Red Hat Enterprise Linux Hardening Checklist
Preparation and Physical Security
- If machine is a new install, protect it from hostile network traffic until the operating system is installed and hardened.
- Set a BIOS/firmware password.
- Configure the device boot order to prevent unauthorized booting from alternate media.
- Use the latest version of RHEL possible.
- Create a separate partition with the nodev, nosuid, and noexec options set for /tmp. Create separate partitions for /var, /var/log, /var/log/audit, and /home.
- Bind mount /var/tmp to /tmp.
- Set nodev option to /home.
- Set nodev, nosuid, and noexec options on /dev/shm.
- Set sticky bit on all world-writable directories.
- Register with Red Hat Satellite Server so that the system can receive patch updates.
- Install the Red Hat GPG key and enable gpgcheck.
Secure Boot Settings
- Set user/group owner to root, and permissions to read and write for root only, on /boot/grub2/grub.cfg.
- Set boot loader password.
- Remove the X Window system.
- Disable X Font Server.
- Restrict core dumps.
- Enable Randomized Virtual Memory Region Placement.
- Remove legacy services (e.g., telnet-server; rsh, rlogin, rcp; ypserv, ypbind; tftp, tftp-server; talk, talk-server)
- Disable any services and applications started by xinetd or inetd that are not being utilized.
- Remove xinetd, if possible.
- Disable legacy services (e.g., chargen-dgram, chargen-stream, daytime-dgram, daytime-stream, echo-dgram, echo-stream, tcpmux-server)
- Disable or remove server services that are not going to be utilized (e.g., FTP, DNS, LDAP, SMB, DHCP, NFS, SNMP, etc.)
- Set Daemon umask
Network Security and Firewall Configuration
- Limit connections to services running on the host to authorized users of the service via firewalls and other access control technologies.
- Disable IP forwarding.
- Disable send packet redirects.
- Disable source routed packet acceptance.
- Disable ICMP redirect acceptance.
- Enable Ignore Broadcast Requests.
- Enable Bad Error Message Protection.
- Enable TCP/SYN cookies.
Remote Administration via SSH
- Set SSH protocol to 2.
- Set SSH LogLevel to INFO.
- Disable SSH Root login.
- Set SSH PermitEmptyPasswords to No.
System Integrity and Intrusion Detection
- Install and configure AIDE.
- Configure SELinux.
- Install and configure OSSec HIDS.
- Configure Network Time Protocol (NTP).
- Enable system accounting (auditd).
- Install and configure rsyslog.
- All administrator or root access must be logged.
- Configure log shipping to separate device/service (e.g. Splunk).
- Integrity checking of system accounts, group memberships, and their associated privileges should be enabled and tested.
- Ensure that the configuration files for PAM, /etc/pam.d/* are secure.
- Upgrade password hashing algorithm to SHA-512.
- Set password creation requirements.
- Restrict root login to system console.
- If network or physical access services are running, ensure the university warning banner is displayed.
- If the system allows logins via a graphical user interface, ensure the university warning banner is displayed prior to login.
- Install and enable anti-virus software.
- Configure to update signature daily on AV.
Additional Security Notes
- Systems will provide secure storage for Category-I data as required by confidentiality, integrity, and availability needs. Security can be provided by means such as, but not limited to, encryption, access controls, filesystem audits, physically securing the storage media, or any combination thereof as deemed appropriate.