Red Hat Enterprise Linux 7

1 Red Hat Enterprise Linux 7 Security GuideConcepts and techniques to secure RHEL servers and workstationsLast Updated: 2021-12-07 Red Hat Enterprise Linux 7 Security GuideConcepts and techniques to secure RHEL servers and workstationsMirek JahodaRed Hat Customer Content FialaRed Hat Customer Content WadeleyRed Hat Customer Content ServicesRobert Kr tk Red Hat Customer Content ServicesMartin Prpi Red Hat Customer Content ServicesIoanna GkiokaRed Hat Customer Content ServicesTom apekRed Hat Customer Content ServicesYoana RusevaRed Hat Customer Content ServicesMiroslav SvobodaRed Hat Customer Content ServicesLegal NoticeCopyright 2020 Red Hat, document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike License. If you distribute this document, or a modified version of it, you must provideattribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hattrademarks must be Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,Section 4d of CC-BY-SA to the fullest extent permitted by applicable Hat, Red Hat Enterprise Linux , the Shadowman logo, the Red Hat logo, JBoss, OpenShift,Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc.

2 , registered in the United Statesand other is the registered trademark of Linus Torvalds in the United States and other is a registered trademark of Oracle and/or its is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United Statesand/or other is a registered trademark of MySQL AB in the United States, the European Union andother is an official trademark of Joyent. Red Hat is not formally related to or endorsed by theofficial Joyent open source or commercial OpenStack Word Mark and OpenStack logo are either registered trademarks/service marksor trademarks/service marks of the OpenStack Foundation, in the United States and othercountries and are used with the OpenStack Foundation's permission. We are not affiliated with,endorsed or sponsored by the OpenStack Foundation, or the OpenStack other trademarks are the property of their respective book assists users and administrators in learning the processes and practices of securingworkstations and servers against local and remote intrusion, exploitation, and malicious on Red Hat Enterprise Linux but detailing concepts and techniques valid for all Linuxsystems, this guide details the planning and the tools involved in creating a secured computingenvironment for the data center, workplace, and home.

3 With proper administrative knowledge,vigilance, and tools, systems running Linux can be both fully functional and secured from mostcommon intrusion and exploit ..Table of ContentsCHAPTER 1. OVERVIEW OF SECURITY WHAT IS COMPUTER SECURITY? SECURITY VULNERABILITY SECURITY COMMON EXPLOITS AND ATTACKSCHAPTER 2. SECURITY TIPS FOR SECURING PARTITIONING THE INSTALLING THE MINIMUM AMOUNT OF PACKAGES RESTRICTING NETWORK CONNECTIVITY DURING THE INSTALLATION POST-INSTALLATION ADDITIONAL RESOURCESCHAPTER 3. KEEPING YOUR SYSTEM MAINTAINING INSTALLED USING THE RED HAT CUSTOMER ADDITIONAL RESOURCESCHAPTER 4. HARDENING YOUR SYSTEM WITH TOOLS AND DESKTOP CONTROLLING ROOT SECURING SECURING NETWORK SECURING DNS TRAFFIC WITH SECURING VIRTUAL PRIVATE NETWORKS (VPNS) USING USING USING CONFIGURING AUTOMATED UNLOCKING OF ENCRYPTED VOLUMES USING CHECKING INTEGRITY WITH USING HARDENING TLS USING SHARED SYSTEM USING REMOVING DATA SECURELY USING SCRUBCHAPTER 5.

4 USING GETTING STARTED WITH INSTALLING THE FIREWALL-CONFIG GUI CONFIGURATION VIEWING THE CURRENT STATUS AND SETTINGS OF STARTING STOPPING CONTROLLING WORKING WITH USING ZONES TO MANAGE INCOMING TRAFFIC DEPENDING ON PORT CONFIGURING IP ADDRESS MANAGING ICMP SETTING AND CONTROLLING IP SETS USING FIREWALLD5567111417171718181919202024252 6263442647281949910211812913013514214514 5147147150150153153153157160162164165167 Table of Contents1.. SETTING AND CONTROLLING IP SETS USING USING THE DIRECT CONFIGURING COMPLEX FIREWALL RULES WITH THE "RICH LANGUAGE" CONFIGURING FIREWALL CONFIGURING LOGGING FOR DENIED ADDITIONAL RESOURCESCHAPTER 6. GETTING STARTED WITH NFTABLESWHEN TO USE FIREWALLD OR WRITING AND EXECUTING NFTABLES CREATING AND MANAGING NFTABLES TABLES, CHAINS, AND CONFIGURING NAT USING USING SETS IN NFTABLES USING VERDICT MAPS IN NFTABLES CONFIGURING PORT FORWARDING USING USING NFTABLES TO LIMIT THE AMOUNT OF DEBUGGING NFTABLES RULESCHAPTER 7.

5 SYSTEM AUDITINGUse AUDIT SYSTEM INSTALLING THE AUDIT CONFIGURING THE AUDIT STARTING THE AUDIT DEFINING AUDIT UNDERSTANDING AUDIT LOG SEARCHING THE AUDIT LOG CREATING AUDIT ADDITIONAL RESOURCESCHAPTER 8. SCANNING THE SYSTEM FOR CONFIGURATION COMPLIANCE AND CONFIGURATION COMPLIANCE TOOLS IN VULNERABILITY CONFIGURATION COMPLIANCE REMEDIATING THE SYSTEM TO ALIGN WITH A SPECIFIC REMEDIATING THE SYSTEM TO ALIGN WITH A SPECIFIC BASELINE USING THE SSG CREATING A REMEDIATION ANSIBLE PLAYBOOK TO ALIGN THE SYSTEM WITH A SPECIFIC SCANNING THE SYSTEM WITH A CUSTOMIZED PROFILE USING SCAP DEPLOYING SYSTEMS THAT ARE COMPLIANT WITH A SECURITY PROFILE IMMEDIATELY AFTER SCANNING CONTAINERS AND CONTAINER IMAGES FOR ASSESSING CONFIGURATION COMPLIANCE OF A CONTAINER OR A CONTAINER IMAGE WITH ASPECIFIC SCANNING AND REMEDIATING CONFIGURATION COMPLIANCE OF CONTAINER IMAGES ANDCONTAINERS USING ATOMIC SCAP SECURITY GUIDE PROFILES SUPPORTED IN RHEL RELATED INFORMATIONCHAPTER 9.

6 FEDERAL STANDARDS AND FEDERAL INFORMATION PROCESSING STANDARD (FIPS) NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL (NISPOM) PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS) SECURITY TECHNICAL IMPLEMENTATION GUIDE17017117217617918018218218218719119 5197200201203206206207208208209210216222 2222232252252262282322332342352392412432 44246255257257259259259 Security Guide2..APPENDIX A. ENCRYPTION SYNCHRONOUS PUBLIC-KEY ENCRYPTIONAPPENDIX B. REVISION HISTORY260260260264 Table of Contents3 Security Guide4 CHAPTER 1. OVERVIEW OF SECURITY TOPICSDue to the increased reliance on powerful, networked computers to help run businesses and keep trackof our personal information, entire industries have been formed around the practice of network andcomputer security. Enterprises have solicited the knowledge and skills of security experts to properlyaudit systems and tailor solutions to fit the operating requirements of their organization.

7 Because mostorganizations are increasingly dynamic in nature, their workers are accessing critical company ITresources locally and remotely, hence the need for secure computing environments has become , many organizations (as well as individual users) regard security as more of anafterthought, a process that is overlooked in favor of increased power, productivity, convenience, easeof use, and budgetary concerns. Proper security implementation is often enacted postmortem after anunauthorized intrusion has already occurred. Taking the correct measures prior to connecting a site to anuntrusted network, such as the Internet, is an effective means of thwarting many attempts at document makes several references to files in the /lib directory. When using 64-bitsystems, some of the files mentioned may instead be located in WHAT IS COMPUTER SECURITY?Computer security is a general term that covers a wide area of computing and information that depend on computer systems and networks to conduct daily business transactions andaccess critical information regard their data as an important part of their overall assets.

8 Several termsand metrics have entered our daily business vocabulary, such as total cost of ownership (TCO), return oninvestment (ROI), and quality of service (QoS). Using these metrics, industries can calculate aspectssuch as data integrity and high-availability (HA) as part of their planning and process managementcosts. In some industries, such as electronic commerce, the availability and trustworthiness of data canmean the difference between success and Standardizing SecurityEnterprises in every industry rely on regulations and rules that are set by standards-making bodies suchas the American Medical Association (AMA) or the Institute of Electrical and Electronics Engineers(IEEE). The same ideals hold true for information security. Many security consultants and vendors agreeupon the standard security model known as CIA, or Confidentiality, Integrity, and Availability. This three-tiered model is a generally accepted component to assessing risks of sensitive information andestablishing security policy.

9 The following describes the CIA model in further detail:Confidentiality Sensitive information must be available only to a set of pre-defined transmission and usage of information should be restricted. For example,confidentiality of information ensures that a customer's personal or financial information is notobtained by an unauthorized individual for malicious purposes such as identity theft or Information should not be altered in ways that render it incomplete or users should be restricted from the ability to modify or destroy Information should be accessible to authorized users any time that it is is a warranty that information can be obtained with an agreed-upon frequency andtimeliness. This is often measured in terms of percentages and agreed to formally in ServiceLevel Agreements (SLAs) used by network service providers and their Enterprise 1. OVERVIEW OF SECURITY Cryptographic Software and CertificationsThe following Red Hat Knowledgebase article provides an overview of the Red Hat Enterprise Linuxcore crypto components, documenting which are they, how are they selected, how are they integratedinto the operating system, how do they support hardware security modules and smart cards, and how docrypto certifications apply to Core Crypto SECURITY CONTROLSC omputer security is often divided into three distinct master categories, commonly referred to ascontrols:PhysicalTechnicalAdministrati veThese three broad categories define the main objectives of proper security implementation.

10 Withinthese controls are sub-categories that further detail the controls and how to implement Physical ControlsPhysical control is the implementation of security measures in a defined structure used to deter orprevent unauthorized access to sensitive material. Examples of physical controls are:Closed-circuit surveillance camerasMotion or thermal alarm systemsSecurity guardsPicture IDsLocked and dead-bolted steel doorsBiometrics (includes fingerprint, voice, face, iris, handwriting, and other automated methodsused to recognize individuals) Technical ControlsTechnical controls use technology as a basis for controlling the access and usage of sensitive datathroughout a physical structure and over a network. Technical controls are far-reaching in scope andencompass such technologies as:EncryptionSmart cardsNetwork authenticationAccess control lists (ACLs)File integrity auditing softwareSecurity Administrative ControlsAdministrative controls define the human factors of security.