kernel.sysrq=0

kernel.sysrq = 0

$ sudo sysctl -w kernel.yama.ptrace_scope=1

kernel.yama.ptrace_scope = 1

-a always,exit -F arch=b32 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S chmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S chown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchmod -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchmodat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchown -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fchownat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S fsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S lremovexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S lsetxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S removexattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S rename -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b64 -S setxattr -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-perm-change

-a always,exit -F arch=b32 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S unlink -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b64 -S unlinkat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete

-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access

-a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules

-w /var/log/lastlog -p wa -k logins

-w /var/log/lastlog -p wa -k logins

-w /sbin/insmod -p x -k modules

-w /sbin/modprobe -p x -k modules

-w /sbin/modprobe -p x -k modules

-w /sbin/rmmod -p x -k modules

-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged

-a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=unset -F key=privileged

-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules

-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules

-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules

-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules

-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules

-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules

-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules

-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules

$ sudo systemctl mask --now avahi-daemon.service

$ sudo chgrp root /etc/at.allow

$ sudo chgrp root /etc/cron.allow

$ sudo chown root /etc/at.allow 

$ sudo chown root /etc/cron.allow 

$ sudo chmod 0640 /etc/at.allow

$ sudo chmod 0640 /etc/cron.allow

$ sudo systemctl mask --now dhcpd.service

$ sudo systemctl mask --now named.service

$ sudo dnf erase httpd

$ sudo dnf erase openldap-clients

$ sudo dnf erase ypserv

$ sudo dnf erase telnet-server

 $ sudo dnf erase tftp-server

 $ sudo dnf erase samba

$ sudo dnf erase net-snmp

HostbasedAuthentication no

Protocol 2

PermitEmptyPasswords no

IgnoreRhosts yes

PermitRootLogin no

AllowTcpForwarding no

IgnoreUserKnownHosts yes

X11Forwarding no

PermitUserEnvironment no

UsePAM yes

Banner /etc/issue.net

LogLevel VERBOSE

MaxAuthTries 
        

MaxSessions 
        

MaxStartups 
        

Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

KexAlgorithms 
        

MACs 
        

sudo dnf remove xorg-x11-server-Xorg xorg-x11-server-common xorg-x11-server-utils xorg-x11-server-Xwayland