hardening fedora

  

sudo lynis audit system 

consider explicit disabling of core dump in /etc/security/limits.conf 

* hard core 0
* soft core 0

Configure password hashing rounds in /etc/login.defs 

 When possible set expire dates for all password protected accounts 

 Configure minimum password age in /etc/login.defs 

Configure maximum password age in /etc/login.defs

Default umask in /etc/login.defs could be more strict like 027 

To decrease the impact of a full /var file system, place /var on a separate partition 

 Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft

Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft

 Check DNS configuration for the dns domain name

 Add the IP name and FQDN to /etc/hosts for proper name resolving

 Consider using a tool to automatically apply upgrades

 Determine if protocol 'dccp',sctp,rds,tipc  is really needed on this system  

 Enable logging to an external logging host for archiving purposes and additional protection 

Aadd a legal banner to /etc/issue,/etc/issue.net to warn unauthorized users 

  Enable process accounting 

 Enable sysstat to collect accounting (no results) 

Use NTP daemon or NTP client to prevent time issues

Determine if automation tools are present for system management 

 Double check the permissions of home directories as some might be not strict enough.

One or more sysctl values differ from the scan profile and could be tweaked 

    - Solution : Change sysctl value or disable test (skip-test=KRNL-6000:<sysctl-key>)
 

Harden compilers like restricting access to root user only 

Harden the system by installing at least one malware scanner, to perform periodic file system scans 

    - dev.tty.ldisc_autoload (exp: 0)                         [ DIFFERENT ]
    - fs.protected_fifos (exp: 2)                             [ DIFFERENT ]
    - fs.protected_hardlinks (exp: 1)                         [ OK ]
    - fs.protected_regular (exp: 2)                           [ DIFFERENT ]
    - fs.protected_symlinks (exp: 1)                          [ OK ]
    - fs.suid_dumpable (exp: 0)                               [ DIFFERENT ]
    - kernel.core_uses_pid (exp: 1)                           [ OK ]
    - kernel.ctrl-alt-del (exp: 0)                            [ OK ]
    - kernel.dmesg_restrict (exp: 1)                          [ DIFFERENT ]
    - kernel.kptr_restrict (exp: 2)                           [ DIFFERENT ]
    - kernel.modules_disabled (exp: 1)                        [ DIFFERENT ]
    - kernel.perf_event_paranoid (exp: 3)                     [ DIFFERENT ]
    - kernel.randomize_va_space (exp: 2)                      [ OK ]
    - kernel.sysrq (exp: 0)                                   [ DIFFERENT ]
    - kernel.unprivileged_bpf_disabled (exp: 1)               [ DIFFERENT ]
    - kernel.yama.ptrace_scope (exp: 1 2 3)                   [ DIFFERENT ]
    - net.core.bpf_jit_harden (exp: 2)                        [ DIFFERENT ]
    - net.ipv4.conf.all.accept_redirects (exp: 0)             [ DIFFERENT ]
    - net.ipv4.conf.all.accept_source_route (exp: 0)          [ OK ]
    - net.ipv4.conf.all.bootp_relay (exp: 0)                  [ OK ]
    - net.ipv4.conf.all.forwarding (exp: 0)                   [ OK ]
    - net.ipv4.conf.all.log_martians (exp: 1)                 [ DIFFERENT ]
    - net.ipv4.conf.all.mc_forwarding (exp: 0)                [ OK ]
    - net.ipv4.conf.all.proxy_arp (exp: 0)                    [ OK ]
    - net.ipv4.conf.all.rp_filter (exp: 1)                    [ DIFFERENT ]
    - net.ipv4.conf.all.send_redirects (exp: 0)               [ DIFFERENT ]
    - net.ipv4.conf.default.accept_redirects (exp: 0)         [ DIFFERENT ]
    - net.ipv4.conf.default.accept_source_route (exp: 0)      [ OK ]
    - net.ipv4.conf.default.log_martians (exp: 1)             [ DIFFERENT ]
    - net.ipv4.icmp_echo_ignore_broadcasts (exp: 1)           [ OK ]
    - net.ipv4.icmp_ignore_bogus_error_responses (exp: 1)     [ OK ]
    - net.ipv4.tcp_syncookies (exp: 1)                        [ OK ]
    - net.ipv4.tcp_timestamps (exp: 0 1)                      [ OK ]
    - net.ipv6.conf.all.accept_redirects (exp: 0)             [ DIFFERENT ]
    - net.ipv6.conf.all.accept_source_route (exp: 0)          [ OK ]
    - net.ipv6.conf.default.accept_redirects (exp: 0)         [ DIFFERENT ]
    - net.ipv6.conf.default.accept_source_route (exp: 0)      [ OK ]

  - HW RNG & rngd                                             [ NO ]
  - SW prng                                                   [ NO ]
  MOR-bit set                                                 [ NO ]

  - Checking for a running NTP daemon or client               [ WARNING ]
 

sudo update-crypto-policies  --show

DEFAULT,LEGACY, FUTURE,FIPS

fips-mode-setup --enable

update-crypto-policies --set DEFAULT:NO-SHA1

 dnf install systemd-resolved

ln -sf ../run/systemd/resolve/stub-resolv.conf /etc/resolv.conf 

nano /etc/systemd/resolved.conf.d/dnssec.conf

[Resolve]
DNSSEC=true
DNS=1.1.1.1
FallbackDNS=9.9.9.9
DNSOverTLS=yes

 resolvectl query badsig.go.dnscheck.tools

resolvectl query go.dnscheck.tools 

remove resolv line from iwd/main.conf else it will create new dns 192.xx  

https://wiki.archlinux.org/title/Systemd-resolved