Linux/RHEL
From Bibliotheca Anonoma
Red Hat Enterprise Linux (and it's open-source clone, CentOS) is a popular Linux distribtuion targeting the corporate server market.
Facts
- RHEL and CentOS are effectively interchangeable when it comes to support instructions.
- RHEL offers an extended support level for corporations, though when it comes to us we take care of our own servers.
- RHEL uses the YUM package manager, and RPMs as package files.
- RHEL 7 will remain supported as the main version until 2019.
- SELinux is used as the primary Mandatory Access Control System.
- Systemd is used as the primary initscript system.
Initial Setup
- Set up a as admin with sudo and ssh key, as well as any other users. Also set up a password (it's like a PIN, last line of defense against privilege escalation).
- Do not allow root user login via SSH. If this is enabled, disable it.
- For AWS, The private key created by Amazon should only be used in case of emergency by the effective owner (if other admins forget their passphrases or passwords).
- Change the hostname to the current one using hostnamectl.
- Set up the EPEL repository.
- Install Byobu, and enable it for all new users.
- Set up Nginx and also Server Blocks to make things easier.
Hardening
- Part 1: Basic Bare Metal Security - Fix the gaping holes in security in hardware and system setup before moving on to the software fixes.
- Part 2: Advanced Software Security - Software level methods to harden CentOS
RHEL
On Red Hat, you will want to utilize package subscription channels. CentOS's corresponding elements are EPEL.
https://access.redhat.com/solutions/265523
yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional