Securing Alpine Linux - Revision history

Dilettant: added shadow to the required packages as the lock script uses chage which is in the shadow package and not installed in alpine by default

2025-11-24T18:44:00Z

added shadow to the required packages as the lock script uses *chage* which is in the shadow package and not installed in alpine by default

← Older revision		Revision as of 18:44, 24 November 2025
Line 11:		Line 11:
	1. Install the {{pkg\|audit\|arch=}} package: {{cmd\|doas apk add audit}}		1. Install the {{pkg\|audit\|arch=}} package: {{cmd\|doas apk add audit}}

	2. Install other necessary security packages: {{cmd\|doas apk add doas logrotate bash-completion openssh-server}}		2. Install other necessary security packages: {{cmd\|doas apk add doas shadow logrotate bash-completion openssh-server}}

	== User and access management ==		== User and access management ==

Prabuanand: fixed heading style and removed step numbers

2025-05-11T06:02:05Z

fixed heading style and removed step numbers

← Older revision		Revision as of 06:02, 11 May 2025
Line 1:		Line 1:
	Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:		Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

	== ~~Step 1:~~ Update and ~~Upgrade System~~ ==		== Update and upgrade system ==

	1. Update package lists: {{cmd\|doas apk update}}		1. Update package lists: {{cmd\|doas apk update}}
Line 7:		Line 7:
	2. Upgrade installed packages: {{cmd\|doas apk upgrade}}		2. Upgrade installed packages: {{cmd\|doas apk upgrade}}

	== ~~Step 2:~~ Install ~~Necessary Security Tools~~ ==		== Install necessary security tools ==

	1. Install the {{pkg\|audit\|arch=}} package: {{cmd\|doas apk add audit}}		1. Install the {{pkg\|audit\|arch=}} package: {{cmd\|doas apk add audit}}
Line 13:		Line 13:
	2. Install other necessary security packages: {{cmd\|doas apk add doas logrotate bash-completion openssh-server}}		2. Install other necessary security packages: {{cmd\|doas apk add doas logrotate bash-completion openssh-server}}

	== ~~Step 3:~~ User and ~~Access Management~~ ==		== User and access management ==

	1. Disable root login over SSH:		1. Disable root login over SSH:
Line 27:		Line 27:
	lcredit = -1</nowiki>}}		lcredit = -1</nowiki>}}

	3. Lock unused system accounts:		3. Lock unused system accounts by running the following script:

	for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do		for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
	if [ $user !{{=}} "root" ]; then		if [ $user !{{=}} "root" ]; then
Line 36:		Line 35:
	done		done

	== ~~Step 4:~~ File ~~System~~ and ~~Directory Permissions~~ ==		== File system and directory permissions ==

	1. Set appropriate permissions on important directories: {{Cmd\|doas chmod 700 /root		1. Set appropriate permissions on important directories: {{Cmd\|doas chmod 700 /root
Line 48:		Line 47:
	...}}		...}}

	== ~~Step 5:~~ Network ~~Security~~ ==		== Network security ==

	1. Disable unnecessary services: {{cmd\|doas rc-update del <service_name>		1. Disable unnecessary services: {{cmd\|doas rc-update del <service_name>
Line 66:		Line 65:
	COMMIT }}		COMMIT }}

	== ~~Step 6:~~ Logging and ~~Auditing~~ ==		== Logging and auditing ==

	1. Configure system logging by editing {{path\|/etc/rsyslog.conf}} to ensure all log files are being captured. An example configuration is shown below:{{Cat\|/etc/rsyslog.conf\|*.info;mail.none;authpriv.none;cron.none /var/log/messages		1. Configure system logging by editing {{path\|/etc/rsyslog.conf}} to ensure all log files are being captured. An example configuration is shown below:{{Cat\|/etc/rsyslog.conf\|*.info;mail.none;authpriv.none;cron.none /var/log/messages
Line 72:		Line 71:
	mail.* -/var/log/maillog		mail.* -/var/log/maillog
	cron.* /var/log/cron}}		cron.* /var/log/cron}}


	2. Set up audit rules by editing the {{path\|/etc/audit/rules.d/audit.rules}} files and adding example rules as follows:{{Cat\|/etc/audit/rules.d/audit.rules\|-w /etc/passwd -p wa -k passwd_changes		2. Set up audit rules by editing the {{path\|/etc/audit/rules.d/audit.rules}} files and adding example rules as follows:{{Cat\|/etc/audit/rules.d/audit.rules\|-w /etc/passwd -p wa -k passwd_changes
Line 78:		Line 76:
	-w /etc/group -p wa -k group_changes}}		-w /etc/group -p wa -k group_changes}}

	== ~~Step 7:~~ Apply ~~Kernel~~ and ~~Service Hardening~~ ==		== Apply kernel and service hardening ==

	1. Disable unused filesystems by editing {{path\|/etc/modprobe.d/disable-filesystems.conf}} and add the following lines: {{Cat\|/etc/modprobe.d/disable-filesystems.conf\|install cramfs /bin/true		1. Disable unused filesystems by editing {{path\|/etc/modprobe.d/disable-filesystems.conf}} and add the following lines: {{Cat\|/etc/modprobe.d/disable-filesystems.conf\|install cramfs /bin/true
Line 101:		Line 99:
	net.ipv4.conf.default.send_redirects = 0</nowiki>}}		net.ipv4.conf.default.send_redirects = 0</nowiki>}}

	== ~~Step 8:~~ Regular ~~Maintenance~~ ==		== Regular maintenance ==

	1. Set up regular updates by creating a cron job by editing {{Path\|crontab}} using the command {{ic\|crontab -e}} such that updates are applied daily at 2 AM. The output of {{ic\|crontab -l}} appears as follows:{{Cat\|/var/spool/cron/crontabs/root\|...		1. Set up regular updates by creating a cron job by editing {{Path\|crontab}} using the command {{ic\|crontab -e}} such that updates are applied daily at 2 AM. The output of {{ic\|crontab -l}} appears as follows:{{Cat\|/var/spool/cron/crontabs/root\|...

Prabuanand: applied wikitags

2025-05-11T05:58:33Z

applied wikitags

Show changes

Prabuanand: Added category. fixed headings as per wiki guidelines

2024-10-10T10:17:36Z

Added category. fixed headings as per wiki guidelines

← Older revision		Revision as of 10:17, 10 October 2024
Line 1:		Line 1:
	Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:		Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

	= Step 1: Update and Upgrade System =		== Step 1: Update and Upgrade System ==

	1. Update package lists:		1. Update package lists:
Line 12:		Line 12:
	{{cmd\|doas apk upgrade}}		{{cmd\|doas apk upgrade}}

	= Step 2: Install Necessary Security Tools =		== Step 2: Install Necessary Security Tools ==

	1. Install the {{pkg\|audit\|arch=}} package:		1. Install the {{pkg\|audit\|arch=}} package:
Line 23:		Line 23:
	{{cmd\|doas apk add doas logrotate bash-completion openssh-server}}		{{cmd\|doas apk add doas logrotate bash-completion openssh-server}}

	= Step 3: User and Access Management =		== Step 3: User and Access Management ==

	1. Disable root login over SSH:		1. Disable root login over SSH:
Line 60:		Line 60:
	done		done

	= Step 4: File System and Directory Permissions =		== Step 4: File System and Directory Permissions ==

	1. Set appropriate permissions on important directories:		1. Set appropriate permissions on important directories:
Line 79:		Line 79:
	/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2		/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2

	= Step 5: Network Security =		== Step 5: Network Security ==

	1. Disable unnecessary services:		1. Disable unnecessary services:
Line 109:		Line 109:
	COMMIT		COMMIT

	= Step 6: Logging and Auditing =		== Step 6: Logging and Auditing ==

	1. Configure system logging:		1. Configure system logging:
Line 137:		Line 137:
	-w /etc/group -p wa -k group_changes		-w /etc/group -p wa -k group_changes

	= Step 7: Apply Kernel and Service Hardening =		== Step 7: Apply Kernel and Service Hardening ==

	1. Disable unused filesystems:		1. Disable unused filesystems:
Line 177:		Line 177:
	net.ipv4.conf.default.send_redirects = 0		net.ipv4.conf.default.send_redirects = 0

	= Step 8: Regular Maintenance =		== Step 8: Regular Maintenance ==

	1. Set up regular updates:		1. Set up regular updates:
Line 195:		Line 195:
	{{cmd\|doas logrotate /etc/logrotate.conf}}		{{cmd\|doas logrotate /etc/logrotate.conf}}

	= Conclusion =		== Conclusion ==

	This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.		This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

			[[Category:Security]]

Pinetree: Add headers to make navigation more friendly; minor (page source) formatting changes

2024-10-10T05:35:07Z

Add headers to make navigation more friendly; minor (page source) formatting changes

← Older revision		Revision as of 05:35, 10 October 2024
Line 1:		Line 1:
	Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:		Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

	Step 1: Update and Upgrade System		= Step 1: Update and Upgrade System =

	1. Update package lists:		1. Update package lists:
Line 12:		Line 12:
	{{cmd\|doas apk upgrade}}		{{cmd\|doas apk upgrade}}

			= Step 2: Install Necessary Security Tools =

	~~Step 2: Install Necessary Security Tools~~		1. Install the {{pkg\|audit\|arch=}} package:

	1. Install {{pkg\|audit\|arch=}} package:

	{{cmd\|doas apk add audit}}		{{cmd\|doas apk add audit}}
Line 22:		Line 21:
	2. Install other necessary security packages:		2. Install other necessary security packages:

	{{cmd\|doas apk add doas logrotate bash-completion openssh-server}}		{{cmd\|doas apk add doas logrotate bash-completion openssh-server}}

			= Step 3: User and Access Management =
	Step 3: User and Access Management

	1. Disable root login over SSH:		1. Disable root login over SSH:
Line 31:		Line 29:
	Edit {{path\|/etc/ssh/sshd_config}}:		Edit {{path\|/etc/ssh/sshd_config}}:

	{{cmd\|doas vi /etc/ssh/sshd_config}}		{{cmd\|doas vi /etc/ssh/sshd_config}}

	Set the following parameter:		Set the following parameter:
Line 62:		Line 60:
	done		done

			= Step 4: File System and Directory Permissions =
	Step 4: File System and Directory Permissions

	1. Set appropriate permissions on important directories:		1. Set appropriate permissions on important directories:
Line 82:		Line 79:
	/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2		/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2

			= Step 5: Network Security =
	Step 5: Network Security

	1. Disable unnecessary services:		1. Disable unnecessary services:
Line 113:		Line 109:
	COMMIT		COMMIT

			= Step 6: Logging and Auditing =
	Step 6: Logging and Auditing

	1. Configure system logging:		1. Configure system logging:
Line 142:		Line 137:
	-w /etc/group -p wa -k group_changes		-w /etc/group -p wa -k group_changes

			= Step 7: Apply Kernel and Service Hardening =
	Step 7: Apply Kernel and Service Hardening

	1. Disable unused filesystems:		1. Disable unused filesystems:
Line 183:		Line 177:
	net.ipv4.conf.default.send_redirects = 0		net.ipv4.conf.default.send_redirects = 0

			= Step 8: Regular Maintenance =
	Step 8: Regular Maintenance

	1. Set up regular updates:		1. Set up regular updates:
Line 195:		Line 188:

	0 2 * * * apk update && apk upgrade		0 2 * * * apk update && apk upgrade


	2. Review and monitor logs regularly:		2. Review and monitor logs regularly:
Line 203:		Line 195:
	{{cmd\|doas logrotate /etc/logrotate.conf}}		{{cmd\|doas logrotate /etc/logrotate.conf}}

			= Conclusion =
	Conclusion

	This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.		This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Zcrayfish: Begin to use some of the styling templates (path, cmd)

2024-07-04T00:07:03Z

Begin to use some of the styling templates (path, cmd)

← Older revision		Revision as of 00:07, 4 July 2024
Line 5:		Line 5:
	1. Update package lists:		1. Update package lists:

	doas apk update		{{cmd\|doas apk update}}


	2. Upgrade installed packages:		2. Upgrade installed packages:

	doas apk upgrade		{{cmd\|doas apk upgrade}}


	Step 2: Install Necessary Security Tools		Step 2: Install Necessary Security Tools

	1. Install `audit` package:		1. Install {{pkg\|audit\|arch=}} package:

	doas apk add audit		{{cmd\|doas apk add audit}}


	2. Install other necessary security packages:		2. Install other necessary security packages:

	doas apk add doas logrotate bash-completion openssh-server		{{cmd\|doas apk add doas logrotate bash-completion openssh-server}}


Line 29:		Line 29:
	1. Disable root login over SSH:		1. Disable root login over SSH:

	Edit `/etc/ssh/sshd_config`:		Edit {{path\|/etc/ssh/sshd_config}}:

	doas vi /etc/ssh/sshd_config		{{cmd\|doas vi /etc/ssh/sshd_config}}

	Set the following parameter:		Set the following parameter:
Line 40:		Line 40:
	2. Ensure password complexity:		2. Ensure password complexity:

	Edit `/etc/security/pwquality.conf`:		Edit {{path\|/etc/security/pwquality.conf}}:

	doas vi /etc/security/pwquality.conf		{{cmd\|doas vi /etc/security/pwquality.conf}}

	Add or update the following lines:		Add or update the following lines:
Line 56:		Line 56:

	for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do		for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
	if [ $user != "root" ]; then		if [ $user !{{=}} "root" ]; then
	doas passwd -l $user		doas passwd -l $user
	doas chage -E 0 $user		doas chage -E 0 $user
Line 74:		Line 74:
	2. Configure mount options:		2. Configure mount options:

	Edit `/etc/fstab`:		Edit {{path\|/etc/fstab}}:

	doas vi /etc/fstab		{{cmd\|doas vi /etc/fstab}}

	Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:		Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
Line 87:		Line 87:
	1. Disable unnecessary services:		1. Disable unnecessary services:

	doas rc-update del <service_name>		{{cmd\|doas rc-update del <service_name>
	doas rc-service <service_name> stop		doas rc-service <service_name> stop}}


	2. Configure firewall (iptables):		2. Configure firewall (iptables):

	doas apk add iptables		{{cmd\|doas apk add iptables
	doas rc-service iptables start		doas rc-service iptables start
	doas rc-update add iptables		doas rc-update add iptables}}


	Create a basic firewall ruleset:		Create a basic firewall ruleset:

	doas vi /etc/iptables/rules.v4		{{cmd\|doas vi /etc/iptables/rules.v4}}

	Example rules:		Example rules:
Line 118:		Line 118:
	1. Configure system logging:		1. Configure system logging:

	Edit `/etc/rsyslog.conf` to ensure all log files are being captured:		Edit {{path\|/etc/rsyslog.conf}} to ensure all log files are being captured:

	doas vi /etc/rsyslog.conf		{{cmd\|doas vi /etc/rsyslog.conf}}

	Example configuration:		Example configuration:
Line 132:		Line 132:
	2. Set up audit rules:		2. Set up audit rules:

	Edit `/etc/audit/rules.d/audit.rules`:		Edit {{path\|/etc/audit/rules.d/audit.rules}}:

	doas vi /etc/audit/rules.d/audit.rules		{{cmd\|doas vi /etc/audit/rules.d/audit.rules}}

	Example rules:		Example rules:
Line 147:		Line 147:
	1. Disable unused filesystems:		1. Disable unused filesystems:

	Edit `/etc/modprobe.d/disable-filesystems.conf`:		Edit {{path\|/etc/modprobe.d/disable-filesystems.conf}}:

	doas vi /etc/modprobe.d/disable-filesystems.conf		{{cmd\|doas vi /etc/modprobe.d/disable-filesystems.conf}}

	Add the following lines:		Add the following lines:
Line 165:		Line 165:
	2. Configure kernel parameters:		2. Configure kernel parameters:

	Edit `/etc/sysctl.conf`:		Edit {{path\|/etc/sysctl.conf}}:

	doas vi /etc/sysctl.conf		{{cmd\|doas vi /etc/sysctl.conf}}

	Add or update the following parameters:		Add or update the following parameters:
Line 190:		Line 190:
	Create a cron job for regular updates:		Create a cron job for regular updates:

	doas crontab -e		{{cmd\|doas crontab -e}}

	Add the following line to update daily at 2 AM:		Add the following line to update daily at 2 AM:
Line 201:		Line 201:
	Ensure logs are rotated and reviewed frequently:		Ensure logs are rotated and reviewed frequently:

	doas logrotate /etc/logrotate.conf		{{cmd\|doas logrotate /etc/logrotate.conf}}

Zcrayfish: Bulk replace sudo with doas.

2024-07-03T23:53:50Z

Bulk replace sudo with doas.

← Older revision		Revision as of 23:53, 3 July 2024
Line 5:		Line 5:
	1. Update package lists:		1. Update package lists:

	~~sudo~~ apk update		doas apk update


	2. Upgrade installed packages:		2. Upgrade installed packages:

	~~sudo~~ apk upgrade		doas apk upgrade


Line 17:		Line 17:
	1. Install `audit` package:		1. Install `audit` package:

	~~sudo~~ apk add audit		doas apk add audit


	2. Install other necessary security packages:		2. Install other necessary security packages:

	~~sudo~~ apk add ~~sudo~~ logrotate bash-completion openssh-server		doas apk add doas logrotate bash-completion openssh-server


Line 31:		Line 31:
	Edit `/etc/ssh/sshd_config`:		Edit `/etc/ssh/sshd_config`:

	~~sudo~~ vi /etc/ssh/sshd_config		doas vi /etc/ssh/sshd_config

	Set the following parameter:		Set the following parameter:
Line 42:		Line 42:
	Edit `/etc/security/pwquality.conf`:		Edit `/etc/security/pwquality.conf`:

	~~sudo~~ vi /etc/security/pwquality.conf		doas vi /etc/security/pwquality.conf

	Add or update the following lines:		Add or update the following lines:
Line 57:		Line 57:
	for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do		for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
	if [ $user != "root" ]; then		if [ $user != "root" ]; then
	~~sudo~~ passwd -l $user		doas passwd -l $user
	~~sudo~~ chage -E 0 $user		doas chage -E 0 $user
	fi		fi
	done		done
Line 67:		Line 67:
	1. Set appropriate permissions on important directories:		1. Set appropriate permissions on important directories:

	~~sudo~~ chmod 700 /root		doas chmod 700 /root
	~~sudo~~ chmod 600 /boot/grub/grub.cfg		doas chmod 600 /boot/grub/grub.cfg
	~~sudo~~ chmod 600 /etc/ssh/sshd_config		doas chmod 600 /etc/ssh/sshd_config


Line 76:		Line 76:
	Edit `/etc/fstab`:		Edit `/etc/fstab`:

	~~sudo~~ vi /etc/fstab		doas vi /etc/fstab

	Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:		Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
Line 87:		Line 87:
	1. Disable unnecessary services:		1. Disable unnecessary services:

	~~sudo~~ rc-update del <service_name>		doas rc-update del <service_name>
	~~sudo~~ rc-service <service_name> stop		doas rc-service <service_name> stop


	2. Configure firewall (iptables):		2. Configure firewall (iptables):

	~~sudo~~ apk add iptables		doas apk add iptables
	~~sudo~~ rc-service iptables start		doas rc-service iptables start
	~~sudo~~ rc-update add iptables		doas rc-update add iptables


	Create a basic firewall ruleset:		Create a basic firewall ruleset:

	~~sudo~~ vi /etc/iptables/rules.v4		doas vi /etc/iptables/rules.v4

	Example rules:		Example rules:
Line 120:		Line 120:
	Edit `/etc/rsyslog.conf` to ensure all log files are being captured:		Edit `/etc/rsyslog.conf` to ensure all log files are being captured:

	~~sudo~~ vi /etc/rsyslog.conf		doas vi /etc/rsyslog.conf

	Example configuration:		Example configuration:
Line 134:		Line 134:
	Edit `/etc/audit/rules.d/audit.rules`:		Edit `/etc/audit/rules.d/audit.rules`:

	~~sudo~~ vi /etc/audit/rules.d/audit.rules		doas vi /etc/audit/rules.d/audit.rules

	Example rules:		Example rules:
Line 149:		Line 149:
	Edit `/etc/modprobe.d/disable-filesystems.conf`:		Edit `/etc/modprobe.d/disable-filesystems.conf`:

	~~sudo~~ vi /etc/modprobe.d/disable-filesystems.conf		doas vi /etc/modprobe.d/disable-filesystems.conf

	Add the following lines:		Add the following lines:
Line 167:		Line 167:
	Edit `/etc/sysctl.conf`:		Edit `/etc/sysctl.conf`:

	~~sudo~~ vi /etc/sysctl.conf		doas vi /etc/sysctl.conf

	Add or update the following parameters:		Add or update the following parameters:
Line 190:		Line 190:
	Create a cron job for regular updates:		Create a cron job for regular updates:

	~~sudo~~ crontab -e		doas crontab -e

	Add the following line to update daily at 2 AM:		Add the following line to update daily at 2 AM:
Line 201:		Line 201:
	Ensure logs are rotated and reviewed frequently:		Ensure logs are rotated and reviewed frequently:

	~~sudo~~ logrotate /etc/logrotate.conf		doas logrotate /etc/logrotate.conf

Reddognighttime at 14:43, 3 July 2024

2024-07-03T14:43:16Z

← Older revision		Revision as of 14:43, 3 July 2024
Line 29:		Line 29:
	1. Disable root login over SSH:		1. Disable root login over SSH:

	Edit `/etc/ssh/sshd_config`:		Edit `/etc/ssh/sshd_config`:

	sudo vi /etc/ssh/sshd_config		sudo vi /etc/ssh/sshd_config

	Set the following parameter:		Set the following parameter:

	PermitRootLogin no		PermitRootLogin no


	2. Ensure password complexity:		2. Ensure password complexity:

	Edit `/etc/security/pwquality.conf`:		Edit `/etc/security/pwquality.conf`:

	sudo vi /etc/security/pwquality.conf		sudo vi /etc/security/pwquality.conf

	Add or update the following lines:		Add or update the following lines:

	minlen = 14		minlen = 14
Line 73:		Line 73:

	2. Configure mount options:		2. Configure mount options:
	Edit `/etc/fstab`:
			Edit `/etc/fstab`:

	sudo vi /etc/fstab		sudo vi /etc/fstab

	Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:		Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:

	/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2		/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
Line 97:		Line 98:


	Create a basic firewall ruleset:		Create a basic firewall ruleset:

	sudo vi /etc/iptables/rules.v4		sudo vi /etc/iptables/rules.v4

	Example rules:		Example rules:

	*filter		*filter
Line 117:		Line 118:
	1. Configure system logging:		1. Configure system logging:

	Edit `/etc/rsyslog.conf` to ensure all log files are being captured:		Edit `/etc/rsyslog.conf` to ensure all log files are being captured:

	sudo vi /etc/rsyslog.conf		sudo vi /etc/rsyslog.conf

	Example configuration:		Example configuration:

	*.info;mail.none;authpriv.none;cron.none /var/log/messages		*.info;mail.none;authpriv.none;cron.none /var/log/messages
Line 131:		Line 132:
	2. Set up audit rules:		2. Set up audit rules:

	Edit `/etc/audit/rules.d/audit.rules`:		Edit `/etc/audit/rules.d/audit.rules`:

	sudo vi /etc/audit/rules.d/audit.rules		sudo vi /etc/audit/rules.d/audit.rules

	Example rules:		Example rules:

	-w /etc/passwd -p wa -k passwd_changes		-w /etc/passwd -p wa -k passwd_changes
Line 146:		Line 147:
	1. Disable unused filesystems:		1. Disable unused filesystems:

	Edit `/etc/modprobe.d/disable-filesystems.conf`:		Edit `/etc/modprobe.d/disable-filesystems.conf`:

	sudo vi /etc/modprobe.d/disable-filesystems.conf		sudo vi /etc/modprobe.d/disable-filesystems.conf

	Add the following lines:		Add the following lines:

	install cramfs /bin/true		install cramfs /bin/true
Line 164:		Line 165:
	2. Configure kernel parameters:		2. Configure kernel parameters:

	Edit `/etc/sysctl.conf`:		Edit `/etc/sysctl.conf`:

	sudo vi /etc/sysctl.conf		sudo vi /etc/sysctl.conf

	Add or update the following parameters:		Add or update the following parameters:

	net.ipv4.ip_forward = 0		net.ipv4.ip_forward = 0
Line 187:		Line 188:
	1. Set up regular updates:		1. Set up regular updates:

	Create a cron job for regular updates:		Create a cron job for regular updates:

	sudo crontab -e		sudo crontab -e

	Add the following line to update daily at 2 AM:		Add the following line to update daily at 2 AM:

	0 2 * * * apk update && apk upgrade		0 2 * * * apk update && apk upgrade
Line 198:		Line 199:
	2. Review and monitor logs regularly:		2. Review and monitor logs regularly:

	Ensure logs are rotated and reviewed frequently:		Ensure logs are rotated and reviewed frequently:

	sudo logrotate /etc/logrotate.conf		sudo logrotate /etc/logrotate.conf

Reddognighttime: Securing Alpine Linux

2024-07-03T14:40:14Z

Securing Alpine Linux