Securing Alpine Linux: Difference between revisions

From Alpine Linux
(Securing Alpine Linux using Security Technical Implementation Guides (STIGs))
 
m (Added category. fixed headings as per wiki guidelines)
 
(6 intermediate revisions by 3 users not shown)
Line 1: Line 1:
Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:
Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:


### Step 1: Update and Upgrade System
== Step 1: Update and Upgrade System ==


1. **Update package lists:**
1. Update package lists:
  ```sh
  sudo apk update
  ```


2. **Upgrade installed packages:**
   {{cmd|doas apk update}}
   ```sh
  sudo apk upgrade
  ```


### Step 2: Install Necessary Security Tools


1. **Install `audit` package:**
2. Upgrade installed packages:
  ```sh
  sudo apk add audit
  ```


2. **Install other necessary security packages:**
   {{cmd|doas apk upgrade}}
   ```sh
  sudo apk add sudo logrotate bash-completion openssh-server
  ```


### Step 3: User and Access Management
== Step 2: Install Necessary Security Tools ==


1. **Disable root login over SSH:**
1. Install the {{pkg|audit|arch=}} package:
  Edit `/etc/ssh/sshd_config`:
 
  ```sh
  {{cmd|doas apk add audit}}
   sudo vi /etc/ssh/sshd_config
 
  ```
 
  Set the following parameter:
2. Install other necessary security packages:
  ```sh
 
  PermitRootLogin no
  {{cmd|doas apk add doas logrotate bash-completion openssh-server}}
   ```
 
== Step 3: User and Access Management ==
 
1. Disable root login over SSH:
 
Edit {{path|/etc/ssh/sshd_config}}:
 
   {{cmd|doas vi /etc/ssh/sshd_config}}
 
Set the following parameter:
 
      PermitRootLogin no
 
 
2. Ensure password complexity:
 
Edit {{path|/etc/security/pwquality.conf}}:
 
   {{cmd|doas vi /etc/security/pwquality.conf}}
 
Add or update the following lines:


2. **Ensure password complexity:**
  Edit `/etc/security/pwquality.conf`:
  ```sh
  sudo vi /etc/security/pwquality.conf
  ```
  Add or update the following lines:
  ```sh
   minlen = 14
   minlen = 14
   dcredit = -1
   dcredit = -1
Line 49: Line 49:
   ocredit = -1
   ocredit = -1
   lcredit = -1
   lcredit = -1
  ```


3. **Lock unused system accounts:**
 
  ```sh
3. Lock unused system accounts:
 
   for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
   for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
       if [ $user != "root" ]; then
       if [ $user !{{=}} "root" ]; then
           sudo passwd -l $user
           doas passwd -l $user
           sudo chage -E 0 $user
           doas chage -E 0 $user
       fi
       fi
   done
   done
  ```


### Step 4: File System and Directory Permissions
== Step 4: File System and Directory Permissions ==
 
1. Set appropriate permissions on important directories:
 
  doas chmod 700 /root
  doas chmod 600 /boot/grub/grub.cfg
  doas chmod 600 /etc/ssh/sshd_config
 
 
2. Configure mount options:
 
Edit {{path|/etc/fstab}}:
 
  {{cmd|doas vi /etc/fstab}}


1. **Set appropriate permissions on important directories:**
Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
  ```sh
  sudo chmod 700 /root
  sudo chmod 600 /boot/grub/grub.cfg
  sudo chmod 600 /etc/ssh/sshd_config
  ```


2. **Configure mount options:**
  Edit `/etc/fstab`:
  ```sh
  sudo vi /etc/fstab
  ```
  Add `nosuid`, `nodev`, and `noexec` options to non-root partitions:
  ```sh
   /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
   /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2
  ```


### Step 5: Network Security
== Step 5: Network Security ==
 
1. Disable unnecessary services:


1. **Disable unnecessary services:**
   {{cmd|doas rc-update del <service_name>
   ```sh
   doas rc-service <service_name> stop}}
  sudo rc-update del <service_name>
   sudo rc-service <service_name> stop
  ```


2. **Configure firewall (iptables):**
  ```sh
  sudo apk add iptables
  sudo rc-service iptables start
  sudo rc-update add iptables
  ```


   Create a basic firewall ruleset:
2. Configure firewall (iptables):
  ```sh
 
   sudo vi /etc/iptables/rules.v4
  {{cmd|doas apk add iptables
  ```
  doas rc-service iptables start
  Example rules:
   doas rc-update add iptables}}
  ```sh
 
 
Create a basic firewall ruleset:
 
   {{cmd|doas vi /etc/iptables/rules.v4}}
 
Example rules:
 
   *filter
   *filter
   :INPUT DROP [0:0]
   :INPUT DROP [0:0]
Line 109: Line 108:
   -A INPUT -p tcp --dport 22 -j ACCEPT
   -A INPUT -p tcp --dport 22 -j ACCEPT
   COMMIT
   COMMIT
  ```


### Step 6: Logging and Auditing
== Step 6: Logging and Auditing ==
 
1. Configure system logging:
 
Edit {{path|/etc/rsyslog.conf}} to ensure all log files are being captured:
 
  {{cmd|doas vi /etc/rsyslog.conf}}
 
Example configuration:


1. **Configure system logging:**
  Edit `/etc/rsyslog.conf` to ensure all log files are being captured:
  ```sh
  sudo vi /etc/rsyslog.conf
  ```
  Example configuration:
  ```sh
   *.info;mail.none;authpriv.none;cron.none /var/log/messages
   *.info;mail.none;authpriv.none;cron.none /var/log/messages
   authpriv.* /var/log/secure
   authpriv.* /var/log/secure
   mail.* -/var/log/maillog
   mail.* -/var/log/maillog
   cron.* /var/log/cron
   cron.* /var/log/cron
  ```


2. **Set up audit rules:**
 
  Edit `/etc/audit/rules.d/audit.rules`:
2. Set up audit rules:
  ```sh
 
   sudo vi /etc/audit/rules.d/audit.rules
Edit {{path|/etc/audit/rules.d/audit.rules}}:
  ```
 
  Example rules:
   {{cmd|doas vi /etc/audit/rules.d/audit.rules}}
  ```sh
 
Example rules:
 
   -w /etc/passwd -p wa -k passwd_changes
   -w /etc/passwd -p wa -k passwd_changes
   -w /etc/shadow -p wa -k shadow_changes
   -w /etc/shadow -p wa -k shadow_changes
   -w /etc/group -p wa -k group_changes
   -w /etc/group -p wa -k group_changes
  ```


### Step 7: Apply Kernel and Service Hardening
== Step 7: Apply Kernel and Service Hardening ==
 
1. Disable unused filesystems:
 
Edit {{path|/etc/modprobe.d/disable-filesystems.conf}}:
 
  {{cmd|doas vi /etc/modprobe.d/disable-filesystems.conf}}
 
Add the following lines:


1. **Disable unused filesystems:**
  Edit `/etc/modprobe.d/disable-filesystems.conf`:
  ```sh
  sudo vi /etc/modprobe.d/disable-filesystems.conf
  ```
  Add the following lines:
  ```sh
   install cramfs /bin/true
   install cramfs /bin/true
   install freevxfs /bin/true
   install freevxfs /bin/true
Line 155: Line 155:
   install udf /bin/true
   install udf /bin/true
   install vfat /bin/true
   install vfat /bin/true
  ```


2. **Configure kernel parameters:**
 
  Edit `/etc/sysctl.conf`:
2. Configure kernel parameters:
  ```sh
 
   sudo vi /etc/sysctl.conf
Edit {{path|/etc/sysctl.conf}}:
  ```
 
  Add or update the following parameters:
   {{cmd|doas vi /etc/sysctl.conf}}
  ```sh
 
Add or update the following parameters:
 
   net.ipv4.ip_forward = 0
   net.ipv4.ip_forward = 0
   net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.all.accept_source_route = 0
Line 175: Line 176:
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
  ```


### Step 8: Regular Maintenance
== Step 8: Regular Maintenance ==
 
1. Set up regular updates:
 
Create a cron job for regular updates:
 
  {{cmd|doas crontab -e}}
 
Add the following line to update daily at 2 AM:


1. **Set up regular updates:**
  Create a cron job for regular updates:
  ```sh
  sudo crontab -e
  ```
  Add the following line to update daily at 2 AM:
  ```sh
   0 2 * * * apk update && apk upgrade
   0 2 * * * apk update && apk upgrade
  ```


2. **Review and monitor logs regularly:**
2. Review and monitor logs regularly:
  Ensure logs are rotated and reviewed frequently:
 
  ```sh
Ensure logs are rotated and reviewed frequently:
  sudo logrotate /etc/logrotate.conf
  ```


### Conclusion
  {{cmd|doas logrotate /etc/logrotate.conf}}
 
== Conclusion ==


This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.
This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.
[[Category:Security]]

Latest revision as of 10:17, 10 October 2024

Securing Alpine Linux using Security Technical Implementation Guides (STIGs) involves several steps. STIGs are a series of security requirements and configurations that help to secure systems. While there might not be a specific STIG for Alpine Linux, you can follow general Linux hardening guidelines and apply the principles from other Linux STIGs. Here’s a step-by-step process:

Step 1: Update and Upgrade System

1. Update package lists:

doas apk update


2. Upgrade installed packages:

doas apk upgrade

Step 2: Install Necessary Security Tools

1. Install the audit package:

doas apk add audit


2. Install other necessary security packages:

doas apk add doas logrotate bash-completion openssh-server

Step 3: User and Access Management

1. Disable root login over SSH:

Edit /etc/ssh/sshd_config:

doas vi /etc/ssh/sshd_config

Set the following parameter: 

      PermitRootLogin no


2. Ensure password complexity:

Edit /etc/security/pwquality.conf:

doas vi /etc/security/pwquality.conf

Add or update the following lines: 

  minlen = 14
  dcredit = -1
  ucredit = -1
  ocredit = -1
  lcredit = -1


3. Lock unused system accounts: 

  for user in `awk -F: '($3 < 1000) {print $1}' /etc/passwd`; do
      if [ $user != "root" ]; then
          doas passwd -l $user
          doas chage -E 0 $user
      fi
  done

Step 4: File System and Directory Permissions

1. Set appropriate permissions on important directories: 

  doas chmod 700 /root
  doas chmod 600 /boot/grub/grub.cfg
  doas chmod 600 /etc/ssh/sshd_config


2. Configure mount options:

Edit /etc/fstab:

doas vi /etc/fstab

Add `nosuid`, `nodev`, and `noexec` options to non-root partitions: 

  /dev/sda1 /home ext4 defaults,nosuid,nodev,noexec 0 2

Step 5: Network Security

1. Disable unnecessary services:

doas rc-update del <service_name> doas rc-service <service_name> stop


2. Configure firewall (iptables):

doas apk add iptables doas rc-service iptables start doas rc-update add iptables


Create a basic firewall ruleset:

doas vi /etc/iptables/rules.v4

Example rules: 

  *filter
  :INPUT DROP [0:0]
  :FORWARD DROP [0:0]
  :OUTPUT ACCEPT [0:0]
  -A INPUT -i lo -j ACCEPT
  -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  -A INPUT -p tcp --dport 22 -j ACCEPT
  COMMIT

Step 6: Logging and Auditing

1. Configure system logging:

Edit /etc/rsyslog.conf to ensure all log files are being captured:

doas vi /etc/rsyslog.conf

Example configuration: 

  *.info;mail.none;authpriv.none;cron.none /var/log/messages
  authpriv.* /var/log/secure
  mail.* -/var/log/maillog
  cron.* /var/log/cron


2. Set up audit rules:

Edit /etc/audit/rules.d/audit.rules:

doas vi /etc/audit/rules.d/audit.rules

Example rules: 

  -w /etc/passwd -p wa -k passwd_changes
  -w /etc/shadow -p wa -k shadow_changes
  -w /etc/group -p wa -k group_changes

Step 7: Apply Kernel and Service Hardening

1. Disable unused filesystems:

Edit /etc/modprobe.d/disable-filesystems.conf:

doas vi /etc/modprobe.d/disable-filesystems.conf

Add the following lines: 

  install cramfs /bin/true
  install freevxfs /bin/true
  install jffs2 /bin/true
  install hfs /bin/true
  install hfsplus /bin/true
  install squashfs /bin/true
  install udf /bin/true
  install vfat /bin/true


2. Configure kernel parameters:

Edit /etc/sysctl.conf:

doas vi /etc/sysctl.conf

Add or update the following parameters: 

  net.ipv4.ip_forward = 0
  net.ipv4.conf.all.accept_source_route = 0
  net.ipv4.conf.all.accept_redirects = 0
  net.ipv4.conf.all.secure_redirects = 0
  net.ipv4.conf.all.log_martians = 1
  net.ipv4.conf.default.log_martians = 1
  net.ipv4.icmp_echo_ignore_broadcasts = 1
  net.ipv4.icmp_ignore_bogus_error_responses = 1
  net.ipv4.tcp_syncookies = 1
  net.ipv4.conf.all.send_redirects = 0
  net.ipv4.conf.default.send_redirects = 0

Step 8: Regular Maintenance

1. Set up regular updates:

Create a cron job for regular updates:

doas crontab -e

Add the following line to update daily at 2 AM: 

  0 2 * * * apk update && apk upgrade

2. Review and monitor logs regularly:

Ensure logs are rotated and reviewed frequently:

doas logrotate /etc/logrotate.conf

Conclusion

This process provides a foundation for securing an Alpine Linux system. Regular reviews and updates, along with compliance with the latest security guidelines, are essential to maintaining a secure environment.

Retrieved from "https://wiki.alpinelinux.org/w/index.php?title=Securing_Alpine_Linux&oldid=27512"