Securing Alpine Linux: Difference between revisions

From Alpine Linux
(Securing Alpine Linux using Security Technical Implementation Guides (STIGs))
 
(fixed heading style and removed step numbers)
 
(8 intermediate revisions by 4 users not shown)
Line 1: Line 1:
Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:
Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:


### Step 1: Update and Upgrade System
== Update and upgrade system ==


1. **Update package lists:**
1. Update package lists: {{cmd|doas apk update}}
  ```sh
  sudo apk update
  ```


2. **Upgrade installed packages:**
2. Upgrade installed packages: {{cmd|doas apk upgrade}}
  ```sh
  sudo apk upgrade
  ```


### Step 2: Install Necessary Security Tools
== Install necessary security tools ==


1. **Install `audit` package:**
1. Install the {{pkg|audit|arch=}} package: {{cmd|doas apk add audit}}
  ```sh
  sudo apk add audit
  ```


2. **Install other necessary security packages:**
2. Install other necessary security packages: {{cmd|doas apk add doas logrotate bash-completion openssh-server}}
  ```sh
  sudo apk add sudo logrotate bash-completion openssh-server
  ```


### Step 3: User and Access Management
== User and access management ==


1. **Disable root login over SSH:**
1. Disable root login over SSH:  
  Edit `/etc/ssh/sshd_config`:
Edit {{path|/etc/ssh/sshd_config}} and Set the following parameter as follows {{Cat|/etc/ssh/sshd_config|...
  ```sh
PermitRootLogin no}}
  sudo vi /etc/ssh/sshd_config
  ```
  Set the following parameter:
  ```sh
  PermitRootLogin no
  ```


2. **Ensure password complexity:**
2. Ensure password complexity:
  Edit `/etc/security/pwquality.conf`:
Edit {{path|/etc/security/pwquality.conf}} and add or update the following lines:{{Cat|/etc/security/pwquality.conf|<nowiki>...
  ```sh
minlen = 14
  sudo vi /etc/security/pwquality.conf
dcredit = -1
  ```
ucredit = -1
  Add or update the following lines:
ocredit = -1
  ```sh
lcredit = -1</nowiki>}}
  minlen = 14
  dcredit = -1
  ucredit = -1
  ocredit = -1
  lcredit = -1
  ```


3. **Lock unused system accounts:**
3. Lock unused system accounts by running the following script:
  ```sh
   for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
   for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
       if [ $user != "root" ]; then
       if [ $user !{{=}} "root" ]; then
           sudo passwd -l $user
           doas passwd -l $user
           sudo chage -E 0 $user
           doas chage -E 0 $user
       fi
       fi
   done
   done
  ```


### Step 4: File System and Directory Permissions
== File system and directory permissions ==


1. **Set appropriate permissions on important directories:**
1. Set appropriate permissions on important directories: {{Cmd|doas chmod 700 /root
  ```sh
doas chmod 600 /boot/grub/grub.cfg
  sudo chmod 700 /root
doas chmod 600 /etc/ssh/sshd_config}}
  sudo chmod 600 /boot/grub/grub.cfg
  sudo chmod 600 /etc/ssh/sshd_config
  ```


2. **Configure mount options:**
2. Configure mount options:
  Edit `/etc/fstab`:
  ```sh
  sudo vi /etc/fstab
  ```
  Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
  ```sh
  /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
  ```


### Step 5: Network Security
Edit {{path|/etc/fstab}} and Add `nosuid`, `nodev`, and `noexec` options to non-root partitions as follows:{{Cat|/etc/fstab|...
/dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
...}}


1. **Disable unnecessary services:**
== Network security ==
  ```sh
  sudo rc-update del <service_name>
  sudo rc-service <service_name> stop
  ```


2. **Configure firewall (iptables):**
1. Disable unnecessary services: {{cmd|doas rc-update del <service_name>
  ```sh
doas rc-service <service_name> stop}}
  sudo apk add iptables
  sudo rc-service iptables start
  sudo rc-update add iptables
  ```


  Create a basic firewall ruleset:
2. Configure {{Pkg|iptables}} firewall by installing and enabling it as follows:{{cmd|doas apk add iptables
  ```sh
doas rc-service iptables start
  sudo vi /etc/iptables/rules.v4
doas rc-update add iptables}}
  ```
  Example rules:
  ```sh
  *filter
  :INPUT DROP [0:0]
  :FORWARD DROP [0:0]
  :OUTPUT ACCEPT [0:0]
  -A INPUT -i lo -j ACCEPT
  -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  -A INPUT -p tcp --dport 22 -j ACCEPT
  COMMIT
  ```


### Step 6: Logging and Auditing
Create a basic firewall ruleset by adding Example rules to {{Path|/etc/iptables/rules.v4}} as follows:{{Cat|/etc/iptables/rules.v4|*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
COMMIT }}


1. **Configure system logging:**
== Logging and auditing ==
  Edit `/etc/rsyslog.conf` to ensure all log files are being captured:
  ```sh
  sudo vi /etc/rsyslog.conf
  ```
  Example configuration:
  ```sh
  *.info;mail.none;authpriv.none;cron.none /var/log/messages
  authpriv.* /var/log/secure
  mail.* -/var/log/maillog
  cron.* /var/log/cron
  ```


2. **Set up audit rules:**
1. Configure system logging by editing {{path|/etc/rsyslog.conf}} to ensure all log files are being captured. An example configuration is shown below:{{Cat|/etc/rsyslog.conf|*.info;mail.none;authpriv.none;cron.none /var/log/messages
  Edit `/etc/audit/rules.d/audit.rules`:
authpriv.* /var/log/secure
  ```sh
mail.* -/var/log/maillog
  sudo vi /etc/audit/rules.d/audit.rules
cron.* /var/log/cron}}
  ```
  Example rules:
  ```sh
  -w /etc/passwd -p wa -k passwd_changes
  -w /etc/shadow -p wa -k shadow_changes
  -w /etc/group -p wa -k group_changes
  ```


### Step 7: Apply Kernel and Service Hardening
2. Set up audit rules by editing the {{path|/etc/audit/rules.d/audit.rules}} files and adding example rules as follows:{{Cat|/etc/audit/rules.d/audit.rules|-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes}}


1. **Disable unused filesystems:**
== Apply kernel and service hardening ==
  Edit `/etc/modprobe.d/disable-filesystems.conf`:
  ```sh
  sudo vi /etc/modprobe.d/disable-filesystems.conf
  ```
  Add the following lines:
  ```sh
  install cramfs /bin/true
  install freevxfs /bin/true
  install jffs2 /bin/true
  install hfs /bin/true
  install hfsplus /bin/true
  install squashfs /bin/true
  install udf /bin/true
  install vfat /bin/true
  ```


2. **Configure kernel parameters:**
1. Disable unused filesystems by editing {{path|/etc/modprobe.d/disable-filesystems.conf}} and add the following lines: {{Cat|/etc/modprobe.d/disable-filesystems.conf|install cramfs /bin/true
  Edit `/etc/sysctl.conf`:
install freevxfs /bin/true
  ```sh
install jffs2 /bin/true
  sudo vi /etc/sysctl.conf
install hfs /bin/true
  ```
install hfsplus /bin/true
  Add or update the following parameters:
install squashfs /bin/true
  ```sh
install udf /bin/true
  net.ipv4.ip_forward = 0
install vfat /bin/true}}
  net.ipv4.conf.all.accept_source_route = 0
  net.ipv4.conf.all.accept_redirects = 0
  net.ipv4.conf.all.secure_redirects = 0
  net.ipv4.conf.all.log_martians = 1
  net.ipv4.conf.default.log_martians = 1
  net.ipv4.icmp_echo_ignore_broadcasts = 1
  net.ipv4.icmp_ignore_bogus_error_responses = 1
  net.ipv4.tcp_syncookies = 1
  net.ipv4.conf.all.send_redirects = 0
  net.ipv4.conf.default.send_redirects = 0
  ```


### Step 8: Regular Maintenance
2. Configure kernel parameters by editing the {{path|/etc/sysctl.conf}} and adding or updating the following parameters:{{Cat|/etc/sysctl.conf|<nowiki>net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0</nowiki>}}


1. **Set up regular updates:**
== Regular maintenance ==
  Create a cron job for regular updates:
  ```sh
  sudo crontab -e
  ```
  Add the following line to update daily at 2 AM:
  ```sh
  0 2 * * * apk update && apk upgrade
  ```


2. **Review and monitor logs regularly:**
1. Set up regular updates by creating a cron job by editing {{Path|crontab}} using the command {{ic|crontab -e}} such that  updates are applied daily at 2 AM. The output of {{ic|crontab -l}} appears as follows:{{Cat|/var/spool/cron/crontabs/root|...
  Ensure logs are rotated and reviewed frequently:
0 2 * * * apk update && apk upgrade }}
  ```sh
2. Review and monitor logs regularly and ensure that logs are rotated and reviewed frequently: {{cmd|doas logrotate /etc/logrotate.conf}}
  sudo logrotate /etc/logrotate.conf
  ```


### Conclusion
== Conclusion ==


This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.
This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.
[[Category:Security]]

Latest revision as of 06:02, 11 May 2025

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

Update and upgrade system

1. Update package lists:

doas apk update

2. Upgrade installed packages:

doas apk upgrade

Install necessary security tools

1. Install the audit package:

doas apk add audit

2. Install other necessary security packages:

doas apk add doas logrotate bash-completion openssh-server

User and access management

1. Disable root login over SSH:

Edit /etc/ssh/sshd_config and Set the following parameter as follows

Contents of /etc/ssh/sshd_config

... PermitRootLogin no

2. Ensure password complexity:

Edit /etc/security/pwquality.conf and add or update the following lines:

Contents of /etc/security/pwquality.conf

... minlen = 14 dcredit = -1 ucredit = -1 ocredit = -1 lcredit = -1

3. Lock unused system accounts by running the following script: 

  for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
      if [ $user != "root" ]; then
          doas passwd -l $user
          doas chage -E 0 $user
      fi
  done

File system and directory permissions

1. Set appropriate permissions on important directories:

doas chmod 700 /root doas chmod 600 /boot/grub/grub.cfg doas chmod 600 /etc/ssh/sshd_config

2. Configure mount options:

Edit /etc/fstab and Add `nosuid`, `nodev`, and `noexec` options to non-root partitions as follows:

Contents of /etc/fstab

... /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2 ...

Network security

1. Disable unnecessary services:

doas rc-update del <service_name> doas rc-service <service_name> stop

2. Configure iptables firewall by installing and enabling it as follows:

doas apk add iptables doas rc-service iptables start doas rc-update add iptables

Create a basic firewall ruleset by adding Example rules to /etc/iptables/rules.v4 as follows:

Contents of /etc/iptables/rules.v4

*filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp --dport 22 -j ACCEPT COMMIT

Logging and auditing

1. Configure system logging by editing /etc/rsyslog.conf to ensure all log files are being captured. An example configuration is shown below:

Contents of /etc/rsyslog.conf

*.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron

2. Set up audit rules by editing the /etc/audit/rules.d/audit.rules files and adding example rules as follows:

Contents of /etc/audit/rules.d/audit.rules

-w /etc/passwd -p wa -k passwd_changes -w /etc/shadow -p wa -k shadow_changes -w /etc/group -p wa -k group_changes

Apply kernel and service hardening

1. Disable unused filesystems by editing /etc/modprobe.d/disable-filesystems.conf and add the following lines:

Contents of /etc/modprobe.d/disable-filesystems.conf

install cramfs /bin/true install freevxfs /bin/true install jffs2 /bin/true install hfs /bin/true install hfsplus /bin/true install squashfs /bin/true install udf /bin/true install vfat /bin/true

2. Configure kernel parameters by editing the /etc/sysctl.conf and adding or updating the following parameters:

Contents of /etc/sysctl.conf

net.ipv4.ip_forward = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 net.ipv4.icmp_echo_ignore_broadcasts = 1 net.ipv4.icmp_ignore_bogus_error_responses = 1 net.ipv4.tcp_syncookies = 1 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0

Regular maintenance

1. Set up regular updates by creating a cron job by editing crontab using the command crontab -e such that updates are applied daily at 2 AM. The output of crontab -l appears as follows:

Contents of /var/spool/cron/crontabs/root

... 0 2 * * * apk update && apk upgrade

2. Review and monitor logs regularly and ensure that logs are rotated and reviewed frequently:

doas logrotate /etc/logrotate.conf

Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Retrieved from "https://wiki.alpinelinux.org/w/index.php?title=Securing_Alpine_Linux&oldid=29849"