about summary refs log blame commit diff stats
path: root/core/hardening.html
blob: 60fea580c440b882b2394e96ca5855a83d5bb3f2 (plain) (tree)
1
2
3
4
5
6
7
8
9



                              
                                     


           
                                              
 
                               
 







                                                                    

             
                                             

              


                                                                               















                                                                   
                                              

                                                         





                                                                                            
<!DOCTYPE html>
<html dir="ltr" lang="en">
    <head>
        <meta charset='utf-8'>
        <title>2.2. Hardening</title>
    </head>
    <body>

        <a href="index.html">Core OS Index</a>

        <h1>2.2. Hardening</h1>

        <p>Check <a href="apparmor.html">apparmor</a>,
        <a href="sysctl.html">sysctl</a>, 
        <a href="toolchain.html">toolchain</a> and
        <a href="samhain.html">samhain</a> before running tests.</p>

        <p>Mount some filesystems in read only</p>
        <p>Check processes running as root</p>
        <p>Check processes users premissions</p>

        <pre>
        $ sudo prt-get depinst checksec lynis
        </pre>

        <p>Lynis gives a view of system overall configuration, without changing
        default profile it runs irrelevant tests. Create a lynis profile by
        coping default one and run lynis;</p>

        <pre>
        $ sudo cp /etc/lynis/default.prf /etc/lynis/custom.prf
        $ sudo lynis configure settings color=yes
        $ sudo lynis show settings
        $ sudo lynis show profile
        </pre>

        <pre>
        $ lynis audit system > lynis_report
        $ mv /tmp/lynis.log .
        $ mv /tmp/lynis-report.dat .
        </pre>

        <p>Add unnecessary tests to profile to have less noise.</p>

        <a href="index.html">Core OS Index</a>
        <p>This is part of the Hive System Documentation.
        Copyright (C) 2018
        c9 team.
        See the file <a href="../fdl-1.3-standalone.html">Gnu Free Documentation License</a>
        for copying conditions.</p>

    </body>
</html>