Red Hat Enterprise Linux 8 Security hardening

Table of Contents
PROVIDING FEEDBACK ON RED HAT DOCUMENTATION
CHAPTER 1. OVERVIEW OF SECURITY HARDENING IN RHEL
	1.1. WHAT IS COMPUTER SECURITY?
	1.2. STANDARDIZING SECURITY
	1.3. CRYPTOGRAPHIC SOFTWARE AND CERTIFICATIONS
	1.4. SECURITY CONTROLS
		1.4.1. Physical controls
		1.4.2. Technical controls
		1.4.3. Administrative controls
	1.5. VULNERABILITY ASSESSMENT
		1.5.1. Defining assessment and testing
		1.5.2. Establishing a methodology for vulnerability assessment
		1.5.3. Vulnerability assessment tools
	1.6. SECURITY THREATS
		1.6.1. Threats to network security
		1.6.2. Threats to server security
		1.6.3. Threats to workstation and home PC security
	1.7. COMMON EXPLOITS AND ATTACKS
CHAPTER 2. SECURING RHEL DURING INSTALLATION
	2.1. BIOS AND UEFI SECURITY
		2.1.1. BIOS passwords
			2.1.1.1. Non-BIOS-based systems security
	2.2. DISK PARTITIONING
	2.3. RESTRICTING NETWORK CONNECTIVITY DURING THE INSTALLATION PROCESS
	2.4. INSTALLING THE MINIMUM AMOUNT OF PACKAGES REQUIRED
	2.5. POST-INSTALLATION PROCEDURES
CHAPTER 3. USING SYSTEM-WIDE CRYPTOGRAPHIC POLICIES
	3.1. SYSTEM-WIDE CRYPTOGRAPHIC POLICIES
		Tool for managing crypto policies
		Strong crypto defaults by removing insecure cipher suites and protocols
		Cipher suites and protocols disabled in all policy levels
		Cipher suites and protocols enabled in the crypto-policies levels
	3.2. SWITCHING THE SYSTEM-WIDE CRYPTOGRAPHIC POLICY TO MODE COMPATIBLE WITH EARLIER RELEASES
	3.3. SWITCHING THE SYSTEM TO FIPS MODE
	3.4. ENABLING FIPS MODE IN A CONTAINER
	3.5. EXCLUDING AN APPLICATION FROM FOLLOWING SYSTEM-WIDE CRYPTO POLICIES
		3.5.1. Examples of opting out of system-wide crypto policies
	3.6. CUSTOMIZING SYSTEM-WIDE CRYPTOGRAPHIC POLICIES WITH POLICY MODIFIERS
	3.7. CREATING AND SETTING A CUSTOM SYSTEM-WIDE CRYPTOGRAPHIC POLICY
	3.8. RELATED INFORMATION
CHAPTER 4. CONFIGURING APPLICATIONS TO USE CRYPTOGRAPHIC HARDWARE THROUGH PKCS #11
	4.1. CRYPTOGRAPHIC HARDWARE SUPPORT THROUGH PKCS #11
	4.2. USING SSH KEYS STORED ON A SMART CARD
	4.3. USING HSMS PROTECTING PRIVATE KEYS IN APACHE AND NGINX
	4.4. CONFIGURING APPLICATIONS TO AUTHENTICATE USING CERTIFICATES FROM SMART CARDS
	4.5. RELATED INFORMATION
CHAPTER 5. USING SHARED SYSTEM CERTIFICATES
	5.1. THE SYSTEM-WIDE TRUST STORE
	5.2. ADDING NEW CERTIFICATES
	5.3. MANAGING TRUSTED SYSTEM CERTIFICATES
	5.4. RELATED INFORMATION
CHAPTER 6. SCANNING THE SYSTEM FOR CONFIGURATION COMPLIANCE AND VULNERABILITIES
	6.1. CONFIGURATION COMPLIANCE TOOLS IN RHEL
	6.2. VULNERABILITY SCANNING
		6.2.1. Red Hat Security Advisories OVAL feed
		6.2.2. Scanning the system for vulnerabilities
		6.2.3. Scanning remote systems for vulnerabilities
	6.3. CONFIGURATION COMPLIANCE SCANNING
		6.3.1. Configuration compliance in RHEL 8
		6.3.2. Possible results of an OpenSCAP scan
		6.3.3. Viewing profiles for configuration compliance
		6.3.4. Assessing configuration compliance with a specific baseline
	6.4. REMEDIATING THE SYSTEM TO ALIGN WITH A SPECIFIC BASELINE
	6.5. REMEDIATING THE SYSTEM TO ALIGN WITH A SPECIFIC BASELINE USING THE SSG ANSIBLE PLAYBOOK
	6.6. CREATING A REMEDIATION ANSIBLE PLAYBOOK TO ALIGN THE SYSTEM WITH A SPECIFIC BASELINE
	6.7. CREATING A REMEDIATION BASH SCRIPT FOR A LATER APPLICATION
	6.8. SCANNING THE SYSTEM WITH A CUSTOMIZED PROFILE USING SCAP WORKBENCH
		6.8.1. Using SCAP Workbench to scan and remediate the system
		6.8.2. Customizing a security profile with SCAP Workbench
		6.8.3. Related information
	6.9. DEPLOYING SYSTEMS THAT ARE COMPLIANT WITH A SECURITY PROFILE IMMEDIATELY AFTER AN INSTALLATION
		6.9.1. Deploying baseline-compliant RHEL systems using the graphical installation
		6.9.2. Deploying baseline-compliant RHEL systems using Kickstart
	6.10. SCANNING CONTAINER AND CONTAINER IMAGES FOR VULNERABILITIES
	6.11. ASSESSING SECURITY COMPLIANCE OF A CONTAINER OR A CONTAINER IMAGE WITH A SPECIFIC BASELINE
	6.12. SUPPORTED VERSIONS OF THE SCAP SECURITY GUIDE IN RHEL
	6.13. RELATED INFORMATION
CHAPTER 7. CHECKING INTEGRITY WITH AIDE
	7.1. INSTALLING AIDE
	7.2. PERFORMING INTEGRITY CHECKS WITH AIDE
	7.3. UPDATING AN AIDE DATABASE
	7.4. RELATED INFORMATION
CHAPTER 8. ENCRYPTING BLOCK DEVICES USING LUKS
	8.1. LUKS DISK ENCRYPTION
	8.2. LUKS VERSIONS IN RHEL 8
	8.3. OPTIONS FOR DATA PROTECTION DURING LUKS2 RE-ENCRYPTION
	8.4. ENCRYPTING EXISTING DATA ON A BLOCK DEVICE USING LUKS2
	8.5. ENCRYPTING EXISTING DATA ON A BLOCK DEVICE USING LUKS2 WITH A DETACHED HEADER
	8.6. ENCRYPTING A BLANK BLOCK DEVICE USING LUKS2
CHAPTER 9. CONFIGURING AUTOMATED UNLOCKING OF ENCRYPTED VOLUMES USING POLICY-BASED DECRYPTION
	9.1. NETWORK-BOUND DISK ENCRYPTION
	9.2. INSTALLING AN ENCRYPTION CLIENT - CLEVIS
	9.3. DEPLOYING A TANG SERVER WITH SELINUX IN ENFORCING MODE
	9.4. ROTATING TANG SERVER KEYS AND UPDATING BINDINGS ON CLIENTS
	9.5. DEPLOYING AN ENCRYPTION CLIENT FOR AN NBDE SYSTEM WITH TANG
	9.6. REMOVING A CLEVIS PIN FROM A LUKS-ENCRYPTED VOLUME MANUALLY
	9.7. DEPLOYING AN ENCRYPTION CLIENT WITH A TPM 2.0 POLICY
	9.8. CONFIGURING MANUAL ENROLLMENT OF LUKS-ENCRYPTED VOLUMES
	9.9. CONFIGURING AUTOMATED ENROLLMENT OF LUKS-ENCRYPTED VOLUMES USING KICKSTART
	9.10. CONFIGURING AUTOMATED UNLOCKING OF A LUKS-ENCRYPTED REMOVABLE STORAGE DEVICE
	9.11. DEPLOYING HIGH-AVAILABILITY NBDE SYSTEMS
		9.11.1. High-available NBDE using Shamir’s Secret Sharing
			9.11.1.1. Example 1: Redundancy with two Tang servers
			9.11.1.2. Example 2: Shared secret on a Tang server and a TPM device
	9.12. DEPLOYMENT OF VIRTUAL MACHINES IN A NBDE NETWORK
	9.13. BUILDING AUTOMATICALLY-ENROLLABLE VM IMAGES FOR CLOUD ENVIRONMENTS USING NBDE
	9.14. ADDITIONAL RESOURCES
CHAPTER 10. AUDITING THE SYSTEM
	10.1. LINUX AUDIT
	10.2. AUDIT SYSTEM ARCHITECTURE
	10.3. CONFIGURING AUDITD FOR A SECURE ENVIRONMENT
	10.4. STARTING AND CONTROLLING AUDITD
	10.5. UNDERSTANDING AUDIT LOG FILES
	10.6. USING AUDITCTL FOR DEFINING AND EXECUTING AUDIT RULES
	10.7. DEFINING PERSISTENT AUDIT RULES
	10.8. USING PRE-CONFIGURED RULES FILES
	10.9. USING AUGENRULES TO DEFINE PERSISTENT RULES
	10.10. DISABLING AUGENRULES
	10.11. RELATED INFORMATION
CHAPTER 11. CONFIGURING AND MANAGING APPLICATION WHITELISTS
	11.1. APPLICATION WHITELISTING IN RHEL
	11.2. DEPLOYING APPLICATION WHITELISTING
	11.3. ADDING CUSTOM RULES FOR APPLICATION WHITELISTING
	11.4. TROUBLESHOOTING RHEL APPLICATION WHITELISTING
	11.5. ADDITIONAL RESOURCES
CHAPTER 12. PROTECTING SYSTEMS AGAINST INTRUSIVE USB DEVICES
	12.1. USBGUARD
	12.2. INSTALLING USBGUARD
	12.3. BLOCKING AND AUTHORIZING A USB DEVICE USING CLI
	12.4. CREATING A CUSTOM POLICY FOR USB DEVICES
	12.5. AUTHORIZING USERS AND GROUPS TO USE THE USBGUARD IPC INTERFACE
	12.6. LOGGING USBGUARD AUTHORIZATION EVENTS TO THE LINUX AUDIT LOG
	12.7. ADDITIONAL RESOURCES