Red Hat Enterprise Linux 5 安全配置指南

需积分: 9 73 浏览量更新于2024-07-28 收藏 1.09MB PDF 举报

"《Red Hat Enterprise Linux 5 安全配置指南》修订版4.1，发布于2011年2月28日，由美国国家安全局的系统与网络分析中心的Unix团队编写。该指南提供了针对RHEL5的安全配置建议，但需在非生产环境中先行测试，并且考虑本地操作和政策需求。请注意，这些配置仅适用于RHEL5，可能不适用于其他操作系统。" 本文档的核心是指导用户如何对Red Hat Enterprise Linux 5 (RHEL5)进行安全配置，以增强系统的安全性。它包含了推荐的安全设置，但并不作为严格的政策替代品，而是作为辅助工具，需要结合合理的判断和具体的环境策略。在实施这些推荐设置时，务必谨慎，确保它们与本地的操作和政策要求相一致。指南的警告部分强调了以下几点： 1. 在生产环境中实施之前，所有建议应在非生产环境中进行充分测试，以避免可能对业务造成的影响。 2. 这份文档是建议性的，不代替经过深思熟虑的政策或专业判断。每个组织都有其特定的安全配置需求，因此在应用指南时需要根据自身情况进行调整。 3. 提供的安全措施特指RHEL5，尝试将其应用于其他操作系统可能会遇到兼容性问题，可能无法直接迁移。 4. 文档中引用的互联网地址截至2009年12月1日有效，后续可能需要更新以获取最新的信息。修订版4.1相对于修订版4（2010年9月14日）进行了更新，但未提供具体的更改内容列表。通常，这样的更新可能包括修复错误、添加新的安全建议或更新已过时的信息。在实际操作中，使用此指南的步骤可能包括： 1. 了解RHEL5的基础架构和安全特性。 2. 阅读并理解文档中的每一条建议，评估其对系统性能和安全的影响。 3. 在测试环境中应用建议，观察系统行为和可能的副作用。 4. 根据测试结果调整配置，确保安全性和可用性的平衡。 5. 制定详细的实施计划，包括备份、监控和应急措施。 6. 在生产环境中逐步部署，持续监控系统的运行状况。通过遵循这个指南，组织可以提高其RHEL5系统的安全性，防止未经授权的访问，保护数据和应用程序免受恶意攻击。然而，安全是一个持续的过程，需要定期审查和更新策略，以应对不断演变的威胁。

16 CHAPTER 1. INTRODUCTION

2. System-wide Conﬁguration

2.1 Installing and Maintaining Software

The following sections contain information on security-relevant choices during the initial operating system instal-

lation process and the setup of software updates.

2.1.1 Initial Installation Recommendations

The recommendations here apply to a clean installation of the system, where any previous installations are wiped

out. The sections presented here are in the same order that the installer presents, but only installation choices

with security implications are covered. Many of the conﬁguration choices presented here can also be applied after

the system is installed. The choices can also b e automatically applied via Kickstart ﬁles, as covered in [8].

2.1.1.1 Disk Partitioning

Some system directories should be placed on their own partitions (or logical volumes). T his allows for better

separation and protection of data.

The installer’s default partitioning scheme creates separate partitions (or logical volumes) for /, /boot, and

swap.



If starting with any of the default layouts, check the box to “Review and mo dify partitioning.” This

allows for the easy creation of additional logical volumes inside the volume group already create d,

though it may require making /’s logical volume smaller to create space. In general, using logical

volumes is preferable to using partitions because they can be more easily adjusted later.



If creating a custom layout, create the partitions mentioned in the previous paragraph (which the

installer will require anyway), as well as separate ones described in the following sections.

If a system has already been installed, and the default partitioning scheme was used, it is possible but nontrivial

to modify it to create separate logical volumes for the directories listed above. The Logical Volume Manager

(LVM) makes this possible. See the LVM HOWTO at http://tldp.org/HOWTO/LVM-HOWTO/ for more detailed

information on LVM.

2.1.1.1.1 Create Separate Partition or Logical Volume for /tmp

The /tmp directory is a world-writable directory used for temporary ﬁle storage. Ensure that it has its own

partition or logical volume.

CCE 14161-4

Because software may need to use /tmp to temp orarily store large ﬁles , ensure that it is of adequate size. For a

modern, general-purpose system, 10GB should be adequate. Smaller or larger size s could be used, depending on

the availability of space on the drive and the system’s operating requirements.

18 CHAPTER 2. SYSTEM-WIDE CONFIGURATION

2.1.1.1.2 Create Separate Partition or Logical Volume for /var

The /var directory is used by daemons and other system services to store frequently-changing data. It is not

uncommon for the /var directory to contain world-writable directories, installed by other software packages.

Ensure that /var has its own partition or logical volume.

CCE 14777-7

Because the yum package manager and other software uses /var to temporarily store large ﬁles, ensure that it is

of adequate size. For a modern, general-purpose system, 10GB should be adequate.

2.1.1.1.3 Create Separate Partition or Logical Volume for /var/log

System logs are stored in the /var/log directory. Ensure that it has its own partition or logical volume.

Make certain that it is large enough to store all the logs that will be written there.

CCE 14011-1

See Section 2.6 for more information about logging and auditing.

2.1.1.1.4 Create Separate Partition or Logical Volume for /var/log/audit

Audit logs are stored in the /var/log/audit directory. Ensure that it has its own partition or logical volume.

Make absolutely certain that it is large enough to store all audit logs that will be created by the auditing

daemon.

CCE 14171-3

See 2.6.2.2 for discussion on deciding on an appropriate size for the volume.

2.1.1.1.5 Create Separate Partition or Logical Volume for /home if Using Local Home

Directories

If user home directories will be stored locally, create a separate partition for /home. If /home will be mounted

from another system such as an NFS server, then creating a separate partition is not necessary at this time,

and the mountpoint can instead be conﬁgured later.

CCE 14559-9

2.1.1.2 Boot Loader Conﬁguration

Check the box to “Use a boot loader password” and create a password. Once this password is set, anyone

who wishes to change the boot loader conﬁguration will need to enter it. More information is available in

Section 2.3.5.2.

Assigning a boot loader password prevents a local user with physical access from altering the boot loader conﬁg-

uration at system startup.

2.1.1.3 Network Devices

The default network device conﬁguration uses DHCP, which is not recommended.

Unless use of DHCP is absolutely necessary, click the “Edit” button and:



Uncheck “Use Dynamic IP conﬁguration (DHCP).”



Uncheck “Enable IPv4 Support” if the system does not require IPv4. (This is uncommon.)



Uncheck “Enable IPv6 Support” if the system does not require IPv6.



Enter appropriate IPv4 and IPv6 addresses and preﬁxes as required.

With the DHCP setting disabled, the hostname, gateway, and DNS servers should then be assigned on the

main screen.

Sections 3.9.1 and 3.9.2 contain more information on network conﬁguration and the use of DHCP.

2.1.1.4 Root Password

The security of the entire system dep e nds on the strength of the root password. The password should be at

least 12 characters long, and should include a mix of capitalized and lowercase letters, special characters, and

numbers. It should also not be base d on any dictionary word.

2.1.1.5 Software Packages

Uncheck all package groups, including the package groups “Software Development” and “Web Server,” unless

there is a spe ciﬁc requirement to install software using the system installer. If the machine will be used as a web

server, it is preferable to manually install the necessary RPMs instead of installing the full “Web Server” package

group. See Section 3.16 for installation and conﬁguration details.

Use the “Customize now” radio box to prune package groups as much as possible. This brings up a two-column

view of categories and package groups. If appropriate, uncheck “X Window System” in the “Base System”

category to avoid installing X entirely. Any other package groups not necessary for system operation should also

be unchecked.

Much ﬁner-grained package selection is possible via Kickstart as described in [8].

2.1.1.6 First-boot Conﬁguration

The system presents more conﬁguration options during the ﬁrst boot after installation. For the screens listed,

implement the security-related recommendations:

Screen Recommendation

Firewall Leave set to “Enabled.” Only check the “Trusted Services” that this system

needs to serve. Uncheck the default selection of SSH if the system does not

need to serve SSH.

SELinux Leave SELinux set to “Enforcing” mode.

Kdump Leave Kdump oﬀ unless the feature is required, such as for kernel develop-

ment and testing.

20 CHAPTER 2. SYSTEM-WIDE CONFIGURATION

Screen Recommendation

Set Up Software Updates If the system is connected to the Internet now, click “Yes, I’d like to register

now.” This will require a connection to either the Red Hat Network servers

or their proxies or satellites. This can also be conﬁgured later as described

in Section 2.1.2.1.

Create User If the system will require a local user account, it can be created here.

Even if the system will be using a network-wide authentication system

as described in Section 2.3.6, do not click on the “Use Network Login...”

button. Manually applying conﬁguration later is preferable.

2.1.2 Updating Software

The yum command line tool is used to install and update software packages. Yum replaces the up2date utility

used in previous system releases. The system also provides two graphical package managers, pirut and pup. The

pirut tool is a graphical front-end for yum that allows users to install and update packages while pup is a simple

update to ol for packages that are already installed. In the Applications menu, pirut is labeled Add/Remove

Software and pup is labeled Software Updater.

It is recomme nded that these to ols be used to keep systems up to date with the latest security patches.

2.1.2.1 Conﬁgure Connection to the RHN RPM Repositories

The ﬁrst step in conﬁguring a system for updates is to register with the Red Hat Network (RHN). For most

systems, this is done during the initial installation. Successfully registered syste ms will appear on the RHN

web site. If the system is not listed, run the Red Hat Network Registration tool, which can be found in the

Applications menu under System Tools or on the c ommand line:

# rhn register

Follow the prompts on the screen. If successful, the system will appear on the RHN web site and be subscribed

to one or more software update channels. Additionally, a new daemon, rhnsd, will be enabled.

If the system will not have ac ce ss to the Internet, it will not be able to directly subscribe to the RHN update

repository. Updates will have to be downloaded from the RHN web site manually. The command line tool yum

and the graphical front-ends pirut and pup can be conﬁgured to handle this situation.

2.1.2.1.1 Ensure Red Hat GPG Key is Installed

To ensure that the system can cryptographically verify update packages (and also connect to the Red Hat

Network to rece ive them if desired), run the following command to ensure that the system has the Red Hat

GPG key properly installed:

$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey

The command should return the string:

gpg(Red Hat, Inc. (release key <security@redhat.com>)

剩余199页未读，继续阅读

feng198148

粉丝: 0
资源: 13

Red Hat Enterprise Linux 5 安全配置指南

Red Hat Enterprise Linux 5 Deployment Guide

A Practical Guide to Fedora and Red Hat Enterprise Linux, 6th Edition

Red Hat Enterprise Linux Network Performance Tuning Guide-translate.docx

红帽官方出版物都有哪些

为Linux设计一个简单的二级文件系统的参考文献

Linux服务搭建参考文献

linux performance tuning pdf

Give an oral introduction to the spirit of Tan Kah Kee culture

rhel本地存储管理

Embedded Linux Primer: A Practical, Real-World Approach

最新资源