Download as PDF, PPTX
![CONFIGURING
TANG SERVER
# yum install tang
# systemctl enable tangd.socket -
-now
[enabling socket activation]
# firewall-cmd --zone=public --
add-service=http --permanent
[setting up the firewall]
# firewall-cmd --reload](https://image.slidesharecdn.com/serverhardeningmethedologies1-191020170744/85/Server-hardening-methedologies-10-320.jpg)
![Configuring clevis
# yum install clevis clevis-luks clevis-dracut -y
# cfg = $'{"t"=1,"pins":{"tang":[{"url":"http://192.168.0.5"}]}}'
# clevis luks bind -d /dev/vdb1 sss "$cfg"
or #clevis bind luks -d /dev/vdb1 tang '{"url":"http://tang.srv"}'
# systemctl enable clevis-luks-askpass.path
# vim /etc/crypttab
encryptedvdb1 /dev/vdb1 none _netdev
# vim /etc/fstab
/dev/mapper/encryptedvdb1 /encrypt xfs _netdev 1 2](https://image.slidesharecdn.com/serverhardeningmethedologies1-191020170744/85/Server-hardening-methedologies-12-320.jpg)
More Related Content
Similar to Server hardening methedologies
![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
Server hardening methedologies
- 1.
- 2. TABLE OF CONTENTS What isServer Hardening Why Server Hardening Linux Servers Hardening Luks Encryption and NBDE Filesystem configuration AIDE Users Introduction to OpenSCAP
- 3. What is ServerHardening? Server Hardening is the process of enhancing server security through a variety of means which results in a much more secure server operating environment.
- 4. What to harden? 1Hardware Security Encrypting the hard disks of the whole infrastructure 2 Software Securtiy Having in place, the right configurations and exercising best security practices.
- 5. DISK ENCRYPTION WITH LUKS Itstands for Linux Unified Key Setup-on- disk-format LUKS provides passphrase strengthening LUKS devices contain multiple key slots, allowing backup keys/passphrases.
- 6. USING CRYPTSETUP cryptsetup isused to conveniently setup dm- crypt managed device- mapper mappings. # fdisk /dev/vdb # cryptsetup luksFormat /dev/vdb1 # cryptsetup luksOpen /dev/vdb1 secure # mkfs.ext4 /dev/mapper/secure # mount /dev/mapper/secure /mnt # partprobe
- 7. PERMANENT MOUNTING # vim/etc/fstab /dev/mapper/secure /mnt ext4 defaults 0 0 # vim /etc/crypttab secure /dev/vdb1 -
- 8. The Network-Bound DiskEncryption (NBDE) allows the user to encrypt root volumes of hard drives on physical and virtual machines without requiring to manually enter a password when systems are restarted. Controlling file system decryption using NBDE (Network Bound Disk Encryption)
- 10. CONFIGURING TANG SERVER # yuminstall tang # systemctl enable tangd.socket - -now [enabling socket activation] # firewall-cmd --zone=public -- add-service=http --permanent [setting up the firewall] # firewall-cmd --reload
- 11. CONFIGURING CLEVIS What's in aName? In NBDE, Clevis provides automated unlocking of LUKS volumes. C L E V I S C L E V I S - L U K S C L E V I S - D R A C U T PACKAGES
- 12. Configuring clevis # yum install clevis clevis-luks clevis-dracut -y # cfg = $'{"t"=1,"pins":{"tang":[{"url":"http://192.168.0.5"}]}}' # clevis luks bind -d /dev/vdb1 sss "$cfg" or #clevis bind luks -d /dev/vdb1 tang '{"url":"http://tang.srv"}' # systemctl enable clevis-luks-askpass.path # vim /etc/crypttab encryptedvdb1 /dev/vdb1 none _netdev # vim /etc/fstab /dev/mapper/encryptedvdb1 /encrypt xfs _netdev 1 2
- 13. Configurational settings Filesystem Check forthe suid on different partitions AIDE AIDE takes a filesystem snapshot that can be used to check for any modifications Users and Groups Ensure 0 is UID of root. User should own their home dir. Logging Configure logging on a remote server so that any system compromise can be reviewed
- 14. File System Configurations Ensurethat /tmp is a separate partition. nosuid and noexec is set on /tmp Ensure separate partition exist for /var Ensure nodev, noexec, nosuid is set on /dev/shm Disable USB storage Ensure sticky bit is set on world-writable directories
- 15. # yum installaide Custom Rules be added in Configuration file : /etc/aide.conf Commands: # aide --init # aide --update # aide --check AIDE (Advanced Intrusion Detection Environment)
- 16. USERS SETTINGS Be carefulwhile assigning suid to a binary Ensure root is the only UID 0 account Ensure user's home directory permission is 750 or more restricitve Ensure no user have .forward files
- 17. Security with SeLinux #semanage login -l # semanage login -m -s user_u -r s0 __default__ # setsebool -P user_exec_content off ------------------------------------------------------------------------------ Selinux offers user mapping to restrict what an user can do
- 18. BUT THAT SEEMS ALOT OF WORK!!!
- 19.
- 20. INTRODUCTION TO OPENSCAP OpenSCAP toollets you check security configuration settings of a system, and examine the system for signs of a compromise by using rules based on standards and specifications. S C A P - S E C U R I T Y - G U I D E Scap security guide is a collection of security policies for linux system in the form of scap docs # yum install scap-security-guide
- 21. FEATURES cost-effective and flexible implementation of security compliance toolsfor automated vulnerability checking Available for cross platform.
- 22. OpenSCAP tools 1 OpenSCAPbase Command line tool for configuration and vulnerability scans 3 SCAP workbench Graphical tool for configuration and vulnerability scans 2 OpenSCAP daemon Service that runs in background to ensure your machines are evaluated according to the schedule 4 SCAP Timony It is a middleware that stores SCAP results
- 23. USING THE SCAP WORKBENCH Package #yum install scap-workbench -y # scap-workbench
- 24.