l='stylesheet' type='text/css' href='/cgit.css'/>
about summary refs log tree commit diff stats
path: root/core/hardening.html
blob: 1455398b1e8091469f231b618225092037a0c023 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
<!DOCTYPE html>
<html dir="ltr" lang="en">
    <head>
        <meta charset='utf-8'>
        <title>2.2. Hardening</title>
    </head>
    <body>

        <a href="index.html">Core OS Index</a>

        <h1>2.2. Hardening</h1>

        <p>Check <a href="apparmor.html">apparmor</a>,
        <a href="sysctl.html">sysctl</a>, 
        <a href="toolchain.html">toolchain</a> and
        <a href="samhain.html">samhain</a> before running tests.</p>

        <p>Mount some filesystems in read only</p>
        <p>Check processes running as root</p>
        <p>Check processes users premissions</p>

        <pre>
        $ sudo prt-get depinst checksec lynis
        </pre>

        <p>Lynis gives a view of system overall configuration, without changing
        default profile it runs irrelevant tests. Create a lynis profile by
        coping default one and run lynis;</p>

        <pre>
        $ sudo cp /etc/lynis/default.prf /etc/lynis/custom.prf
        $ sudo lynis configure settings color=yes
        $ sudo lynis show settings
        $ sudo lynis show profile
        </pre>

        <pre>
        $ lynis audit system > lynis_report
        $ mv /tmp/lynis.log .
        $ mv /tmp/lynis-report.dat .
        </pre>

        <p>Add unnecessary tests to profile to have less noise.</p>

        <a href="index.html">Core OS Index</a>
        <p>This is part of the Hive System Documentation.
        Copyright (C) 2018
        Hive Team.
        See the file <a href="../fdl-1.3-standalone.html">Gnu Free Documentation License</a>
        for copying conditions.</p>

    </body>
</html>