Red Hat Enterprise Linux 7 Hardening Checklist

MAC Address

IP Address

Machine Name

Asset Tag

Administrator Name

Date

Step

√

To Do

CIS

UT Note

Cat I

Cat II/III

Min Std

1

If machine is a new install, protect it from hostile network traffic until the operating system is installed and hardened.

§

!

! 

5.1

2

Set a BIOS/firmware password.

!

4.1

16

Disable X Font Server.

20

Disable any services and applications started by xinetd or inetd that are not being utilized.

§

!

!

5.4

25

Limit connections to services running on the host to authorized users of the service via firewalls and other access control technologies.

4.7

§

!

!

5.5

33

Set SSH protocol to 2.

6.2.1

§

!

!

5.6

40

Configure Network Time Protocol (NTP).

3.6

§

!

41

Enable system accounting (auditd).

5.2

§

!

6.1

43

All administrator or root access must be logged.

!

6.4

45

Integrity checking of system accounts, group memberships, and their associated privileges should be enabled and tested.

§

!

5.9

46

Ensure that the configuration files for PAM, /etc/pam.d/* are secure.

6.3

§

!

!

5.12

50

If network or physical access services are running, ensure the university warning banner is displayed.

6.2.14, 8.1

§

!

!

5.10

51

If the system allows logins via a graphical user interface, ensure the university warning banner is displayed prior to login.

8.3

§

!

52

Install and enable anti-virus software.

§

3.1

53

Configure to update signature daily on AV.

§

3.3

54

Systems will provide secure storage for Category-I data as required by confidentiality, integrity, and availability needs. Security can be provided by means such as, but not limited to, encryption, access controls, filesystem audits, physically securing the storage media, or any combination thereof as deemed appropriate.

§

!

!

5.7

1

If other alternatives are unavailable, this can be accomplished by installing a SOHO router/firewall in between the network and the host to be protected.

11

Install and use the yum-security plugin.
To install the plugin run:

yum install yum-security

To list all updates that are security relevant, and get a reutrn code on whether there are security updates use:

yum --security check-update

To apply updates that are security relevant use:

yum --security update

15

A simple way to disable the GUI is to change the default run level. Edit the file /etc/inittab. Look for the line that contains the following:

id:5:initdefault: 

Replace the "5" with "3". The line will then read:

id:3:initdefault: 

20

Disable any xinetd services you do not absolutely require by setting "disable=yes" in /etc/xinetd.d/*.
If no xinetd services are required, disable xinetd altogether

sudo service xinetd stop; sudo chkconfig xinetd off

Configure TCP wrappers for access control.
Edit /etc/hosts.deny to include this entry as the first uncommented line in the file: ALL:ALL
Ensure /etc/hosts.allow is edited appropriately to allow the administrator(s) to connect.
Unless "r" commands (i.e., rsh, rlogin) are required, remove or empty the file /etc/hosts.equiv.
If "r" commands are required, consider replacing them with a secure alternative such as SSH.
Verify that you have disabled any unnecessary startup scripts under /etc, /etc/rc*.d, or /etc/init.d (or startup script directory for your system) and disabled any unneeded services from starting in these scripts.
Unnecessary services can be disabled with:

$ sudo chkconfig off

To check what services are listening use: 

$ lsof 	\| grep '*:' 

OR

$ sudo netstat \--tulp

Much more detailed information regarding services is available in the CIS benchmark documents.
Red Hat also provides a text-based interface for changing startup services:
ntsysv
For example, the command

ntsysv \--level 345

configures runlevels 3, 4, and 5.

25

Red Hat comes with iptables. Below is a list of some iptables resources:
http://firehol.sourceforge.net
http://sourceforge.net/projects/fwbuilder
http://www.simonzone.com/software/guarddog

If you decide to utilize SSH, the ISO highly recommends the following:

• Change the port from port 22 to something/anything else. There are scripts online that malicious hackers can use against an SSH server. These scripts always attack port 22 since most people do not change the default port.
• Restrict access to the SSH port using a hardware or software firewall.
• Do not allow root logins via SSH.

• If possible, use keys with passphrase instead of just passwords. To create rsa keys, follow these commands:

  ssh-keygen \--t rsa
  ssh server "mkdir .ssh; chmod 0700 .ssh"
  scp ./ssh/ida_rsa.pub server:.ssh/authorized_keys2

• The CIS Solaris Benchmark covers some suggested basic settings to place in the configuration file.
  You may also want to visit the SSL Web site.

37

There is a license fee for Tripwire. The Tripwire management console can be very helpful for managing more complex installations.
AIDE is a free tool available from SourceForge.
SamHain is another free tool, as is OSSEC HIDS.

40

ITS Networking operates two stratum 2 NTPv4 (NTP version 4) servers for network time synchronization services for university network administrators.

45

• Check in /etc/sudoers to see who has sudo rights
• Check in /etc/groups to see what groups your users belong to
• Check in /etc/passwd and/or /etc/shadow for blank passwords
• Check the strength of users' passwords with tools such as John the Ripper
• Seek approval from IT Owner. Consider using a simple dictionary for easily guessed passwords.
• Develop a procedure to report and remediate easily guessed passwords.

Ensure the following are set in /etc/pam.d/other:

• auth  required pam_deny.so
• auth   required pam_warn.so
• account  required pam_deny.so
• account  required pam_warn.so
• password  required pam_deny.so
• password  required pam_warn.so
• session  required pam_deny.so
• session  required pam_warn.so
• session  required pam_deny.so

Warn will report alerts to syslog.

48

To require strong passwords, in compliance with section 5.18 of the Information Resources Use and Security Policy:

For RHEL 6:

In /etc/pam.d/system-auth, add or change the file as required to read:

password   required     pam_cracklib.so retry=3 difok=5 minlen=8 lcredit=-1 dcredit=-1 ocredit=-1
password   sufficient   pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=10
password   required     pam_deny.so
password   required     pam_warn.so

For RHEL 7:

In /etc/security/pwquality.conf, add:

difok = 5
minlen = 8
minclass = 1
maxrepeat = 0
maxclassrepeat = 0
lcredit = -1
ucredit = 0
dcredit = -1
ocredit = -1
gecoscheck = 1

In /etc/pam.d/system-auth, add or change the file as required to read:

password    required    pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient  pam_unix.so sha512 shadow try_first_pass use_authtok remember=10
password    required    pam_deny.so

49

Ensure that the terminal security file (for example, /etc/securetty or /etc/ttys) is configured to deny privileged (root) access. On a Red Hat box, this means that no virtual devices (such as /dev/pty*) appear in this file.

50

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

51

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

52

There are few viruses that infect Linux computers; therefore, it is understandable for most Linux servers to have an exception to this rule. See the Operations Manual for information on the exception process.

You may choose any proven anti-virus product. One option is ClamAV.

53

There are few viruses that infect Linux computers; therefore, it is understandable for most Linux servers to have an exception to this rule. See the Operations Manual for information on the exception process.

54