2

I have a VPS CentOS 6 Linux web server. It is run on KVM.

Running a Lynis audit, it notes that single user mode and GRUB are not protected by any password/authentication:

[16:00:28] Warning: No password set for single mode [AUTH-9308]
[15:59:26] Suggestion: Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password) [BOOT-5122]

Additionally Lynis mentions storage drives as well:

[16:05:09] Suggestion: Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft [STRG-1840]
[16:05:09] Suggestion: Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft [STRG-1846]

As this is a virtualised Linux instance and is a server, would taking action on the points raised above be actually beneficial? Would adding authentication mechanisms to single user mode and GRUB actually cause problems during boot (particularly with GRUB) as its a virtualised server not a typical Linux Desktop client, though Lynis obviously doesn't know that.

I'm not sure if Lynis is coming from a server configuration perspective and that's where my confusion lies.

Any clarification on the points highlighted would be appreciated!

Thanks,

1 Answer 1

2

You can use my centos-6.x-harden.sh I made for general hardening, which

#!/bin/bash
echo "readonly TMOUT=900" >> /etc/profile.d/os-sec.sh
echo "readonly HISTFILE" >> /etc/profile.d/os-sec.sh
chmod +x /etc/profile.d/os-sec.sh
echo "tty1" > /etc/securetty
chmod 700 /root
echo "blacklist usb-storage" > /etc/modprobe.d/blacklist-usbstorage
cat << EOF > /etc/sysconfig/init 
BOOTUP=color
RES_COL=60
MOVE_TO_COL="echo -en \\033[${RES_COL}G"
SETCOLOR_SUCCESS="echo -en \\033[0;32m"
SETCOLOR_FAILURE="echo -en \\033[0;31m"
SETCOLOR_WARNING="echo -en \\033[0;33m"
SETCOLOR_NORMAL="echo -en \\033[0;39m"
PROMPT=no
AUTOSWAP=no
ACTIVE_CONSOLES=/dev/tty[1-6]
SINGLE=/sbin/sulogin
EOF
cat << EOF > /etc/init/control-alt-delete.override
start on control-alt-delete
exec /usr/bin/logger -p authpriv.notice -t init "Ctrl-Alt-Del was pressed and ignored"
EOF
cat << EOF > /tmp/grub.patch
--- grub.conf   2014-11-09 13:43:45.085378787 +0330
+++ grub.conf.new       2014-11-09 13:43:48.508377857 +0330
@@ -9,6 +9,7 @@
default=0
timeout=5
+password --md5 \$1\$T.IYz1\$wLQ21IjrUuMeLfkGd1Xby0
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
hiddenmenu
EOF
patch -s /boot/grub/grub.conf < /tmp/grub.patch
# alternate to the latter patch is: echo 'password --md5 $1$T.IYz1$wLQ21IjrUuMeLfkGd1Xby0' >>      /boot/grub/grub.conf
  1. Protects shell, if I left the terminal open.
  2. Protects in case of terminal bruteforce.
  3. Protects single user mode, by making user provide root password
  4. Protects GRUB menu, by mandating the password.
  5. Protects system by disabling alt-ctrl-delete based reboot.

** please consider changing md5 hash for your desirable password.

2
  • Thanks for posting your script. I'm aware of how to carry out the changes Lynis is recommending, I'm am more concerned of said changes being appropriate for the mentioned setup and environment. Commented Jun 17, 2015 at 17:29
  • Actually I use Lynis in server env, no problems. These are less popular in desktop env. You can check SANS, GIAS, Redhat and IBM open guides in this matter. google.com/… Commented Jun 17, 2015 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .