Security Hardening Tools

Overview

HCE 2.0 is a Linux distribution for Huawei Cloud users. By default, security hardening is not performed after the ISO is installed.

security-tool is a Huawei-developed security hardening tool package that meets Huawei's basic security hardening requirements. By default, security-tool is not installed with HCE 2.0. You can install security-tool as required. After security-tool is installed, automatic security hardening is performed when the OS is started for the first time. You can also harden your OS by referring to the Huawei Cloud EulerOS 2.0 Security Configuration Baseline if needed.

For details about security hardening, see the security-tool RPM package. The security hardening items are as follows:

System services: for example, configuring SSH, deleting postfix.service, and enabling haveged.service
Kernel parameters: for example, kernel network protocol stack
Accounts and passwords: for example, PAM parameters
Authorization and authentication: for example, warning banner and umask
File permissions: for example, cron configuration

Using security-tool

Install the security-tool package.
If the package exists in the repository, run the yum command to install it.
```
yum install -y security-tool
```
If no, obtain the security-tool package from the repository on the Huawei Cloud official website.
Specify the type of the configuration to be hardened in the /etc/hce_security/hce_enhance_type.conf file.

There are three types of configurations: cybersecurity (graded protection hardening), hwsecurity (cloud service hardening), and general (general hardening). general is recommended. general is used as an example in the following steps.
```
echo general > /etc/hce_security/hce_enhance_type.conf
```

Start the hce-security service.

systemctl start hce-security

Run the systemctl status hce-security command to check the service status. If the status is active(exited), the security hardening is successful.

For details about security hardening logs, see /var/log/hce_security.log.

You can modify the /etc/hce_security/usr-security.conf file to configure security hardening items. The method of modifying the configuration file is as follows:

########################################################################
#
# HowTo:
#       # delete key, and difference caused by blankspace/tab on key is ignored
#       id@d@file@key
#
#       # modify option: find line started with key, and get the value changed
#       id@m@file@key[@value]
#
#       # modify sub-option: find line started with key, and then change the value of key2 to value2(prepostive separator should not be blank characters) in the line
#       id@M@file@key@key2[@value2]
#
#       # check existence of commands
#       id@which@command1 [command2 ...]
#
#       # execute command on the files found
#       id@find@dir@condition@command
#
#       # any command(with or without parameter), such as 'rm -f','chmod 700','which','touch', used to extend functions, return 0 is ok
#       id@command@file1 [file2 ...]
#
# Notes:
#       1. The comment line should start with '#'
#       2. "value" related with "key" should contain prepositive separator("="," " and so on), if there is any.
#       3. When item starts with "d", "m" or "M", "file" should be a single normal file, otherwise multi-objects(separated by blankspace) are allowed.
#
########################################################################

If you want to harden the security for more items, refer to Huawei Cloud EulerOS 2.0 Security Configuration Baseline or other Huawei Cloud OS security hardening specifications.

Enabling SELinux affects system performance. SELinux is disabled in HCE by default. To enable SELinux, you need to restart the OS for multiple times. SELinux cannot be enabled in one click. For details about how to enable SELinux, see How Do I Enable SELinux on an ECS Running HCE?

Differences Between general, hwsecurity, and cybersecurity

Check Item Type	Check Item	Check Content	general	hwsecurity	cybersecurity	Satisfied by Default
Initial configuration	File system configuration	Partition key system directories for mounting.	-	-	-	No
		Ensure that unnecessary file systems are disabled.	-	-	-	No
		Ensure that partitions that do not need to be modified are mounted as read-only.	-	-	-	No
		Ensure that partitions that do not need to be mounted with devices are mounted in nodev mode.	-	-	-	No
		Ensure that partitions without executable files are mounted in noexec mode.	-	-	-	No
		Ensure that partitions that do not require SUID/SGID are mounted in nosuid mode.	-	-	-	No
		Avoid using USB storage.	√	-	-	Yes
	Software service configuration	Forbid the installation of the X Window System (X11, or simply X).	-	-	-	Yes
		Disable the debug-shell service.	√	-	-	Yes
		Disable the rsync service.	√	-	-	Yes
		Disable the avahi service.	√	√	-	Yes
		Disable the SNMP service.	√	√	-	Yes
		Disable the squid service.	√	√	-	Yes
		Avoid enabling the samba service.	√	√	-	Yes
		Disable the FTP service.	√	√	-	Yes
		Disable the TFTP service.	√	√	-	Yes
		Disable the DNS service.	√	-	-	Yes
		Disable the NFS service.	√	√	-	Yes
		Disable the rpcbind service.	√	√	√	No
		Disable the LDAP service.	√	√	-	Yes
		Disable the DHCP service.	√	√	-	Yes
		Do not install the CUPS software.	-	-	-	Yes
		Do not install the NIS software.	-	-	-	Yes
		Do not install the Telnet software.	-	-	-	Yes
		Do not install the NIS client.	-	-	-	Yes
		Do not install the LDAP client.	-	-	-	Yes
		Do not install debugging tools.	-	-	-	Yes
		Do not install development and compilation tools.	-	-	-	Yes
		Do not install network sniffing tools.	-	-	-	Yes
	Software upgrade configuration	Ensure that the GNU Privacy Guard (GPG) public key is configured.	-	-	-	Yes
		Ensure that gpgcheck is enabled.	-	-	-	Yes
		Ensure that the software repository source is configured.	-	-	-	Yes
	File integrity check	Ensure that the Advanced Intrusion Detection Environment (AIDE) is installed.	-	-	-	No
	File integrity check	Set periodic file integrity check.	-	-	-	No
	Common process hardening	Ensure that address space layout randomization (ASLR) is enabled.	√	-	-	Yes
		Ensure that core dumps are correctly configured.	√	-	-	Yes
		Restrict the number of files that can be opened by users.	-	-	-	No
		Ensure that link file protection is correctly configured.	√	-	-	Yes
		Ensure that the dmesg access permission is correctly configured.	√	√	-	No
		Ensure that access to the kernel symbol address is restricted.	√	√	-	Yes
		Restrict the ptrace for processes.	-	-	-	No
		Do not set the global encryption policy to LEGACY.	-	-	-	Yes
System services	Time synchronization service	Configure the ntpd service correctly.	-	-	-	No
	Time synchronization service	Configure the chronyd service correctly.	-	-	-	Yes
	Cron service	Ensure that the cron service is running normally.	√	-	-	Yes
	Cron service	Ensure that the cron configuration permission is correct.	√	√	-	No
	Secure Shell (SSH) service	Ensure that the /etc/ssh/sshd_config permission is correctly configured.	√	√	-	Yes
		Ensure that the permission on the SSH private key file is correctly configured.	√	√	√	No
		Ensure that the permission on the SSH public key file is correctly configured.	√	√	√	No
		Ensure that IgnoreRhosts is enabled.	√	-	-	Yes
		Configure the authentication blacklist and whitelist correctly.	-	-	-	No
		Ensure that Privileged Access Management (PAM) authentication is enabled for SSH.	√	-	-	Yes
		Forbid login as user root.	-	-	√	No
		Forbid login using an empty password.	√	-	-	Yes
		Forbid host-based authentication.	√	-	-	Yes
		Ensure that the warning banner file path is configured.	√	√	-	No
		Ensure that the SSH log level is correctly configured.	√	√	-	Yes
		Configure the listening IP address of the SSH service.	-	-	-	No
		Configure an appropriate number of concurrent unauthenticated SSH connections.	√	-	-	No
		Forbid X11 forwarding.	√	√	-	No
		Set the value of SSH MaxSessions less than or equal to 10.	√	-	-	Yes
		Ensure that MaxAuthTries is correctly configured.	√	-	-	No
		Forbid PermitUserEnvironment.	√	-	-	Yes
		Set the value of LoginGraceTime less than or equal to 60 seconds.	√	√	-	No
		Ensure that the idle timeout is configured.	√	√	-	No
		Forbid AllowTcpForwarding.	√	√	-	No
		Ensure that strong SSH key exchange algorithms (KexAlgorithms) are configured.	√	√	-	Yes
		Ensure that strong SSH message authentication codes (MACs) are configured.	√	√	-	Yes
		Ensure that strong SSH Ciphers are configured.	√	√	-	Yes
		Do not configure the options that will be discarded by SSH.	√	-	-	Yes
Network services	Unused network protocols and devices	Avoid using uncommon network services.	-	-	-	No
	Unused network protocols and devices	Avoid using WLANs.	-	-	-	Yes
	Network protocol stack in the kernel space	Disable the system from responding to ICMP broadcast packets.	√	√	-	Yes
		Do not receive ICMP redirect messages.	√	√	-	No
		Do not forward ICMP redirect messages.	√	-	-	Yes
		Ignore all ICMP requests.	-	-	-	No
		Ensure that forged ICMP packets are ignored.	√	-	-	Yes
		Ensure that reverse address filtering is enabled.	√	√	-	No
		Disable IP forwarding.	√	√	-	Yes
		Disable the option of receiving source route packets.	√	√	-	No
		Ensure that TCP-SYN cookie protection is enabled.	√	√	-	Yes
		Enable logging to record suspicious network packets.	√	-	-	No
		Do not enable tcp_timestamps.	-	-	-	No
		Ensure that TIME_WAIT for TCP is configured.	√	-	-	Yes
		Ensure that the number of queues in the SYN_RECV state is correctly configured	-	-	-	No
		Do not use the ARP proxy.	-	-	-	Yes
Firewall configuration	firewalld	Enable the firewalld service.	-	-	-	Yes
		Ensure that iptables is not enabled.	-	-	-	Yes
		Ensure that nftables is not enabled.	-	-	-	Yes
		Configure valid default zones.	-	-	-	No
		Ensure that the network interfaces are bound to the correct zones.	-	-	-	No
		Avoid enabling unnecessary services and ports.	-	-	-	No
	iptables	Enable the iptables service.	-	-	-	No
		Ensure that iptables is not enabled.	-	-	-	No
		Ensure that nftables is not enabled.	-	-	-	Yes
		Configure the default rejection policy.	-	-	-	No
		Configure the iptables loopback policy.	-	-	-	No
		Configure the iptables INPUT policy.	-	-	-	No
		Configure the iptables OUTPUT policy.	-	-	-	No
		Configure association policies for the iptables INPUT and OUTPUT.	-	-	-	No
	nftables	Enable the nftables service.	-	-	-	No
		Ensure that iptables is not enabled.	-	-	-	Yes
		Ensure that nftables is not enabled.	-	-	-	No
		Configure the default rejection policy.	-	-	-	No
		Configure the nftables loopback policy.	-	-	-	No
		Configure the nftables INPUT policy.	-	-	-	No
		Configure the nftables OUTPUT policy.	-	-	-	No
		Configure association policies for the nftables INPUT and OUTPUT.	-	-	-	No
Log auditing	auditd	Ensure that auditd is enabled.	√	-	-	Yes
		Ensure that auditd can be enabled when the system boots.	-	-	-	No
		Ensure that audit_backlog_limit is correctly configured.	-	-	-	No
		Ensure that the maximum size of a single log file is specified.	-	-	-	Yes
		Ensuring that ROTATE is enabled for audit logs.	-	-	-	No
		Ensure that audit logs are not automatically deleted.	-	-	-	Yes
		Ensure that disk space thresholds are correctly configured.	-	-	-	Yes
		Avoid setting a small rate limit threshold for audit logs.	-	-	-	Yes
		Configure the sudoers audit rule.	-	√	√	No
		Configure a login audit rule.	-	-	-	Yes
		Configure a session audit rule.	-	-	-	Yes
		Configure an audit rule for time change.	-	√	√	No
		Configure an SELinux audit rule.	-	-	-	No
		Configure an audit rule for the network environment.	-	-	√	No
		Configure an audit rule for file access control permissions.	-	-	-	No
		Configure an audit rule for file access failures.	-	-	-	No
		Configure an audit rule for file deletions.	-	-	-	No
		Configure an audit rule for account information modifications.	-	√	√	No
		Configure an audit rule for file system mounting.	-	-	-	No
		Configure the audit rule for privilege escalation commands.	-	-	-	No
		Ensure that the audit rule for kernel module changes.	-	-	-	Yes
		Configure an audit rule for sudo log file modifications.	-	-	-	No
	rsyslog	Ensure that the rsyslog service is enabled.	√	√	√	No
		Ensure that system authentication-related events are recorded.	-	-	-	Yes
		Ensure that cron logs are recorded.	√	-	-	Yes
		Configure the log records of each service correctly.	-	-	-	Yes
		Configure the default rsyslog file permission correctly.	√	√	√	No
		Configure a rotation policy for rsyslog.	-	-	-	No
		Configure the option of sending logs to a remote log server.	-	-	-	No
		Ensure that remote rsyslog messages are received only on the specified log host.	-	-	-	No
		Ensure that the option of dumping journald logs of the rsyslog service has been configured.	-	-	-	No
Account and password management	Account management	Forbid login capabilities for accounts that are not used for login.	-	-	-	No
		Forbid unused accounts.	-	-	-	No
		Set the account validity period correctly.	-	-	-	No
		Forbid non-root accounts with UID 0.	-	-	-	Yes
		Ensure that the UIDs are unique.	-	-	-	Yes
		Ensure that the GIDs are unique.	-	-	-	Yes
		Ensure that the account names are unique.	-	-	-	Yes
		Ensure that the group names are unique.	-	-	-	Yes
		Ensure that all groups exist in /etc/passwd.	-	-	-	Yes
		Ensure that an account has its own home directory.	-	-	-	Yes
		Ensure that the permissions on the home directory of the account are 750 or stricter.	-	-	-	Yes
		Avoid the .forward file in the home directory.	-	-	-	Yes
		Avoid the .netrc file in the home directory.	-	-	-	Yes
		Ensure that the user PATH variable is strictly defined.	-	-	-	Yes
	Password management	Ensure the password complexity.	√	√	√	No
		Restrict the number of reusing a historical password.	√	√	√	No
		Ensure that passwords do not contain the account character strings.	-	-	-	Yes
		Ensure that passwords are encrypted using SHA512.	√	√	√	No
		Ensure that the password expiration time is correctly configured.	√	√	√	No
		Ensure that the password expiration alarm time is correctly configured.	√	√	-	Yes
		Ensure that the password change period is correctly configured.	√	√	√	No
		Ensure that inactive passwords are locked for no more than 30 days.	√	-	-	Yes
		Ensure that the password protection is configured for GRUB.	-	-	-	Yes
		Ensure that password protection is configured in the single-user mode.	-	-	-	Yes
Identity authentication	Login management	Lock an account after a specific number of login failures.	√	√	√	No
		Prevent user root from accessing the system locally.	-	-	-	No
		Ensure that the timeout duration of sessions is correctly configured.	√	√	√	No
	Warning banners	Ensure that the local login warning banner contains proper information.	√	√	-	No
		Ensure that the remote login warning banner contains proper information.	√	√	-	No
		Ensure that the motd file contains proper information.	√	√	-	No
		Ensure that the /etc/issue permission is correctly configured.	√	√	-	Yes
		Ensure that the /etc/issue.net permission is correctly configured.	√	√	-	Yes
		Ensure that the /etc/motd permission is correctly configured.	√	√	-	Yes
Access control	SELinux	Ensure that the enforce mode is enabled.	-	-	-	Yes
		Ensure that the SELinux policy is correctly configured.	-	-	-	Yes
		Avoid the services with the unconfined_service_t label.	-	-	-	No
		Ensure that the SETroubleShoot service is not installed.	-	-	-	Yes
		Ensure that the Mount Conversion Service (MCS) is not installed.	-	-	-	Yes
	Privileged commands	Ensure that the su command is restricted.	√	√	√	No
		Ensure that the su command inherits the user's environment variables without escalating privileges.	√	√	√	No
		Ensure that common users run privileged programs using sudo.	-	-	-	No
		Ensure that the sudo log file is configured.	√	-	-	No
		Disable the SysRq key.	-	√	-	No
	System file permissions	Ensure that the /etc/passwd permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/passwd- permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/shadow permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/shadow- permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/group permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/group- permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/gshadow permission is correctly configured.	√	-	-	Yes
		Ensure that the /etc/gshadow- permission is correctly configured.	√	-	-	Yes
		Ensure that the sticky bit is set for world-writable directories.	-	-	-	Yes
		Forbid files or directories without owners or owning groups.	-	-	-	Yes
		Avoid using world-writable files.	-	-	-	Yes
		Forbid files with invalid links.	-	-	-	Yes
		Forbid executable hidden files.	-	-	-	Yes
		Ensure that unnecessary SUID or SGID bits in the file are deleted.	-	-	-	Yes
		Ensure that umask is 027 or stricter.	√	√	√	No