در ادامه سری مقالات hardening سیستم عامل centos 7 به بررسی موارد دیگری که باید ایمن شوند می پردازیم
۱۷- هرس کردن کاربران غیر فعال
برای این منظور دستورات زیر را اجرا کنید
echo “Idle users will be removed after 15 minutes”
echo “readonly TMOUT=900” >> /etc/profile.d/os-security.sh
echo “readonly HISTFILE” >> /etc/profile.d/os-security.sh
chmod +x /etc/profile.d/os-security.sh
۱۸- ایمن کردن cron
برای این منظور به ترتیب کارهای زیر را انجام دهید
echo “Locking down Cron”
touch /etc/cron.allow
chmod 600 /etc/cron.allow
awk -F: ‘{print $1}’ /etc/passwd | grep -v root > /etc/cron.deny
echo “Locking down AT”
touch /etc/at.allow
chmod 600 /etc/at.allow
awk -F: ‘{print $1}’ /etc/passwd | grep -v root > /etc/at.deny
۱۹- ایمن سازی sysctl
برای این منظور فایل /etc/sysctl.conf را ویرایش کرده و موارد زیر را در آن اضافه میکنیم.
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.tcp_max_syn_backlog = 1280
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_timestamps = 0
۲۰- اعمال رول های پایه بر روی فایروال
برای این منظور موارد زیر را در فایل تنظیمات iptables کپی میکنیم
#Drop anything we aren’t explicitly allowing. All outbound traffic is okay
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT – [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp –icmp-type echo-reply -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp –icmp-type destination-unreachable -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp –icmp-type time-exceeded -j ACCEPT
# Accept Pings
-A RH-Firewall-1-INPUT -p icmp –icmp-type echo-request -j ACCEPT
# Log anything on eth0 claiming it’s from a local or non-routable network
# If you’re using one of these local networks, remove it from the list below
-A INPUT -i eth0 -s 10.0.0.0/8 -j LOG –log-prefix “IP DROP SPOOF A: ”
-A INPUT -i eth0 -s 172.16.0.0/12 -j LOG –log-prefix “IP DROP SPOOF B: ”
-A INPUT -i eth0 -s 192.168.0.0/16 -j LOG –log-prefix “IP DROP SPOOF C: ”
-A INPUT -i eth0 -s 224.0.0.0/4 -j LOG –log-prefix “IP DROP MULTICAST D: ”
-A INPUT -i eth0 -s 240.0.0.0/5 -j LOG –log-prefix “IP DROP SPOOF E: ”
-A INPUT -i eth0 -d 127.0.0.0/8 -j LOG –log-prefix “IP DROP LOOPBACK: ”
# Accept any established connections
-A RH-Firewall-1-INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
# Accept ssh traffic. Restrict this to known ips if possible.
-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
#Log and drop everything else
-A RH-Firewall-1-INPUT -j LOG
-A RH-Firewall-1-INPUT -j DROP
COMMIT
بعد از انجام کارهای بالا چک میکنیم ببینیم آیا iptables فعال است یا نه و آن را فعال میکنیم
sudo systemctl enable iptables
systemctl start iptables.service
۲۱- غیر فعال کردن پروتکل های غیر ضروری
برا یان منظور دستورات زیر را اجرا میکنیم
echo “install dccp /bin/false” > /etc/modprobe.d/dccp.conf
echo “install sctp /bin/false” > /etc/modprobe.d/sctp.conf
echo “install rds /bin/false” > /etc/modprobe.d/rds.conf
echo “install tipc /bin/false” > /etc/modprobe.d/tipc.conf
نکته : در زیر توضیحی از هر کدام از این پروتکل ها آمده است
Datagram Congestion Control Protocol (DCCP)
Stream Control Transmission Protocol (SCTP)
Reliable Datagram Sockets (RDS)
Transparent Inter-Process Communication (TIPC)
۲۲- نصب rsyslog و فعال کردن آن
در این فسمت ابتدا rsyslog را که یک log سرور می باشد با دستور زیر نصب میکنیم
yum -y install rsyslog
و سپس با دستورات زیر آن را فعال میکنیم
systemctl enable rsyslog.service
systemctl start rsyslog.service
۲۳- نصب ابزار auditd و اعمال رول های پیش فرض بر روی آن
این ابزار در واقع یک فایروال لایه ۷ میباشد که اجازه نمی دهد نرم افزار ها و سرویس ها هر کاری که دلشان بخواهد را انجام دهند.
برای این منظور ابتدا باید آن را فعال کنیم
systemctl enable auditd.service
systemctl start auditd.service
سپس فایل /etc/audit/audit.rules را ویرایش میکنیم و رول های زیر را در آن قرار میدهیم
# audit_time_rules – Record attempts to alter time through adjtime
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules
# audit_time_rules – Record attempts to alter time through settimeofday
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules
# audit_time_rules – Record Attempts to Alter Time Through stime
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime
-k audit_time_rules
# audit_time_rules – Record Attempts to Alter Time Through clock_settime
-a always,exit -F arch=b64 -S clock_settime -k audit_time_rules
# Record Attempts to Alter the localtime File
-w /etc/localtime -p wa -k audit_time_rules
# Record Events that Modify User/Group Information
# audit_account_changes
-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes
# Record Events that Modify the System’s Network Environment
# audit_network_modifications
-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_network_modifications
-w /etc/issue -p wa -k audit_network_modifications
-w /etc/issue.net -p wa -k audit_network_modifications
-w /etc/hosts -p wa -k audit_network_modifications
-w /etc/sysconfig/network -p wa -k audit_network_modifications
#Record Events that Modify the System’s Mandatory Access Controls
-w /etc/selinux/ -p wa -k MAC-policy
#Record Events that Modify the System’s Discretionary Access Controls – chmod
-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – chown
-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fchmod
-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fchmodat
-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fchown
-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fchownat
-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fremovexattr
-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fsetxattr
-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – lchown
-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – lremovexattr
-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – lsetxattr
-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – removexattr
-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fchown
-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fchownat
-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fremovexattr
-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – fsetxattr
-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – removexattr
-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Events that Modify the System’s Discretionary Access Controls – setxattr
-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod
#Record Attempts to Alter Logon and Logout Events
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
#Record Attempts to Alter Process and Session Initiation Information
-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session
#Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access
#Ensure auditd Collects Information on the Use of Privileged Commands
#
# Find setuid / setgid programs then modify and uncomment the line below.
#
## sudo find / -xdev -type f -perm -4000 -o -perm -2000 2>/dev/null
#
# -a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged
#Ensure auditd Collects Information on Exporting to Media (successful)
-a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k export
#Ensure auditd Collects File Deletion Events by User
-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete
#Ensure auditd Collects System Administrator Actions
-w /etc/sudoers -p wa -k actions
#Ensure auditd Collects Information on Kernel Module Loading and Unloading
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module -S delete_module -k modules
#Make the auditd Configuration Immutable
-e 2
۲۴- پاک کردن سرویس هایی که مورد نیاز نیست
برای این منظور دستورات زیر را اجرا میکنیم
# Remove
yum remove xinetd
yum remove telnet-server
yum remove rsh-server
yum remove telnet
yum remove rsh-server
yum remove rsh
yum remove ypbind
yum remove ypserv
yum remove tftp-server
yum remove cronie-anacron
yum remove bind
yum remove vsftpd
yum remove httpd
yum remove dovecot
yum remove squid
yum remove net-snmpd
و سپس آنها را غیرفعال میکنیم. برای این منظور دستورات زیر را اجرا میکنیم
#Disable / Enable
systemctl disable xinetd
systemctl disable rexec
systemctl disable rsh
systemctl disable rlogin
systemctl disable ypbind
systemctl disable tftp
systemctl disable certmonger
systemctl disable cgconfig
systemctl disable cgred
systemctl disable cpuspeed
systemctl enable irqbalance
systemctl disable kdump
systemctl disable mdmonitor
systemctl disable messagebus
systemctl disable netconsole
systemctl disable ntpdate
systemctl disable oddjobd
systemctl disable portreserve
systemctl enable psacct
systemctl disable qpidd
systemctl disable quota_nld
systemctl disable rdisc
systemctl disable rhnsd
systemctl disable rhsmcertd
systemctl disable saslauthd
systemctl disable smartd
systemctl disable sysstat
systemctl enable crond
systemctl disable atd
systemctl disable nfslock
systemctl disable named
systemctl disable httpd
systemctl disable dovecot
systemctl disable squid
systemctl disable snmpd
