Guide to the Secure Configuration of WRLinux
scap-security-guide
package which is developed at
https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG for WRLinux, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Profile ID | (default) |
---|
Revision History
Current version: 0.1.35
- draft (as of 2017-08-29)
Platforms
- cpe:/o:windriver:wrlinux:8
Table of Contents
- Remediation functions used by the SCAP Security Guide Project
- Introduction
- System Settings
- Installing and Maintaining Software
- File Permissions and Masks
- SE Linux Settings
- Account and Access Control
- Network Settings
- Logging Settings
- Auditing Settings
- Services
Checklist
Remediation functions used by the SCAP Security Guide Project [ref]groupXCCDF form of the various remediation functions as used by remediation scripts from the SCAP Security Guide Project. |
Introduction [ref]groupThe purpose of this guidance is to provide security configuration recommendations and baselines for the WRLinux operating system. Recommended settings for the basic operating system are provided, as well as for many network services that the system can provide to other systems. The guide is intended for system administrators. Readers are assumed to possess basic system administration skills for Unix-like systems, as well as some familiarity with the product's documentation and administration conventions. Some instructions within this guide are complex. All directions should be followed completely and with understanding of their effects in order to avoid serious adverse effects on the system and its security. |
General Principles [ref]groupThe following general principles motivate much of the advice in this guide and should also influence any configuration decisions that are not explicitly covered. |
Encrypt Transmitted Data Whenever Possible [ref]groupData transmitted over a network, whether wired or wireless, is susceptible to passive monitoring. Whenever practical solutions for encrypting such data exist, they should be applied. Even if data is expected to be transmitted only over a local network, it should still be encrypted. Encrypting authentication data, such as passwords, is particularly important. Networks of WRLinux machines can and should be configured so that no unencrypted authentication data is ever transmitted between machines. |
Minimize Software to Minimize Vulnerability [ref]groupThe simplest way to avoid vulnerabilities in software is to avoid installing that software. On WRLinux, the RPM Package Manager (originally Red Hat Package Manager, abbreviated RPM) allows for careful management of the set of software packages installed on a system. Installed software contributes to system vulnerability in several ways. Packages that include setuid programs may provide local attackers a potential path to privilege escalation. Packages that include network services may give this opportunity to network-based attackers. Packages that include programs which are predictably executed by local users (e.g. after graphical login) may provide opportunities for trojan horses or other attack code to be run undetected. The number of software packages installed on a system can almost always be significantly pruned to include only the software for which there is an environmental or operational need. |
Run Different Network Services on Separate Systems [ref]groupWhenever possible, a server should be dedicated to serving exactly one network service. This limits the number of other services that can be compromised in the event that an attacker is able to successfully exploit a software flaw in one network service. |
Configure Security Tools to Improve System Robustness [ref]groupSeveral tools exist which can be effectively used to improve a system's resistance to and detection of unknown attacks. These tools can improve robustness against attack at the cost of relatively little configuration effort. In particular, this guide recommends and discusses the use of host-based firewalling, SELinux for protection against vulnerable services, and a logging and auditing infrastructure for detection of problems. |
Least Privilege [ref]group
Grant the least privilege necessary for user accounts and software to perform tasks.
For example, |
How to Use This Guide [ref]groupReaders should heed the following points when using the guide. |
Read Sections Completely and in Order [ref]groupEach section may build on information and recommendations discussed in prior sections. Each section should be read and understood completely; instructions should never be blindly applied. Relevant discussion may occur after instructions for an action. |
Test in Non-Production Environment [ref]groupThis guidance should always be tested in a non-production environment before deployment. This test environment should simulate the setup in which the system will be deployed as closely as possible. |
Root Shell Environment Assumed [ref]group
Most of the actions listed in this document are written with the
assumption that they will be executed by the root user running the
|
Formatting Conventions [ref]group
Commands intended for shell execution, as well as configuration file text,
are featured in a |
Reboot Required [ref]groupA system reboot is implicitly required after some actions in order to complete the reconfiguration of the system. In many cases, the changes will not take effect until a reboot is performed. In order to ensure that changes are applied properly and to test functionality, always reboot the system after applying a set of recommendations from this guide. |
System Settings [ref]groupContains rules that check correct system settings. |
Installing and Maintaining Software [ref]groupThe following sections contain information on security-relevant choices during the initial operating system installation process and the setup of software updates. |
Updating Settings [ref]group |
Integrity Settings [ref]group |
Gnome Settings [ref]group |
File Permissions and Masks [ref]groupTraditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
$ mount -t xfs | awk '{print $3}'For any systems that use a different local filesystem type, modify this command as appropriate. |
Restrict Partition Mount Options [ref]group
System partitions can be mounted with certain options that limit what files on those partitions can do.
These options are set in the |
Restrict Dynamic Mounting and Unmounting of Filesystems [ref]group
Linux includes a number of facilities for the automated addition and removal of filesystems on a running system.
These facilities may be necessary in many environments, but this capability also carries some risk -- whether direct risk from allowing users to introduce arbitrary filesystems, or risk that software flaws in the automated mount facility itself could allow an attacker to compromise the system.
$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'If these filesystems are not required then they can be explicitly disabled in a configuratio file in /etc/modprobe.d .
|
Verify Permissions on Important Files and Directories [ref]groupPermissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses important permission restrictions which can be verified to ensure that no harmful discrepancies have arisen. |
Verify Permissions on Files with Local Account Information and Credentials [ref]group
The default restrictive permissions for files which act as important security databases such as |
Verify File Permissions Within Some Important Directories [ref]groupSome directories contain files whose confidentiality or integrity is notably important and may also be susceptible to misconfiguration over time, particularly if unpackaged software is installed. As such, an argument exists to verify that files' permissions within these directories remain configured correctly and restrictively. |
Execution Settings [ref]group |
SE Linux Settings [ref]group |
Account and Access Control [ref]groupIn traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. Therefore, making it more difficult for unauthorized people to gain shell access to accounts, particularly to privileged accounts, is a necessary part of securing a system. This section introduces mechanisms for restricting access to accounts under WRLinux. |
Protect Accounts by Restricting Password-Based Login [ref]groupConventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the |
Restrict Root Logins [ref]group
Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system via a unique unprivileged account, and then use |
Proper Storage and Existence of Password Hashes [ref]group
By default, password hashes for local accounts are stored in the second field (colon-separated) in |
Set Password Expiration Parameters [ref]group
The file # chage -M 180 -m 7 -W 7 USER |
Account expiration Settings [ref]group |
pam Settings [ref]group |
Secure Session Configuration Files for Login Accounts [ref]groupWhen a user logs into a Unix account, the system configures the user's session by reading a number of files. Many of these files are located in the user's home directory, and may have weak permissions as a result of user error or misconfiguration. If an attacker can modify or even read certain types of account configuration information, they can often gain full access to the affected user's account. Therefore, it is important to test and correct configuration file permissions for interactive accounts, particularly those of privileged users such as root or system administrators. |
Ensure that No Dangerous Directories Exist in Root's Path [ref]groupThe active path of the root account can be obtained by starting a new root shell and running: $ sudo echo $PATHThis will produce a colon-separated list of directories in the path. Certain path elements could be considered dangerous, as they could lead to root executing unknown or untrusted programs, which could contain malicious code. Since root may sometimes work inside untrusted directories, the . character, which represents the current directory, should never be in the root path, nor should any directory which can be written to by an unprivileged or semi-privileged (system) user.
It is a good practice for administrators to always execute privileged commands by typing the full path to the command. |
Ensure that Users Have Sensible Umask Values [ref]group
The umask setting controls the default permissions for the creation of new files.
With a default |
Physical Settings [ref]group |
Banners Settings [ref]group |
Network Settings [ref]group |
Kernel Settings [ref]group |
Wireless Settings [ref]group |
Ipv6 Settings [ref]group |
Firewalld Settings [ref]group |
Ssl Settings [ref]group |
Uncommon Settings [ref]group |
Ipsec Settings [ref]group |
Logging Settings [ref]group |
Auditing Settings [ref]group |
Services [ref]group
The best protection against vulnerable software is running less software. This section describes how to review
the software which WRLinux installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default WRLinux system and provides guidance about which
ones can be safely disabled.
|
Cron and At Daemons [ref]groupThe cron and at services are used to allow commands to be executed at a later time. The cron service is required by almost all systems to perform necessary maintenance tasks, while at may or may not be required on a given system. Both daemons should be configured defensively. |
ssh Settings [ref]group |
Ntp Settings [ref]group |
Audit Settings [ref]group |
Ftp Settings [ref]group |
Snmp Settings [ref]group |
Nfs Settings [ref]group |
Xorg Settings [ref]group |