VA791-15-R-0020-002.pdf

DEPARTMENT OF

VETERANS AFFAIRS

O F F I C E O F I N F O R M A T I O N A N D T E C H N O L O G Y

S E R V I C E D E L I V E R Y A N D E N G I N E E R I N G

E N T E R P R I S E S Y S T E M S E N G I N E E R I N G

R e d H a t E n t e r p r i s e L i n u x 7 S e r v e r B a s e l i n e

Ve r s i o n 1

S e p t e m b e r 2 1 , 2 0 1 5

Revision History

Revision # Revision Date Description of Change Author

0.1 09/17/14 Initial Draft Donald Adams

0.2 10/20/14 Minor changes James Owens

0.3 12/1/14 Removed References to DoD Donald Adams

0.4 12/11/14 Edited for clarity Donald Adams

0.5 12/12/14 Technical edits Raven Nuckols

0.6 1/14/15 Edits requested by VA Donald Adams

0.7 1/15/15 Revisions of tech edits Raven Nuckols

0.8 6/5/15 Edits requested by VA Donald Adams

1.0 7/21/2015 Updated by VA John Dellar

Distribution

Recipient Name Recipient Organization Distribution Method

VA Baseline Configuration and Security Standard RHEL 7

Table of Contents

1 Overview

1.1 Conventions

2 Purpose

3 Policy

4 Scope of Authority:

5 Responsibilities

6 Procedures

6.1 RHEL7 Baseline Configuration and Security

Server Availability Options ...................................................................................... 6 6.1.1

6.2 Red Hat Enterprise Satellite Server

6.3 RHEL Required Channel Subscriptions

6.4 RHEL Required Applications Installation

6.5 File system Configuration

Partition/Logical Volume Layout ............................................................................. 8 6.5.1

Restrict Mount Point options .................................................................................. 10 6.5.2

Bind Mount the /var/tmp directory to /tmp ............................................................. 11 6.5.3

Set Sticky Bit on all World-Writable Directories ................................................... 11 6.5.4

6.6 Software Package Updates

6.7 Verify that Red Hat GPG Key is installed

6.8 Ensure gpgcheck Enabled In Main Yum Configuration

6.9 Verify Package Integrity Using RPM

6.10 Verify File Permissions Using RPM

6.11 Advanced Intrusion Detection Environment (AIDE)

Install AIDE ............................................................................................................ 14 6.11.1

Initialize AIDE ........................................................................................................ 14 6.11.2

Implement Periodic Execution of File Integrity Check .......................................... 15 6.11.3

6.12 Disable Unused Services

Disable Interactive startup ...................................................................................... 16 6.12.1

Verify grub.cfg settings .......................................................................................... 17 6.12.2

Shadow Passwords .................................................................................................. 17 6.12.3

Verify that no Non-Root Accounts have a UID of 0 .............................................. 17 6.12.4

Verify settings on /etc/shadow ................................................................................ 17 6.12.5

Verify settings on /etc/gshadow .............................................................................. 17 6.12.6

Verify settings on /etc/group ................................................................................... 18 6.12.7

Verify settings on /etc/passwd ................................................................................ 18 6.12.8

Ensure Password File Integrity ............................................................................... 18 6.12.9

Lock Inactive User Accounts .............................................................................. 18 6.12.10

6.13 Account Management

Mandatory Password Management Practices ......................................................... 19 6.13.1

Service Account Management ................................................................................ 20 6.13.2

Creating Unique Local User Accounts ................................................................... 21 6.13.3

The SUDO command must require authentication ................................................. 23 6.13.4

6.14 RHEL Configuration Channels

VA Baseline RHEL 7.............................................................................................. 24 6.14.1

Modify Default System-wide Profiles .................................................................... 25 6.14.2

Disable X Windows startup at boot time ................................................................ 27 6.14.3

Configuring Secure Sockets Layer (SSH) Server ................................................... 27 6.14.4

Configure /etc/login.defs to meet password default requirements......................... 29 6.14.5

Password Protect Single User Mode ....................................................................... 29 6.14.6

Logging ................................................................................................................... 30 6.14.7

Disable Unused Kernel Drivers .............................................................................. 31 6.14.8

System Time Protocol Service (NTP) ..................................................................... 35 6.14.9

Configuring PAM for user account compliance ................................................. 36 6.14.10

Restrict Root Logins to the System Console ....................................................... 38 6.14.11

Restricting use of the SU commands .................................................................. 39 6.14.12

Ensure Password Hashing Algorithm is SHA-512 ............................................. 39 6.14.13

Implement Inactivity Timeout for Login Shells .................................................. 40 6.14.14

Disable ipv6......................................................................................................... 41 6.14.15

System Resource Management ........................................................................... 41 6.14.16

Enable Randomized Layout of Virtual Address Space ....................................... 43 6.14.17

Configure ExecShield ......................................................................................... 43 6.14.18

Disable Crtl-Alt-Delete Reboot Activation ......................................................... 44 6.14.19

Preventing Network Attacks ............................................................................... 44 6.14.20

Configure System Auditing with Auditd ............................................................ 46 6.14.21

Configure SELINUX........................................................................................... 50 6.14.22

Mail must be forwarded to one or more system administrators .......................... 50 6.14.23

6.15 VA V2S RHEL7

Configure SNMP .................................................................................................... 51 6.15.1

7 References

8 Review Date

9 Follow-Up Responsibility

Appendix A Functional Configuration Baselines

Intel CPU’s

Issue - C-State limits

Dell Systems

Issue - Biosdevname

Virtual Machines

Hypervisor specific client tools

Figures

Tables

Table 1 – Note and Warning Symbols

Table 2 – Typographic Conventions

1 OVERVIEW

1.1 CONVENTIONS

Table 1 – Note and Warning Symbols lists the Note and Warning Symbol conventions used in this guide to alert the reader to special information or conditions. Table 2 – Typographic

Conventions lists the typographic conventions used in the document.

Table 1 – Note and Warning Symbols

Symbol Note Type Description

NOTE: Emphasizes points, remind readers of something, or to indicate minor problems in the outcome of what they are doing.

REFERENCE: Directs the reader to other sources of information.

DISCLAIMER: Generally any statement intended to specify or delimit the scope of rights and obligations that may be exercised and enforced by parties in a legally recognized relationship.

DANGER:

Warns readers about the possibility of serious or fatal injury to themselves or others.

WARNING: Alerts readers about the possibility of minor injury to themselves or others.

CAUTION: Draws special attention to anything that could damage equipment or cause the loss of data.

Table 2 – Typographic Conventions

Font, Style or Symbol

Represents Examples:

Blue text, underlined

External hyperlink to another document or Uniform Resource Locator (URL)

For more information, please refer to the Department of Veterans Affairs website.

Green text, dotted underlined

Hyperlink within this document See Overview for more information.

Arial Text inside tables This is an example of the text normally found within a table.

Courier New (Monospace) with gray framed background

Computer code or computer screen text inetd.conf > inetd.conf.new cp inetd.conf.new inetd.conf rm -f /etc/inetd.conf.new

Courier New, bold Menu options Task Manager → View Task Schedule → Schedule New Task

Screen prompts Copy file? Y/N

Directories, file names, command names, system responses, command line commands

…using cache.cpf configuration file.

http://www.va.gov/

Field Names In the Indicator field, enter the logic that is to be used to determine if the test was positive for the selected MDRO.

Keyboard keys <F1>, <Alt>, <L>, <Tab>, <Enter>

Courier New, bold, red

Code and deployment descriptor samples to indicate lines of particular interest, discussed in the preceding text scd equals the site’s three letter site code, 999 should be replaced by the site’s station number and z corresponds to the number used in the application instance name.

$@SYS$MANAGER:CSTOP scd999A0z

QUIETLY

$@SYS$MANAGER:CSTOP scd999SVR

QUIETLY

→ Choosing a command from a cascading menu

Task Manager → View Task Schedule → Schedule New Task

Times New Roman

Body text There are no changes in the performance of the system once the installation process is complete.

Times New Roman Italic

Text emphasis It is very important…

National and International Standard names

International Statistical Classification of

Diseases and Related Health Problems

Document names Microsoft Manual of Style for Technical

Publications

2 PURPOSE

The purpose of this document is to provide guidance for the base installation, configuration and securing of Red Hat Enterprise Linux 7 (RHEL 7), operating system for implementation onto production servers within the Veterans Affairs (VA) environment.

The objectives of this policy:

To produce a secure and less vulnerable network by ensuring the systems connected to the network are correctly updated and secured.

To standardize the build and images across the Enterprise of all systems running RHEL 7

This document is to be used for the hardening, and as a Baseline Configuration for securing RHEL version 7 servers.

To implement National Institute of Standards and Technology (NIST)

It is not the objective of this policy to address management and reconfiguration actions.

3 POLICY

This policy is the Baseline Configuration Standard for Red Hat Enterprise Linux Servers. It is for the installation and security hardening of Red Hat Enterprise Linux version 7 Operating

System (OS) within the VA.

4 SCOPE OF AUTHORITY:

The content and direction of this policy are in accordance with the VA Handbook 6500, Defense

Information Systems Administration (DISA) RHEL checklists, and NIST Checklists.

5 RESPONSIBILITIES

Material Weakness Guide Design: Enterprise Platform Engineering (EPE).

6 PROCEDURES

The following section will provide manual detailed procedures to be used in conducting a review of the RHEL 7 systems for Security Readiness Review process. These procedures are based on documents provided by NIST and the Red Hat RHEL 7 Security Guide.

6.1 RHEL7 BASELINE CONFIGURATION AND SECURITY

Server Availability Options 6.1.1

Thermal Shutdown – Enabled

Wake On Local Area Network (LAN) – Enabled

Power-on Self-Test (POST) F1 Prompt – Disabled

Power Button – Enabled

Auto Power On – Enabled

Power on Delay – No Delay

Boot Order – Boot from Hard Disk first o CD ROM second o PXE boot third o Other options as may be necessary

Set Basic Input/Output System (BIOS) Password – Ensure password is secure o (only required if server is not located in a secure location)

6.2 RED HAT ENTERPRISE SATELLITE SERVER

All Production Red Hat Linux systems are required to be registered with and receive updates from the National Satellite Server. In order to ensure consistency with Operating Systems deployment, the National Satellite administrators will establish clones of the base Red Hat channels that will have the prefix VA-PREPROD and VA-PROD which will be the only channels visible to the regions...

On the first weekend of each month new and updated packages will be added to the VA-

PREPROD channels, so that all Regions and other entities can complete their own testing and evaluation.

On the first weekend of each quarter new and updated packages from VA-PREPROD will be placed into VA- PROD after being processed through ESSCB and NCCB approval process.

So that regions are able to comply with the timeframes required for applying patches as outlined in the Memorandum, Patch Management and Compliance VA Intranet Quorum (VAIQ)

#7294131) of Nov 16 2012.

a. Critical–patches will be tested and applied within 30 days

b. High–patches will be tested an applied within 60 days.

c. Moderate-patches will be tested an applied within 90 days

d. Low–system administrators will determine patching timeframe.

e. Emergent–patches will be applied ASAP

National Satellite Administrators will test critical and if time allows, high level patches, every week. High and moderate patches will be tested within 30 days of release. All others will be moved to the VA-PREPROD channel within 30 days of release.

Note: Not every patch will be tested due to time constraints

6.3 RHEL REQUIRED CHANNEL SUBSCRIPTIONS

A software channel is a collection of Red Hat Package Manager (RPM) packages. These are the packages that are deployed on systems managed by the National Satellite Server. Software channels define which packages a given system has access to. All Red Hat Linux servers are subscribed to at least the following channels. Other channels may be subscribed to as necessary for a particular application or server function.

prod-rhel-x86_64-server-7 prod-rhn-tools-rhel-x86_64-server-7 prod-bigfix_x64 prod-encase_V2s

Each region will create their own production clones of these national channels

6.4 RHEL REQUIRED APPLICATIONS INSTALLATION

Current approved Visibility to Servers (V2S) suite as approved for Linux Systems. .

BigFix

Encase

Simple Network Management Protocol (SNMP)

McAfee Anti-Virus Software (See Note Below)

McAfee EPO agent (See Note Below)

McAfee Host Intrusion Prevention (HIPS). (See Note Below)

Note: Before installing McAfee Software products, ensure that the systems that they are being installed on have been tested and are compatible

6.5 FILE SYSTEM CONFIGURATION

Directories that are used for system-wide functions can be protected by placing them on separate partitions. This provides protection from resource exhaustion and enables the use of mounting options that are applicable to the directory's intended use. User's data can be stored on separate partitions and have stricter mount options.

The overall strategy is to apply security concepts to OS partitioning in the beginning of system build and installation activities in such a way that mount options can be applied to secure the machine–such as noexec options for /tmp and /home, etc. Red Hat does not recommend putting partitions, directories and files in non-standard locations, since SElinux already has a well-defined concept of where things belong.

Logical Volume Management (LVM) should be used so as to provide increased robustness and flexibility in disk and partition management.

XFS is the default file system for RHEL 7, however the tools and utilities that are used with

EXT4 no longer work with, or work differently on XFS, and there are new tools (XFSPROGS) that are used to work with XFS file systems.

EXT4 file system may be used to retain compatibility with current tools and configurations.

XFS can be used if so desired.

Partition/Logical Volume Layout 6.5.1

The following partitioning scheme is the minimum required as it protects and segments various portions of operating system functionality. Such partitioning provides various benefits, among them being the protection of any one of them becoming full not adversely affecting the others.

/ – The root partition is required; it is the top of the UNIX file system tree structure and must be established as its own partition.

/boot – Required partition; allocated on the first physical drive the BIOS will look to for boot and/or start-up information.

/home – Will be its own distinct partition as a repository for local storage of administrative and user files. The underlying issue is that any place a user can write to must be on a separate partition from /bin, /sbin, and /usr.

/tmp – The /tmp partition is a world-writable directory that provides a safe container for temporary storage and lessens the possibility of resource exhaustion should it become full.

/var – The /var partition is a container for libraries and system services to store frequently changing data and for temporary application files.

/var/log – container for application and security logs.

/var/log/audit – Audit data is stored on its own partition so that auditd will correctly calculate when its partition is out of space.

<swap> – provides additional virtual memory to supplement physical memory. Swap size can be determined by using the settings below:

<2GB RAM 2 times the amount of RAM

>2GB – 8GB RAM Equal to the amount of RAM

>8GB – 64GB RAM 0.5 times the amount of RAM

>64GB RAM 32GB of swap space

Other, additional partitions may be added, and sized, as site/mission/server function requirements dictate. These include /opt, /srv /usr/local and other data partitions.

partition /boot --fstype ext4 --size=512 partition pv.2 --size=1 --grow volgroup vg_root --pesize=32768 pv.2 logvol swap --fstype swap --name=lv_swap --vgname=vg_root --size=16000 logvol / --fstype ext4 --name=lv_root --vgname=vg_root --fsoptions="noatime" --size=12000 logvol /home --fstype ext4 --name=lv_home --vgname=vg_root --fsoptions="noatime,nodev"

--size=4096 logvol /var --fstype ext4 --name=lv_var --vgname=vg_root --fsoptions="noatime,nodev" -

-size=8000 logvol /var/log --fstype ext4 --name=lv_logs --vgname=vg_root --fsoptions="noatime,nodev" --size=4096 logvol /var/log/audit --fstype ext4 --name=lv_audit --vgname=vg_root --fsoptions="noatime,nodev" --size=2000 logvol /tmp --fstype ext4 --name=lv_tmp --vgname=vg_root --fsoptions="noatime,nodev,nosuid" --size=4096 logvol /srv --fstype ext4 --name=lv_srv --vgname=vg_root --size=1 --grow --percent=25

--fsoptions="noatime,nodev" 2

Example partitioning scheme

/dev/mapper/vg_root-lv_root / ext4 defaults,noatime 1 2

/dev/mapper/vg_root-lv_var /var ext4 defaults,noatime,nodev 1 2

/dev/mapper/vg_root-lv_tmp /tmp ext4 defaults,noatime,nodev,nosuid,noexec 1 2

/dev/mapper/vg_root-lv_logs /var/log ext4 defaults,noatime,nodev 1 2

/dev/mapper/vg_root-lv_audit /var/log/audit ext4 defaults,noatime,nodev 1 2

/dev/mapper/vg_root-lv_home /home ext4 defaults,noatime,nodev 1 2

/dev/mapper/datavg1-u01 /u01 ext4 defaults,noatime,nodev 1 2

/dev/mapper/vg_root-swap swap swap defaults 0 0

Example /etc/fstab

Note: The noatime setting is not a security setting, but is a performance booster that prevents the file system recording each time a file is read, but does not stop the time that a file is modified from being recorded.

Restrict Mount Point options 6.5.2

System partitions can be mounted with various options which limit what files on those partitions can do. These options are set in the file /etc/fstab, and can be used to make certain types of malicious behavior more difficult.

These settings can be set at installation time as part of the partitioning scheme by using the – fsoptions parameter

6.5.2.1 Set nodev option to Non-Root Local Partitions

The nodev option prevents users from mounting unauthorized devices on any partition or logical volume which is known not to contain any authorized devices. These include:

/var

/var/log/

/var/log/audit

/home

/tmp/

/dev/shm

The root partition typically contains the /dev partition, which is the primary location for authorized devices, so this option should not be set on the root / partition .

6.5.2.2 nosuid option

The nosuid mount option specifies that the file system does not allow the setuid or setguid bits to take effect.

/tmp

/dev/shm

6.5.2.3 Set noexec option

The noexec mount option specifies that although the file system may contain executable scripts and binaries, the OS is not allowed direct execution of those files.

/tmp

/dev/shm

During the installation of some applications, the install will fail as the installer tries to extract and execute temporary scripts to /tmp. To temporarily disable the noexec option run the follow commands mount -o remount,exec /tmp

#Once the application has been installed, re-enalbe the default mount options specified in fstab with:

mount -o remount /tmp

Bind Mount the /var/tmp directory to /tmp 6.5.3

The /var/tmp directory is normally a standard subdirectory in the /var directory. Binding

/var/tmp to /tmp establishes an unbreakable link that cannot be removed (even by the root user).

It also allows /var/tmp to inherit the same mount options that /tmp owns, allowing /var/tmp to be protected in the same way that /tmp is protected. It will also prevent /var from filling up with temporary files as the contents of /var/tmp will actually reside in the file system containing /tmp.

This will also prevent a user from running the /var file system out of space or trying to perform operations that have been blocked in the /tmp file system.

Edit the /etc/fstab file to and add or modify the following line:

/tmp /var/tmp none bind 0 0

Set Sticky Bit on all World-Writable Directories 6.5.4

Setting the sticky bit on world writable directories prevents users from deleting or renaming files in that directory that are not owned by them.

To find and remediate incorrectly set directories, run the following command:

df --local -P | awk {'if (NR!=1) print $6'} \

| xargs -I '{}' find '{}' -xdev -type d \

\( -perm -0002 -a ! -perm -1000 \) 2>/dev/null\

| xargs chmod a+t

To find directories that do not have the sticky bit set, run the following command:

df --local -P | awk {'if (NR!=1) print $6'} \

| xargs -I '{}' find '{}' -xdev -type d \

\( -perm -0002 -a ! -perm -1000 \) 2>/dev/null

6.6 SOFTWARE PACKAGE UPDATES

Operating systems and application software need to routinely have patches and updates applied on a regular basis. Updates should be applied as often as possible, with a maximum time between updates of 90 days.

All Production Red Hat Linux systems are to be registered and updates applied from the national

Red Hat Satellite. Each region has a Satellite Proxy Server that is used to reduce the network load from the National Satellite. The system administrator will be responsible for installing all patches and package updates.

6.7 VERIFY THAT RED HAT GPG KEY IS INSTALLED

Red Hat cryptographically signs updates with a GNU Privacy Guard (GPG) key to verify that they are valid.

It is important to ensure that updates are obtained from a valid source to protect against spoofing that could lead to the inadvertent installation of malware on the system.

The following command can be used to print the installed release key’s fingerprint, which is actually contained in the file referenced below:

# gpg --quiet --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release pub 4096R/FD431D51 2009-10-22 Red Hat, Inc. (release key 2) <security@redhat.com>

Key fingerprint = 567E 347A D004 4ADE 55BA 8A5F 199E 2F91 FD43 1D51 pub 1024D/2FA658E0 2006-12-01 Red Hat, Inc. (auxiliary key) <security@redhat.com>

Key fingerprint = 43A6 E49C 4A38 F4BE 9ABF 2A53 4568 9C88 2FA6 58E

Run the following command to ensure that the system has the Red Hat GPG key properly installed:

# rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey gpg(Red Hat, Inc. (release key 2) <security@redhat.com>) gpg(Red Hat, Inc. (auxiliary key) <security@redhat.com>)

6.8 ENSURE GPGCHECK ENABLED IN MAIN YUM CONFIGURATION

The gpgcheck option should be used to ensure checking of an RPM package's signature always occurs prior to its installation. To configure yum to check package signatures before installing them, ensure the following line appears in /etc/yum.conf in the [main] section. This is the default in Red Hat 7.

grep gpgcheck /etc/yum.conf gpgcheck=1

6.9 VERIFY PACKAGE INTEGRITY USING RPM

RPM has the capability of verifying installed packages by comparing the installed files against the file information stored in the package. Verifying packages gives a system administrator the ability to detect if package files were changed, which could indicate that a valid binary was overwritten with a trojaned binary.

Perform the following to verify integrity of installed packages rpm -Va | awk '$2 != "c" { print $0}'

If any output shows up, you may have an integrity issue with that package that must be rectified.

6.10 VERIFY FILE PERMISSIONS USING RPM

The RPM package management system can check file access permissions of installed software packages, including many that are important to system security. The following command will list which only those files on the system have verification failure due to setting that are different than what are expected by the RPM database:

# rpm -Va | grep '^.M'

Where:

S is the file size.

M is the file's mode.

5 is the MD5 checksum of the file.

D is the file's major and minor numbers.

L is the file's symbolic link contents.

U is owner of the file.

G is the file's group.

T is the modification time of the file.

c appears only if the file is a configuration file. This is handy for quickly identifying config files, as they are very likely to change, and therefore, very unlikely to verify successfully.

file is the file that failed verification. The complete path is listed to make it easy to find.

Permissions on system binaries and configuration files that are too generous could allow an unauthorized user to gain privileges that they should not have. The permissions set by the vendor should be maintained. Any deviations from this baseline should be investigated

6.11 ADVANCED INTRUSION DETECTION ENVIRONMENT (AIDE)

AIDE is a file integrity checking tool, similar in nature to Tripwire. While it cannot prevent intrusions, it can detect unauthorized changes to configuration files by alerting when the files are changed. When setting up AIDE, decide internally what the site policy will be concerning integrity checking. Review the AIDE quick start guide and AIDE documentation before proceeding.

Install AIDE 6.11.1

Install AIDE to make use of the file integrity features to monitor critical files for changes that could affect the security of the system. The AIDE package must be installed during the initial kick start of the system.

Perform the following command to verify that AIDE is installed

# rpm –q aide aide-<version>.el7.x86_64

Initialize AIDE 6.11.2

To initialize AIDE, run the following command

/usr/sbin/aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'

Implement Periodic Execution of File Integrity Check 6.11.3

Associated Baseline Configuration Files

/etc/cron.d/aide-check

/etc/sysconfig/prelink

Periodic file checking allows the system administrator to determine on a regular basis if critical files have been changed in an unauthorized fashion.

Verify that the default figuration file, /etc/cron.d/aide-check, contains the following lines:

#/etc/cron.d/aide-check

# modified by:<user name>

0 5 * * * /usr/sbin/aide –check

6.11.3.1 Disable prelinking

The prelinking feature changes binaries in an attempt to decrease their startup time. The prelinking feature can interfere with Advanced Intrusion Detection Environment (AIDE) because of the fact that it, prelinking, alters binaries. In order to disable it, change the following line inside the file /etc/sysconfig/prelink

PRELINKING=no

Next, run the following command to return binaries to a normal, non-prelinked state:

/usr/sbin/prelink -ua

6.12 DISABLE UNUSED SERVICES

Disabling unnecessary services within Red Hat Enterprise Linux greatly reduces the risk of security vulnerabilities.

Disable the following services

If any of these services are required for a particular application or purpose, then it must be documented aep1000 amd apmd arptables_jf atd autofs bcm5820 bgpd canna chargen daytime dc_client dc_server dhcpd dhcrelay finger FreeWnn gmp gpm hpoj identd innd irda irqbalance isdn kadmin kprop krb524 krb5kdc kudzu lisa mdmonitor microcode_ctl mysqld named netdump netdump-server netfs nfs nfsloc nfslock ospf6d ospfd pcmcia portmap postgresql psacct pxe qotd radiusd radvd rarpd ripd ripngd rlogin rsh rstatd rusersd rwhod sendmail smartd smb snmptrapd spamassassin squid telnet tux vncserver vsftpd winbind yum-updatesd yppasswdd ypppasswd ypserv ypxfrd zebra

The script below will disable unnecessary services. For any service that are not enabled there will be and error “Failed to issue method call: Access denied “, which is to be expected:

for i in echo daytime finger chargen qotd atd gmp kudzu netfs nfsloc portmap identd netdump netdump-server rwhod sendmail rlogin smb ypppasswd ypserv ypxfrd rsh telnet apmd gpm autofs isdn nfs nfslock winbind irda mysqld postgresql microcode_ctl mdmonitor psacct pcmcia irqbalance smartd snmptrapd vncserver hpoj spamassassin lisa canna amd dc_client dc_server aep1000 bcm5820 squid dhcrelay rstatd rusersd FreeWnn named vsftpd pxe rarpd kadmin kprop krb524 krb5kdc dhcpd radiusd yppasswdd bgpd ospf6d ospfd ripd ripngd zebra radvd arptables_jf innd tux yum-updatesd do systemctl disable $i done

Additionally, delete all unnecessary xinetd services from the /etc/xinetd.d directory.

This includes services such as:

telnet, ftp, time, gss* krb* ekl* klog* chargen* kshell* daytime* echo* time* cups* sgi* ktalk

Amanda rexec rlogin dbs* aman* amidxtape tftp imap* pop

Disable Interactive startup 6.12.1

To prevent users from starting up the system interactively, as root, disable the PROMPT parameter in the /etc/sysconfig/init file:

# PROMPT=no

Verify grub.cfg settings 6.12.2

The file /etc/boot/grub2/grub.cfg should be owned by the root user and group and permissions set to 600 to prevent destruction or modification of the file. This is the default setting, but to ensure that these settings are correct run the commands:

# stat -L -c "%u %g" /boot/grub2/grub.cfg | egrep "0 0”

0 0

Set permission on the /boot/grub2/grub.cfg file to read and write for root only

# chmod og-rwx /boot/grub2/grub.cfg

Shadow Passwords 6.12.3

Implement the use of shadow passwords. This is installed by default on Red Hat Linux

Verify that no Non-Root Accounts have a UID of 0 6.12.4

Only the root user account should have a UID of 0. If any other accounts have a UID of 0, ensure that these additional UID-0 accounts are authorized, and that there is a good reason for them to exist.

The following command will print all password file entries for accounts with UID 0:

# awk -F: '($3 == "0") {print}' /etc/passwd

Verify settings on /etc/shadow 6.12.5

To properly set the owner, group and settings of /etc/shadow:

# chown root /etc/shadow

# chgrp root /etc/shadow

# chmod 0000 /etc/shadow

Verify settings on /etc/gshadow 6.12.6

# chown root /etc/gshadow

# chgrp root /etc/gshadow

# chmod 0000 /etc/gshadow

Verify settings on /etc/group 6.12.7

# chown root /etc/group

# chgrp root /etc/group

# chmod 0000 /etc/group

Verify settings on /etc/passwd 6.12.8

To properly set the owner, group and settings of /etc/shadow:

# chown root /etc/passwd

# chgrp root /etc/passwd

# chmod 0000 /etc/passwd

Ensure Password File Integrity 6.12.9

Ensure there are no mistakes in the /etc/passwd or /etc/groups files:

Verify that there are no accounts with blank passwords.

Run the following commands to ensure there are no mistakes in the /etc/passwd or /etc/groups files:

# /usr/sbin/pwck

# /usr/sbin/grpck

To verify that there are no accounts with blank passwords run the following command:

awk -F: '($2 == “” ) { print $1 }' /etc/shadow

Lock Inactive User Accounts 6.12.10

VA guidelines specify that unused user accounts must be locked after 90 days of inactivity.

Use the passwd command to lock an inactive user account.

To identify user accounts that are over 90 days since they were last logged into, use the command below:

lastlog –b 90

For user accounts that have the entry **Never logged in** for the last login time, use the command below to determine when the account was created and if it is over 90 days old, it must be disabled:

passwd –S <username>

Note: It is expected that system accounts and service accounts will have the entry **Never

Logged in** for the last login time

6.13 ACCOUNT MANAGEMENT

Individual user accountability precludes the use of shared accounts (i.e., accounts where multiple users are allowed to log on directly to the same account). Applications may require that a specific account (e.g., oracle) be used for certain administrative tasks. The user is required to log on with that user’s account name and sudo to the application account. That action retains the individual accountability (through audit files). If there is an application account (e.g., oracle) that requires the account to be shared, this will be justified and documented.

Mandatory Password Management Practices 6.13.1

The following specify the mandatory password management practices of all VA Information systems enterprise wide.

6.13.1.1 Password must not include any of the following:

Vendor/manufacturer default passwords

Names (i.e. systems user names, part or entire account name of user, family names)

Words found in the dictionary (i.e. words from any dictionary; spelled forward or backwards)

Addresses

Birthdays

Social Security Numbers

Common character sequences (i.e. 3456, ghijk, 2468)

Vendor supplied default passwords (i.e. SYSTEM, Password, Default, USER, Demo and

TEST)

6.13.1.2 Passwords must :

Have at least eight characters

Administrator accounts shall use a password with a minimum of 12 characters contain characters from three of the following categories o English upper case characters (A-Z) o English lower case characters (a-z) o Base 10 digits (0-9) o Non-alphanumeric, special characters (i.e. !@#$%^&*)

Six of the characters must not occur more than once in the password

6.13.1.3 Passwords must:

Be changed at least every 90 days

Be changed immediately, if believed to be compromised or one suspects a password has been compromised, or if discovered to be in non-compliance with this standard

Be changed on direction from management

Expire after 90 days of inactivity (System administrator accounts would be exempt from expiring due to inactivity)

Have minimum of 2 days between password changes

Users will receive warnings beginning 14 days before their password expires

Do not reuse a password you have used during the past 5 password changes, or as recent as two years from when the password was last used in order to preclude password guessing

An intruder lock out feature shall suspend the account after 5 invalid attempts to log on to the system

Where round-the-lock system administration service is available, system administrator intervention shall be required to clear a locked account

Where round-the-clock system administration is not available, accounts shall remain locked out for at least fifteen (15) minutes

Service Account Management 6.13.2

The follow applies to all Linux service accounts.

Service accounts shall use a password with a minimum of 12 characters in length

A password randomizing tool shall not be used where Denial of Service (DoS) risks exist

Password shall be changed every 3 years (at Certification and Accreditation (C and A), Security Control Assessment ( SCA) test time)

The mkpasswd utility (available from the expect package) can be used to generate and apply password to service accounts.

The following command generates a random 12 character password with at least one digit, one lower case character, one upper case character and one special character and assigns it to the user. Sending output to /dev/null prevents the result from echoing back to the screen

Use the script below to disable service accounts, ensure they have no login shell and that the password aging requirement is set

#Lock and Set strong password on service accounts

#The expect package must be installed servaccts=$( awk -F: '($3 >0 && $3< 500) { print $1 }' /etc/passwd ) for acct in $servaccts do mkpasswd -l 12 -d 1 -c 1 -C 1 -s 1 $acct >/dev/null

/usr/sbin/usermod -L -s /sbin/nologin $acct passwd -x 1095 -n 2 -w 14 -i 30 $acct done

Creating Unique Local User Accounts 6.13.3

VA directives require unique identification for each system user. Authorized users should be granted access only to the resources needed to accomplish their mission. A user is either an individual or an executing process/task that accesses a computer resource. Each user will be identified with an account name and a corresponding user identification (UID) number. The uid's and group identification (gid) numbers are assigned according to the following scheme

Although Linux systems automatically generate unique user ID’s (UID) and group ID’s (GID) for each user when the account is created on the individual system, it is preferable to ensure that the UID and GID are the same on all systems. The following steps can be used to accomplish this.

The script below is used to create a unique uid based on the user’s active directory name. Before creating the user account add a 1 and another digit according to the following legend.

0 = National Accounts

1 = Region 1

2 = Region 2

3 = Region 3

4 = Region 4

5 = Region 5

6= Region 6

Create user accounts that are the same as the users Active Directory account and if they have a 0 account, use that.

In this case below, the ID for a national account would be 109491, for region 6 it would be

169491.

Create a unique 4-digit ID for the user. Substitute the real username for the VHATESTERJ0 name in the following script. Note: that all capital letters are converted to lowercase.

name="VHATESTERJ0"; myname=$(echo "${name}" | awk -F^ '{ print tolower($1) }') num=$((echo -n $myname) | md5sum | cut -d' ' -f1 | tr -d 'a-f' | cut -c1-4); echo

$myname":"$num

>>output = vhatesterj0:9491

Create an encrypted password for the account.

This will create an md5 encrypted password, but once the user changes their password at first logon, it will be sha512 encrypted.

openssl passwd -1

Password: <Enter password here>

Verifying - Password:<Re-enter password>

$1$amfJDQQB$8BxcE2OoBs5pZ2Jo/kZnI/ <<encrypted password Purple#2012>>

Create unique group for the user

/usr/sbin/groupadd -g 119491 vhatesterj0

Create the user and add them to their own group, a previously created r01linuxadmins group and the built-in wheel group. The last thing is to force the password to expire so that the user must change it the first time they log in.

Note: The comment field (-c) can be anything, but it is recommended to use the email address of the user to make to it clear who that user is.

/usr/sbin/useradd -u 119491 \

-c ‘john.tester@va.gov’ \

-d /home/vhatesterj0 \

-m \

-g vhatesterj0 \

-G r01linuxadmins,wheel \

-p '$1$amfJDQQB$8BxcE2OoBs5pZ2Jo/kZnI/' \

-s /bin/bash \ vhatesterj0

#Force the password to expire chage -d 0 vhatesterj0

The SUDO command must require authentication 6.13.4

/etc/sudoers

The "sudo" command allows authorized users to run programs (including shells) as other users, system users, and root. Some configuration options in the "/etc/sudoers" file allow configured users to run programs without re-authenticating. Use of these configuration options makes it easier for one compromised account to be used to compromise other accounts

Edit the /etc/sudoers file and verify that the following lines are set correctly

****** Comment ‘#’ removed from this line

%wheel ALL=(ALL) ALL

***** Comment ‘#” does exist in front of this line

# %wheel ALL=(ALL) NOPASSWD: ALL

6.14 RHEL CONFIGURATION CHANNELS

A configuration channel is a collection of files that are deployed to the systems at installation time, and can also be redeployed as necessary to keep systems up to date and are deployed by the

National Satellite Server. These configuration channels are used to configure the settings that are set forth as requirements in this guide. All Red Hat Linux systems are subscribed to at least the following configurations channels. Each region will replace the VA or va text, with the appropriate region:

VA baseline RHEL7 (va-baseline-rhel7)

/etc/at.allow

/etc/bashrc

/etc/cron.allow

/etc/cron.d/aide-check

/etc/cron.daily/rdp_update

/etc/csh.login

/etc/inittab

/etc/issue (symlink to /etc/issue.net)

/etc/issue.net

/etc/login.defs

/etc/logrotate.conf

/etc/logrotate.d/syslog

/etc/ntp.conf

/etc/ntp/step-tickers

/etc/pam.d/su

/etc/pam.d/system-auth (symlink to /etc/pam.d/system-auth-va)

/etc/pam.d/system-auth-va

/etc/profile.d/tmout.csh

/etc/profile.d/tmout.sh

/etc/securetty

/etc/sysconfig/init

/etc/modprobe.d/crisp.conf

/etc/sysconfig/prelink

/etc/sysctl.conf

/etc/sysctl.d/

/etc/security/limits.d/50-crisp.conf

/etc/selinux/config

/etc/ssh/sshd_config

VA V2S (va-v2s)

/etc/opt/BESClient/actionsite.afxm

/etc/snmp/snmpd.conf

/root/EPO_4.X/RX_install.sh where X is the current version

/root/RX_install.sh

/root/v2s_kick.sh

VA Baseline RHEL 7 6.14.1

6.14.1.1 Cron and Crontab

Associated Baseline Configuration Files

/etc/at.allow

/etc/cron.allow

6.14.1.2 Enable cron Service

The cron service is used to execute commands at preconfigured times. It is required by almost all systems to perform necessary maintenance tasks, such as notifying root of system activity. The crond service can be enabled with the following command:

systemctl enable crond

It is required to use files in /etc/cron.d, /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly for scheduling system jobs rather than root’s crontab unless there is a compelling reason not to do so and will require a Risk Based Decision

(RBD).

6.14.1.3 Deny User Access to CRONTAB

The /etc/at.allow and /etc/cron.allow files contain lists of users who are allowed to use cron and at to delay execution of processes. If these files exist and if the corresponding files

/etc/cron.deny and /etc/at.deny do not exist, then only users listed in the relevant allow files can run the crontab and at commands to submit jobs to be run at scheduled intervals.

On most systems, only the system administrator needs the ability to schedule jobs. Note: even if a given user is not listed in cron.allow, cron jobs can still be run as that user. The cron.allow file controls only administrative access to the crontab command for scheduling and modifying cron jobs..

Edit /etc/cron.allow, adding one line for each user allowed to use the crontab command to create cron jobs.

Edit /etc/at.allow, adding one line for each user allowed to use the “at” command to create jobs.

Remove the /etc/cron.deny file

Remove the /etc/at.deny file.

Modify Default System-wide Profiles 6.14.2

/etc/bashrc

/etc/csh.cshrc

/etc/profile

/etc/login.defs

/etc/csh.login

The umask setting controls the default permissions for the creation of new files. With a default umask setting of 077, files and directories created by users will not be readable by any other user on the system. Users who wish to make specific files group- or world-readable can accomplish this by using the chmod command.

Additionally, users can make all their files readable to their group by default by setting a umask of 027 in their shell configuration files.

6.14.2.1 Ensure Default Umask settings

To ensure the default umask for users of the Bash shell is set properly to 077 in /etc/bashrc, use the following script:

#!/bin/bash user_umask="077" grep -q umask /etc/bashrc && \ sed -i "s/umask.*/umask $user_umask/g" /etc/bashrc if ! [ $? -eq 0 ]; then echo "umask $user_umask" >> /etc/bashrc fi

To ensure the default umask for users of the C shell is set properly to 077 in /etc/csh.cshrc use the following script:

#!/bin/bash user_umask="077" grep -q umask /etc/csh.cshrc && \ sed -i "s/umask.*/umask $user_umask/g" /etc/csh.cshrc if ! [ $? -eq 0 ]; then echo "umask $user_umask" >> /etc/csh.cshrc fi

To ensure the default umask is set properly, add or correct the umask setting in /etc/profile to read as follows:

umask 077

To ensure the default umask controlled by /etc/login.defs is set properly, add or correct the

UMASK setting in /etc/login.defs to read as follows:

UMASK 077

To ensure the default umask controlled by /etc/csh.login is set properly, add or correct the

UMASK setting in /etc/csh.login to read as follows:

umash 077

Disable X Windows startup at boot time 6.14.3

The X Windows system provides a Graphical User Interface (GUI) where users can have multiple windows in which to run programs and various add on. To prevent automatic startup of

X windows, run the following command:

systemctl set-default multi-user.target

Configuring Secure Sockets Layer (SSH) Server 6.14.4

/etc/ssh/sshd_config

/etc/issue.net

/etc/issue

SSH provides confidentiality and integrity for data exchanged between two systems, as well as server authentication, through the use of public key cryptography. The implementation included with the system is called OpenSSH.

6.14.4.1 Allow Only SSH Protocol 2

Only SSH protocol version 2, or higher connections are permitted as protocol version 1 suffers from design flaws that result in security vulnerabilities. The default setting in

/etc/ssh/sshd_config is correct, and can be verified by ensuring that the following line appears:

Protocol 2

6.14.4.2 Disable SSH Access via Empty Passwords

To explicitly disallow remote login from accounts with empty passwords, verify that the default configuration file /etc/ssh/sshd_config contains the following entry:

PermitEmptyPasswords no

Any accounts with empty passwords should be disabled immediately and PAM configuration should prevent users from being able to assign themselves empty passwords.

6.14.4.3 Do not permit root login via ssh

The root user should never be allowed to login to a system directly over a network. To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config:

PermitRootLogin no

6.14.4.4 Do Not Allow SSH Environment Options

To ensure users are not able to present environment options to the SSH daemon, add or correct the following line in /etc/ssh/sshd_config:

PermitUserEnvironment no

6.14.4.5 Configure SSH Warning Banner

Verify that the default configuration file /etc/issue.net , to contains the following text.

Security Warning!

This U.S. government system is intended to be used by authorized VA network users for viewing and retrieving information only except as otherwise explicitly authorized. VA information resides on and transmits through computer systems and networks funded by the VA. All use is considered to be with an understanding and acceptance that there is no reasonable expectation of privacy for any data or transmissions on Government Intranet or

Extranet (non-public) networks or systems., All transactions that occur on this system and all data transmitted through this system are subject to review and action including (but not limited to) monitoring-recording- retrieving- coping- auditing- inspecting- investigating- restricting access- blocking- tracking- disclosing to authorized personnel or any other authorized actions by all authorized VA and law enforcement personnel., All use of this system constitutes understanding and unconditional acceptance of these terms., Unauthorized attempts or acts to either (1) access- upload- change- or delete information on this system(2) modify this system (3) deny access to this system or (4) accrue resources for unauthorized use on this system are strictly prohibited., Such attempts or acts are subject to action that may result in criminal civil or administrative penalties

Add a symlink from /etc/issue.net to /etc/issue

Next, verify that the default configuration file /etc/ssh/sshd_config contains the following text.

Banner /etc/issue.net

6.14.4.6 Use Only Approved Ciphers

Limiting the ciphers to those algorithms which are FIPS-approved, Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.

The “built-in” default Ciphers are:

aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour

The arcfour and blowfish ciphers are not fips certified. Verify that the default configuration file

/etc/ssh/sshd_config contains the entry as below and if not, it must be added.

#Use only fips certified ciphers

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

#Disable MD5 MACs (Message Authentication Code) Algorithms

MACs hmac-sha1,hmac-ripemd160

Configure /etc/login.defs to meet password default requirements 6.14.5

Verify that the baseline configuration /etc/login.defs file has the following entries:.

PASS_MAX_DAYS 90

PASS_MIN_DAYS 2

PASS_MIN_LEN 12

PASS_WARN_AGE 14

FAIL_DELAY 15

Password Protect Single User Mode 6.14.6

/etc/sysconfig/init

Single-user mode is intended as a system recovery method, providing a single user root access to the system by providing a boot option at startup. By default, no authentication is performed if single-user mode is selected.

To require entry of the root password even if the system is started in single-user mode, add or correct the following line in the file /etc/sysconfig/init:

SINGLE=/sbin/sulogin

Logging 6.14.7

/etc/rsyslog.conf

/etc/logrotate.d/rsyslog

The rsyslog software is a replacement for the default syslogd daemon and provides the option to log to database formats, and the encryption of log data to a central logging server. rsyslog is installed by default on RHEL 7.

6.14.7.1 Configuring logging rules

The /etc/rsyslog.conf file specifies rules for logging and which files are to be used to log certain classes of messages.

Review the contents of the /etc/rsyslog.conf file to ensure appropriate logging is set.

Custom logging configuration files should be created in the /etc/rsyslog.d directory.

6.14.7.2 Log Rotation

Red Hat comes with a logrotate program built-in. The log files should be rotated at least monthly. However the frequency of the rotation of those, and other log files, will vary depending upon the logs being kept and the rotation will need to comply…