Fedora36: security measures

🔗

1. Installed anti-virus software (Clam AntiVirus).
2. Introduced a file tampering detection system (Tripwire).
3. Rootkit detection system introduced (RkHunter).
4. Settings for SSH server public key authentication method connections.
   1. Create a public key for the server.
   2. Connection test.
   3. Authenticated connection with private key.

Installed anti-virus software (Clam AntiVirus).

Install Clam AntiVirus.

[root@www ~]# dnf -y install clamav clamav-update

Configure Clam AntiVirus.

[root@www ~]# vi /etc/freshclam.conf

Line 8: Add “#” at the beginning of the line to make it a comment.

#Example

Update pattern files.

[root@www ~]# freshclam

ClamAV update process started at Sun Jun 30 23:51:01 2019
main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
daily.cld is up to date (version: 25496, sigs: 1606212, f-level: 63, builder: raynman)
bytecode.cvd is up to date (version: 328, sigs: 94, f-level: 63, builder: neo)

Run a scan to make sure it works.

[root@www ~]# clamscan --infected --remove --recursive /home

----------- SCAN SUMMARY -----------
Known viruses: 6163086
Engine version: 0.101.2
Scanned directories: 38
Scanned files: 23
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 179.738 sec (2 m 59 s)

Download a test harmless virus.

[root@www ~]# wget http://www.eicar.org/download/eicar.com

Run a scan to make sure it works.

[root@www ~]# clamscan --infected --remove --recursive .

----------- SCAN SUMMARY -----------
Known viruses: 6163097
Engine version: 0.101.2
Scanned directories: 3
Scanned files: 10
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 179.738 sec (2 m 59 s)

Introduced a file tampering detection system (Tripwire).

Install Tripwire.

[root@www ~]# dnf -y install tripwire

Initialize Tripwire.

[root@www ~]# tripwire-setup-keyfiles

Set a passphrase for the site key file.

Enter the site keyfile passphrase:　Site key file passphrase (alphanumeric)
Verify the site keyfile passphrase:　Site key file passphrase (alphanumeric)

Sets the passphrase for the local keyfile.

Enter the local keyfile passphrase:　Local key file passphrase (alphanumeric)
Verify the local keyfile passphrase:　Local key file passphrase (alphanumeric)

Enter the passphrase for the site key file.

Please enter your site passphrase:　Site key file passphrase

Enter the passphrase for the site key file.

Please enter your site passphrase:　Site key file passphrase

Change the directory to “/etc/tripwire”.

[root@www ~]# cd /etc/tripwire

Make initial settings.

[root@www tripwire]# vi twcfg.txt

Line 12: Change the reporting level to maximum.

REPORTLEVEL = 4

Generate a configuration file.

[root@www tripwire]# twadmin -m F -c tw.cfg -S site.key twcfg.txt

Enter the passphrase for the site key file.

Please enter your site passphrase:　Site key file passphrase
Wrote configuration file: /etc/tripwire/tw.cfg

Optimize your policy.

[root@www tripwire]# vi twpolmake.pl

If “#” is automatically inserted at the beginning of the line, create it in two steps.

#!/usr/bin/perl
# Tripwire Policy File customize tool
# ----------------------------------------------------------------
# Copyright (C) 2003 Hiroaki Izumi
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
# ----------------------------------------------------------------
# Usage:
# perl twpolmake.pl {Pol file}
# ----------------------------------------------------------------
#
#Create a line without "#" at the beginning of the line, and do the following.
$POLFILE=$ARGV[0];

open(POL,"$POLFILE") or die "open error: $POLFILE" ;
my($myhost,$thost) ;
my($sharp,$tpath,$cond) ;
my($INRULE) = 0 ;

while (<POL>) {
    chomp;
    if (($thost) = /^HOSTNAMEs*=s*(.*)s*;/) {
        $myhost = `hostname` ; chomp($myhost) ;
        if ($thost ne $myhost) {
            $_="HOSTNAME="$myhost";" ;
        }
    }
    elsif ( /^{/ ) {
        $INRULE=1 ;
    }
    elsif ( /^}/ ) {
        $INRULE=0 ;
    }
    elsif ($INRULE == 1 and ($sharp,$tpath,$cond) = /^(s*#?s*)(/S+)b(s+->s+.+)$/) {
        $ret = ($sharp =~ s/#//g) ;
        if ($tpath eq '/sbin/e2fsadm' ) {
            $cond =~ s/;s+(tune2fs.*)$/; #$1/ ;
        }
        if (! -s $tpath) {
            $_ = "$sharp#$tpath$cond" if ($ret == 0) ;
        }
        else {
            $_ = "$sharp$tpath$cond" ;
        }
    }
    print "$_n" ;
}
close(POL) ;

[root@www tripwire]# perl twpolmake.pl twpol.txt > twpol.txt.new
[root@www tripwire]# twadmin -m P -c tw.cfg -p tw.pol -S site.key twpol.txt.new

Enter the passphrase for the site key file.

Please enter your site passphrase:　Passphrase for your site key file
Wrote configuration file: /etc/tripwire/tw.pol

Create a database.

[root@www tripwire]# tripwire -m i -s -c tw.cfg

Enter the passphrase for the local key file.

Please enter your local passphrase:　Local key file passphrase 

Move directory.

[root@www tripwire]# cd

Run the check. (Regular checks are performed daily.)

[root@www ~]# tripwire -m c -s -c /etc/tripwire/tw.cfg
Open Source Tripwire(R) 2.4.2.2 Integrity Check Report

Report generated by:          root
...
...
...
All rights reserved.

Confirm the check result.

[root@www ~]# ll /var/lib/tripwire/report
total 4
-rw-r--r-- 1 root root 1821526 6月 29 07:58 server.jp-20190629-075230.twr
-rw-r--r-- 1 root root 1830182 6月 30 06:09 server.jp-20190630-060029.twr
-rw-r--r-- 1 root root 1829590 7月 1 09:29 server.jp-20190701-092314.twr
-rw-r--r-- 1 root root 1828518 7月 1 17:27 server.jp-20190701-171400.twr

Specifies a report to update the database.

[root@www ~]# tripwire -m u -a -s -c /etc/tripwire/tw.cfg -r /var/lib/tripwire/report/server.jp-20190701-171400.twr

Enter the passphrase for the local key file.

Please enter your local passphrase:　Local key file passphrase

Rootkit detection system introduced (RkHunter).

Install RKHunter.

[root@www ~]# dnf -y install rkhunter

Set up RKHunter.

[root@www ~]# vi /etc/sysconfig/rkhunter

Set the destination to send the report and scan mode.

#Destination to send the report to
MAILTO=root@localhost
#Scan mode
DIAG_SCAN=no

Update the database.

[root@www ~]# rkhunter --update

Update system file information.

[root@www ~]# rkhunter --propupd

Run check.

[root@www ~]# rkhunter --check --sk
[ Rootkit Hunter version 1.4.2 ]

Checking system commands...
...
...
No warnings were found while checking the system.

Settings for SSH server public key authentication method connections.

Create a public key for the server.

Start TeraTerm, log in as a user, and create public and private keys.

[webmaster@www ~]$ ssh-keygen -t ecdsa