Securing Your System with Red Hat Enterprise Linux 7.2

=====================================================================================

Introduction

----------

Red Hat Enterprise Linux (RHEL) 7.2 is an enterprise-grade operating system that provides a robust foundation for mission-critical applications and infrastructure management. As part of its commitment to security, this article will guide you through the essential steps required to harden your RHEL 7.2 environment against common threats.

Prerequisites

------------

Before proceeding with these instructions:

1. Ensure your system is running Red Hat Enterprise Linux (RHEL) version 7.2 or later.

2. Verify that all installed packages are up-to-date by executing `sudo yum update --security` followed by a reboot if prompted.

3. Make sure you have root privileges to perform the following tasks.

Step-by-Step Checklist

---------------------

### Step 1: Enable and Configure SELinux

SELinux (Security-Enhanced Linux) is an important component of RHEL's security architecture that provides fine-grained access control over system resources. To enable it:

```bash

sudo setenforce --set 0

```

To check the current state, execute `getsebool -a | grep selinux`.

### Step 2: Configure Network Services

By default, several network services are enabled on RHEL 7.x systems to facilitate easy setup and testing. However, for production environments, it is highly recommended to disable those not explicitly required:

```bash

sudo systemctl enable --now firewalld.service

```

To list all active rules and zones: `firewall-cmd -list-all` followed by `systemctl status firewalld`.

### Step 3: Configure System Services

Several system services are enabled by default on RHEL systems. To harden the security posture, follow these steps:

- Disable Unnecessary Services

```bash

sudo systemctl disable --now postfix.service cups-lpd.service vsftpd.service telnet.socket sshd_selinux.target rhsmcertd.service ntpdate.service cockpit-*

```

To ensure they are not started on boot: `systemctl enable --no-wait firewalld` followed by a reboot.

### Step 4: Configure File System and User Access

- Setumount noexec, nosuid, noatime

```bash

sudo mount -o remount,nosuid,noatime /dev/mapper/vg-root /

```

To check the current configuration:

```bash

df -h --noatime | grep ext4|xargs chattr +i

```

### Step 5: Configure System Cron and Crontab

- Remove Default Cron Jobs

```bash

sudo crontabs -r root /etc/cron.hourly/

```

To ensure only essential jobs run on system startup:

1. Open the `/etc/systemd/timers.target` file with your favorite editor.

2. Comment out or remove any unnecessary lines starting with `ExecStart`.

3. Reload and restart the systemd timer service: `sudo systemctl daemon-reload && sudo systemctl reboot`.

### Step 6: Configure SELinux File Contexts

- Set Correct SELinux File Context

```bash

restorecon -R /etc/.*

```

To check for any remaining incorrect file contexts:

```bash

setcontext selinux | grep context

```

-------

By following the steps outlined in this article, you will have significantly hardened your RHEL 7.2 system against common attacks and vulnerabilities commonly seen on enterprise networks today.

Remember to regularly review these instructions as new threats emerge and security best practices evolve. Regularly running `sudo yum update --security` along with a reboot is crucial for keeping your environment up-to-date and secure.

Red hat enterprise linux 7.2