Creating a Linux Agent Image

Preparing an ECS

Prepare a Linux ECS using a public image.

Set a password for the ECS. Install Python 3 on the ECS if it is not included in the public image.

Preparing Scripts

For details, see Creating Scripts in Agent Images.

Modifying the ECS

1. Install necessary components.
   Install Python dependencies. Below is just an example. Install the latest version of Python.

   yum install python36
   ln -s /usr/bin/python36 /usr/bin/python3
   yum install python36-setuptools
   wget https://files.pythonhosted.org/packages/ae/e8/2340d46ecadb1692a1e455f13f75e596d4eab3d11a57446f08259dee8f02/pip-10.0.1.tar.gz
   tar xvf pip-10.0.1.tar.gz
   cd pip-10.0.1
   python3 setup.py install
   pip3 install requests

2. Modify the /etc/rc.local file.

   ln -s /etc/rc.d/rc.local /etc/rc.local     #In some public images, /etc/rc.local may not be properly linked to /etc/rc.d/rc.local, which can result in the rc.local script not being executed during the startup.
   chmod 766 /etc/rc.d/rc.local

3. Install basic system components.

   yum install expect
   yum install lvm2
   yum install dosfstools      #mkfs.vfat is supported.
   rpm -ivh grub-0.97-99.el6.x86_64.rpm      #This component is only needed when the servers to be migrated use GRUB 1. Download this component at the GRUB official website.

4. Modify /etc/mke2fs.conf.

   Delete 64bit from the ext4 item. Otherwise, GRUB 1 may fail to be installed on an Ext4 file system.

   

5. Change partition UUIDs.
   1. Detach the system disk from the ECS and attach it to a temporary ECS as a data disk.
   2. On the temporary ECS, use uuidgen to generate new UUIDs and use tune2fs –U to assign new UUIDs to partitions.
      1. Run the blkid command on the temporary ECS to query the UUID of each partition.

         

      2. Run the uuidgen command to generate a new UUID.

         

      3. Run the tune2fs -U <new_UUID> <device> or xfs_admin -U <new_UUID> <device> command to assign the new UUID to a partition.

         

      4. Change the UUID of the partition in /etc/fstab and /boot/grub2/grub.cfg to the newly assigned UUID.

         If partition UUIDs change, you must update the corresponding UUIDs in /etc/fstab and /boot/grub2/grub.cfg. Otherwise, the system may fail to boot.

      5. Attach the disk back to the original ECS as the system disk and test whether the OS can start up.

6. Transfer the smsMetadataAgent folder where stores the necessary scripts to the ECS and enable these scripts to automatically run at startup. For details, see Creating Scripts in Agent Images.
7. Modify the sshd configuration file to disable password login.
8. Delete residual settings. Ensure that there is no /data directory, there are no SMS log files in the /root directory, and there are no residual certificates in the /etc/ssh directory.

(Optional) Hardening Security

1. Add the following content to the sshd_config file.

   MaxAuthTries 6
   LoginGraceTime 60
   PasswordAuthentication no

2. Disable history.
   1. Start the terminal and run the following command:

      sudo nano ~/.bashrc

   2. Add the following content to the end of the file:

      unset HISTFILE

   3. Save the file and exit. Run the following command for the modification to take effect:

      source ~/.bashrc

3. Prevent brute-force attacks.

   Add the content below to the /etc/pam.d/password-auth file. The content is contained in Huawei Cloud EulerOS by default.

   auth sufficient pam_faillock.so authsucc audit deny=3 even_deny_root unlock_time=60

   This can prevent any user from login for 30 seconds after 3 failed login attempts.

4. Set the password complexity requirements.

   In the /etc/pam.d/system-auth file, append enforce_for_root minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 to the end of the row that starts with password requisite pam_pwquality.so try_first_pass.

   password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root minlen=8 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1

5. Change the umask value to 027. The umask command is used to set the default permissions on files and directories.
   1. Open the terminal and run the following command to open the .bashrc file:

      nano ~/.bashrc

   2. Add the following content to the end of the file:

      umask 027

   3. Save and close the file. Run the following command to make the change take effect:

      source ~/.bashrc

6. Delete residual system tools because keeping them only increases the attack surface of the system and mislead security software.

   Delete the following residual tools:

   • tcpdump, sniffer, Wireshark, Netcat, and other WinPcap-based sniffing tools
   • gdb, strace, readelf, cpp, gcc, dexdump, mirror, JDK, and other self-developed tools or scripts used only in the development and debugging phase

Creating an Image

1. Sign in to the Huawei Cloud console, search for IMS, and access the IMS console.
2. Click Create Image.

   

3. Create a system disk image from the ECS as prompted.

   

   

4. Obtain the ID of the created image.