Securing Alpine Linux: Difference between revisions

From Alpine Linux
No edit summary
m (Begin to use some of the styling templates (path, cmd))
 
(3 intermediate revisions by 2 users not shown)
Line 5: Line 5:
1. Update package lists:
1. Update package lists:


   sudo apk update
   {{cmd|doas apk update}}




2. **Upgrade installed packages:**
2. Upgrade installed packages:
  ```sh
  sudo apk upgrade
  ```


### Step 2: Install Necessary Security Tools
  {{cmd|doas apk upgrade}}


1. **Install `audit` package:**
  ```sh
  sudo apk add audit
  ```


2. **Install other necessary security packages:**
Step 2: Install Necessary Security Tools
  ```sh
  sudo apk add sudo logrotate bash-completion openssh-server
  ```


### Step 3: User and Access Management
1. Install {{pkg|audit|arch=}} package:


1. **Disable root login over SSH:**
  {{cmd|doas apk add audit}}
  Edit `/etc/ssh/sshd_config`:
 
  ```sh
 
  sudo vi /etc/ssh/sshd_config
2. Install other necessary security packages:
  ```
 
  Set the following parameter:
      {{cmd|doas apk add doas logrotate bash-completion openssh-server}}
  ```sh
 
  PermitRootLogin no
 
   ```
Step 3: User and Access Management
 
1. Disable root login over SSH:
 
Edit {{path|/etc/ssh/sshd_config}}:
 
      {{cmd|doas vi /etc/ssh/sshd_config}}
 
Set the following parameter:
 
      PermitRootLogin no
 
 
2. Ensure password complexity:
 
Edit {{path|/etc/security/pwquality.conf}}:
 
   {{cmd|doas vi /etc/security/pwquality.conf}}
 
Add or update the following lines:


2. **Ensure password complexity:**
  Edit `/etc/security/pwquality.conf`:
  ```sh
  sudo vi /etc/security/pwquality.conf
  ```
  Add or update the following lines:
  ```sh
   minlen = 14
   minlen = 14
   dcredit = -1
   dcredit = -1
Line 49: Line 51:
   ocredit = -1
   ocredit = -1
   lcredit = -1
   lcredit = -1
  ```


3. **Lock unused system accounts:**
 
  ```sh
3. Lock unused system accounts:
 
   for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
   for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
       if [ $user != "root" ]; then
       if [ $user !{{=}} "root" ]; then
           sudo passwd -l $user
           doas passwd -l $user
           sudo chage -E 0 $user
           doas chage -E 0 $user
       fi
       fi
   done
   done
  ```


### Step 4: File System and Directory Permissions


1. **Set appropriate permissions on important directories:**
Step 4: File System and Directory Permissions
  ```sh
 
   sudo chmod 700 /root
1. Set appropriate permissions on important directories:
   sudo chmod 600 /boot/grub/grub.cfg
 
   sudo chmod 600 /etc/ssh/sshd_config
   doas chmod 700 /root
   ```
   doas chmod 600 /boot/grub/grub.cfg
   doas chmod 600 /etc/ssh/sshd_config
 
 
2. Configure mount options:
 
Edit {{path|/etc/fstab}}:
 
   {{cmd|doas vi /etc/fstab}}
 
Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:


2. **Configure mount options:**
  Edit `/etc/fstab`:
  ```sh
  sudo vi /etc/fstab
  ```
  Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
  ```sh
   /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
   /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
  ```


### Step 5: Network Security


1. **Disable unnecessary services:**
Step 5: Network Security
  ```sh
  sudo rc-update del <service_name>
  sudo rc-service <service_name> stop
  ```


2. **Configure firewall (iptables):**
1. Disable unnecessary services:
  ```sh
 
   sudo apk add iptables
  {{cmd|doas rc-update del <service_name>
   sudo rc-service iptables start
  doas rc-service <service_name> stop}}
   sudo rc-update add iptables
 
   ```
 
2. Configure firewall (iptables):
 
   {{cmd|doas apk add iptables
   doas rc-service iptables start
   doas rc-update add iptables}}
 
 
Create a basic firewall ruleset:
 
   {{cmd|doas vi /etc/iptables/rules.v4}}
 
Example rules:


  Create a basic firewall ruleset:
  ```sh
  sudo vi /etc/iptables/rules.v4
  ```
  Example rules:
  ```sh
   *filter
   *filter
   :INPUT DROP [0:0]
   :INPUT DROP [0:0]
Line 109: Line 112:
   -A INPUT -p tcp --dport 22 -j ACCEPT
   -A INPUT -p tcp --dport 22 -j ACCEPT
   COMMIT
   COMMIT
  ```


### Step 6: Logging and Auditing


1. **Configure system logging:**
Step 6: Logging and Auditing
  Edit `/etc/rsyslog.conf` to ensure all log files are being captured:
 
  ```sh
1. Configure system logging:
   sudo vi /etc/rsyslog.conf
 
  ```
Edit {{path|/etc/rsyslog.conf}} to ensure all log files are being captured:
  Example configuration:
 
  ```sh
   {{cmd|doas vi /etc/rsyslog.conf}}
 
Example configuration:
 
   *.info;mail.none;authpriv.none;cron.none /var/log/messages
   *.info;mail.none;authpriv.none;cron.none /var/log/messages
   authpriv.* /var/log/secure
   authpriv.* /var/log/secure
   mail.* -/var/log/maillog
   mail.* -/var/log/maillog
   cron.* /var/log/cron
   cron.* /var/log/cron
  ```


2. **Set up audit rules:**
 
  Edit `/etc/audit/rules.d/audit.rules`:
2. Set up audit rules:
  ```sh
 
   sudo vi /etc/audit/rules.d/audit.rules
Edit {{path|/etc/audit/rules.d/audit.rules}}:
  ```
 
  Example rules:
   {{cmd|doas vi /etc/audit/rules.d/audit.rules}}
  ```sh
 
Example rules:
 
   -w /etc/passwd -p wa -k passwd_changes
   -w /etc/passwd -p wa -k passwd_changes
   -w /etc/shadow -p wa -k shadow_changes
   -w /etc/shadow -p wa -k shadow_changes
   -w /etc/group -p wa -k group_changes
   -w /etc/group -p wa -k group_changes
  ```


### Step 7: Apply Kernel and Service Hardening


1. **Disable unused filesystems:**
Step 7: Apply Kernel and Service Hardening
  Edit `/etc/modprobe.d/disable-filesystems.conf`:
 
  ```sh
1. Disable unused filesystems:
   sudo vi /etc/modprobe.d/disable-filesystems.conf
 
  ```
Edit {{path|/etc/modprobe.d/disable-filesystems.conf}}:
  Add the following lines:
 
  ```sh
   {{cmd|doas vi /etc/modprobe.d/disable-filesystems.conf}}
 
Add the following lines:
 
   install cramfs /bin/true
   install cramfs /bin/true
   install freevxfs /bin/true
   install freevxfs /bin/true
Line 155: Line 161:
   install udf /bin/true
   install udf /bin/true
   install vfat /bin/true
   install vfat /bin/true
  ```


2. **Configure kernel parameters:**
 
  Edit `/etc/sysctl.conf`:
2. Configure kernel parameters:
  ```sh
 
   sudo vi /etc/sysctl.conf
Edit {{path|/etc/sysctl.conf}}:
  ```
 
  Add or update the following parameters:
   {{cmd|doas vi /etc/sysctl.conf}}
  ```sh
 
Add or update the following parameters:
 
   net.ipv4.ip_forward = 0
   net.ipv4.ip_forward = 0
   net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.all.accept_source_route = 0
Line 175: Line 182:
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
  ```


### Step 8: Regular Maintenance


1. **Set up regular updates:**
Step 8: Regular Maintenance
  Create a cron job for regular updates:
 
  ```sh
1. Set up regular updates:
   sudo crontab -e
 
  ```
Create a cron job for regular updates:
  Add the following line to update daily at 2 AM:
 
  ```sh
   {{cmd|doas crontab -e}}
 
Add the following line to update daily at 2 AM:
 
   0 2 * * * apk update && apk upgrade
   0 2 * * * apk update && apk upgrade
  ```


2. **Review and monitor logs regularly:**
  Ensure logs are rotated and reviewed frequently:
  ```sh
  sudo logrotate /etc/logrotate.conf
  ```


### Conclusion
2. Review and monitor logs regularly:
 
Ensure logs are rotated and reviewed frequently:
 
  {{cmd|doas logrotate /etc/logrotate.conf}}
 
 
Conclusion


This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.
This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Latest revision as of 00:07, 4 July 2024

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

Step 1: Update and Upgrade System

1. Update package lists:

doas apk update


2. Upgrade installed packages:

doas apk upgrade


Step 2: Install Necessary Security Tools

1. Install audit package:

doas apk add audit


2. Install other necessary security packages:

doas apk add doas logrotate bash-completion openssh-server


Step 3: User and Access Management

1. Disable root login over SSH:

Edit /etc/ssh/sshd_config:

doas vi /etc/ssh/sshd_config

Set the following parameter: 

      PermitRootLogin no


2. Ensure password complexity:

Edit /etc/security/pwquality.conf:

doas vi /etc/security/pwquality.conf

Add or update the following lines: 

  minlen = 14
  dcredit = -1
  ucredit = -1
  ocredit = -1
  lcredit = -1


3. Lock unused system accounts: 

  for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
      if [ $user != "root" ]; then
          doas passwd -l $user
          doas chage -E 0 $user
      fi
  done


Step 4: File System and Directory Permissions

1. Set appropriate permissions on important directories: 

  doas chmod 700 /root
  doas chmod 600 /boot/grub/grub.cfg
  doas chmod 600 /etc/ssh/sshd_config


2. Configure mount options:

Edit /etc/fstab:

doas vi /etc/fstab

Add `nosuid`, `nodev`, and `noexec` options to non-root partitions: 

  /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2


Step 5: Network Security

1. Disable unnecessary services:

doas rc-update del <service_name> doas rc-service <service_name> stop


2. Configure firewall (iptables):

doas apk add iptables doas rc-service iptables start doas rc-update add iptables


Create a basic firewall ruleset:

doas vi /etc/iptables/rules.v4

Example rules: 

  *filter
  :INPUT DROP [0:0]
  :FORWARD DROP [0:0]
  :OUTPUT ACCEPT [0:0]
  -A INPUT -i lo -j ACCEPT
  -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  -A INPUT -p tcp --dport 22 -j ACCEPT
  COMMIT


Step 6: Logging and Auditing

1. Configure system logging:

Edit /etc/rsyslog.conf to ensure all log files are being captured:

doas vi /etc/rsyslog.conf

Example configuration: 

  *.info;mail.none;authpriv.none;cron.none /var/log/messages
  authpriv.* /var/log/secure
  mail.* -/var/log/maillog
  cron.* /var/log/cron


2. Set up audit rules:

Edit /etc/audit/rules.d/audit.rules:

doas vi /etc/audit/rules.d/audit.rules

Example rules: 

  -w /etc/passwd -p wa -k passwd_changes
  -w /etc/shadow -p wa -k shadow_changes
  -w /etc/group -p wa -k group_changes


Step 7: Apply Kernel and Service Hardening

1. Disable unused filesystems:

Edit /etc/modprobe.d/disable-filesystems.conf:

doas vi /etc/modprobe.d/disable-filesystems.conf

Add the following lines: 

  install cramfs /bin/true
  install freevxfs /bin/true
  install jffs2 /bin/true
  install hfs /bin/true
  install hfsplus /bin/true
  install squashfs /bin/true
  install udf /bin/true
  install vfat /bin/true


2. Configure kernel parameters:

Edit /etc/sysctl.conf:

doas vi /etc/sysctl.conf

Add or update the following parameters: 

  net.ipv4.ip_forward = 0
  net.ipv4.conf.all.accept_source_route = 0
  net.ipv4.conf.all.accept_redirects = 0
  net.ipv4.conf.all.secure_redirects = 0
  net.ipv4.conf.all.log_martians = 1
  net.ipv4.conf.default.log_martians = 1
  net.ipv4.icmp_echo_ignore_broadcasts = 1
  net.ipv4.icmp_ignore_bogus_error_responses = 1
  net.ipv4.tcp_syncookies = 1
  net.ipv4.conf.all.send_redirects = 0
  net.ipv4.conf.default.send_redirects = 0


Step 8: Regular Maintenance

1. Set up regular updates:

Create a cron job for regular updates:

doas crontab -e

Add the following line to update daily at 2 AM: 

  0 2 * * * apk update && apk upgrade


2. Review and monitor logs regularly:

Ensure logs are rotated and reviewed frequently:

doas logrotate /etc/logrotate.conf


Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Retrieved from "https://wiki.alpinelinux.org/w/index.php?title=Securing_Alpine_Linux&oldid=26887"