RHELのセキュリティポリシーのチューニング – 企業における最適化手法

sudo sestatus
sudo cat /etc/security/limits.conf
sudo firewall-cmd --list-all

sudo yum install scap-security-guide
sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

sudo setenforce 1
sudo vi /etc/selinux/config
SELINUX=enforcing

sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --remove-service=ftp --permanent
sudo firewall-cmd --reload

sudo vi /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
sudo systemctl restart sshd

sudo vi /etc/security/pwquality.conf
minlen=12
dcredit=-1
ucredit=-1
lcredit=-1

sudo yum install audit
sudo systemctl enable auditd
sudo systemctl start auditd
sudo auditctl -w /etc/passwd -p wa -k passwd_changes

sudo yum install clamav clamav-update
sudo freshclam
sudo clamscan -r /home

sudo systemctl disable cups
sudo systemctl stop cups
sudo systemctl list-unit-files | grep enabled

sudo vi /etc/sysctl.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
sudo sysctl -p

sudo yum install dnf-automatic
sudo vi /etc/dnf/automatic.conf
apply_updates = yes
sudo systemctl enable --now dnf-automatic.timer