Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| hardening [2019/02/07 17:31] – [Server setup] admin | hardening [2024/11/30 10:22] (current) – [Managing Accounts] dani | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Hardening ====== | + | ====== Hardening |
| ===== Updates ===== | ===== Updates ===== | ||
| Line 221: | Line 221: | ||
| Usually the password and account ageing is configured in ''/ | Usually the password and account ageing is configured in ''/ | ||
| - | {{:images/Hardening/users.png| User management}} | + | {{:images:users.png? |
| === PAM Modules === | === PAM Modules === | ||
| Line 488: | Line 488: | ||
| <code bash> | <code bash> | ||
| - | kinit admin Password for admin@EXAMPLE.COM: | + | kinit admin |
| + | Password for admin@EXAMPLE.COM: | ||
| ipa user-find admin | ipa user-find admin | ||
| Line 510: | Line 511: | ||
| <code bash> | <code bash> | ||
| - | getent passwd admin | + | getent passwd admin |
| + | getent group admins | ||
| + | kinit admin | ||
| </ | </ | ||
| Line 516: | Line 519: | ||
| <code bash> | <code bash> | ||
| - | ipa user-add gpyle --first=Gomer --last=Pyle --password | + | ipa user-add gpyle --first=Gomer --last=Pyle --password |
| + | ipa user-add cboyle --first=Charles --last=Boyle --password | ||
| + | ... | ||
| </ | </ | ||
| Line 534: | Line 539: | ||
| <code bash> | <code bash> | ||
| - | ipa sudocmd-add --desc "For displaying logs" / | + | ipa sudocmd-add --desc "For displaying logs" / |
| + | ipa sudocmdgroup-add --desc "List logs" loglist | ||
| + | ipa sudocmdgroup-add-member --sudocmds "/ | ||
| + | ipa sudorule-add --hostcat " | ||
| + | ipa sudorule-add-option loglist-attr | ||
| + | ipa sudorule-add-user --groups marines loglist-attr | ||
| + | ipa sudorule-add-allow-command --sudocmdgroups loglist loglist-attr | ||
| </ | </ | ||
| Line 554: | Line 565: | ||
| * Create and change into directory ('' | * Create and change into directory ('' | ||
| - | < | + | < |
| - | mkdir ca cd ca | + | mkdir ca |
| + | cd ca | ||
| </ | </ | ||
| Line 589: | Line 601: | ||
| Common name: serverX.example.com | Common name: serverX.example.com | ||
| - | Is this a TLS web client certificate? | + | Is this a TLS web client certificate? |
| + | Is this also a TLS web server certificate? | ||
| </ | </ | ||
| Line 596: | Line 609: | ||
| <code bash> | <code bash> | ||
| - | certtool --generate-certificate --load-request serverX-request.pem --outfile serverX-cert.pem --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem | + | certtool --generate-certificate --load-request serverX-request.pem --outfile serverX-cert.pem |
| + | --load-ca-certificate ca.pem --load-ca-privkey ca-key.pem | ||
| The certificate will expire in (days): 1000 | The certificate will expire in (days): 1000 | ||
| - | Is this a TLS web client certificate? | + | Is this a TLS web client certificate? |
| + | Is this also a TLS web server certificate? | ||
| + | Enter a dnsName of the subject of the certificate: | ||
| </ | </ | ||
| Line 608: | Line 624: | ||
| <code bash> | <code bash> | ||
| - | # make gtls driver the default $DefaultNetstreamDriver gtls | + | # make gtls driver the default |
| + | $DefaultNetstreamDriver gtls | ||
| - | # certificate files $DefaultNetstreamDriverCAFile / | + | # certificate files |
| + | $DefaultNetstreamDriverCAFile / | ||
| + | $DefaultNetstreamDriverCertFile / | ||
| + | $DefaultNetstreamDriverKeyFile / | ||
| $ModLoad imtcp # load TCP listener | $ModLoad imtcp # load TCP listener | ||
| - | $InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode $InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated $InputTCPServerRun 6514 # listen on port 6514 | + | $InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode |
| + | $InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated | ||
| + | $InputTCPServerRun 6514 # listen on port 6514 | ||
| </ | </ | ||
| Line 620: | Line 642: | ||
| <code bash> | <code bash> | ||
| - | # certificate files - just CA for a client $DefaultNetstreamDriverCAFile / | + | # certificate files - just CA for a client |
| + | $DefaultNetstreamDriverCAFile / | ||
| - | # set up the action $DefaultNetstreamDriver gtls | + | # set up the action |
| - | # use gtls netstream driver $ActionSendStreamDriverMode 1 | + | $DefaultNetstreamDriver gtls # use gtls netstream driver |
| - | # require TLS for the connection $ActionSendStreamDriverAuthMode anon | + | $ActionSendStreamDriverMode 1 # require TLS for the connection |
| - | # server is NOT authenticated | + | $ActionSendStreamDriverAuthMode anon # server is NOT authenticated |
| + | *.* @@(o)serverX.example.com: | ||
| </ | </ | ||
| Line 650: | Line 674: | ||
| The trace command is probably useful (Example for date): | The trace command is probably useful (Example for date): | ||
| - | < | + | < |
| autrace /bin/date | autrace /bin/date | ||
| Waiting to execute: /bin/date | Waiting to execute: /bin/date | ||
| Line 664: | Line 688: | ||
| Using '' | Using '' | ||
| - | < | + | < |
| Chain INPUT (policy ACCEPT 0 packets, 0 bytes) | Chain INPUT (policy ACCEPT 0 packets, 0 bytes) | ||
| num pkts bytes target | num pkts bytes target | ||
| Line 687: | Line 711: | ||
| A very basic example script to initialize '' | A very basic example script to initialize '' | ||
| - | < | + | < |
| iptables -F | iptables -F | ||
| iptables -A INPUT -i lo -j ACCEPT | iptables -A INPUT -i lo -j ACCEPT | ||
| Line 699: | Line 723: | ||
| To delete a rule: | To delete a rule: | ||
| - | < | + | < |
| iptables -D INPUT 11 | iptables -D INPUT 11 | ||
| </ | </ | ||
| Line 705: | Line 729: | ||
| To add a rule (insert): | To add a rule (insert): | ||
| - | < | + | < |
| iptables -I INPUT 11 | iptables -I INPUT 11 | ||
| </ | </ | ||