1.Threats of the Kernel and Operating System
Operating System is the kernel of information system,it managing software and hardware.All applications depends on operating system to ensure the integrity,confidentiality,availability and controllability of information.
Main threat of operating system and kernel are:hardware failure,infiltration,system vulnerabilities and so on.The safety of operating system depends on its safety configuration,relative safety software and third-party safety softwares.
2.Security Hardening
Security Hardening of operating system is essentially a measure a measure to eliminate some risks in advance by optimizing operation system configuration items based on past security risk experience.Security hardening of openEuler operating system mainly consists of five parts:kernel parameters,authorization,account password,file permissions,system service.
3.Kernel Parameters
3.1.Definition
Kernel parameters define status of configuration and application status.Parameters can modified temporarily and read by ‘sysctl’ command,these parameters located in the directory ‘/proc/sys’.Parameters can be modified permanently by modify the file ‘/etc/sysctl.conf’.
3.2.Configuration Tool of Kernel Parameters — sysctl
Command ‘sysctl -a’/’sysctl –all’ means ‘check all kernel parameters’.
Command ‘sysctl -w’/’sysctl –write’ means ‘modify specified kernel parameters temporarily’.
Command ‘sysctl -p’ means load kernel parameters from the file(default ‘/etc/sysctl.conf’).
3.3.Commonly Used Security Hardening Strategy
We can edit ‘/etc/sysctl.conf’ to modify kernel parameters permanently,1 usually means enabled,0 usually means disabled.
Set IP forwarding.Input ‘cat /proc/sys/net/ipv4/ip_forward’ to check the data package transfer function.If the output is 1,the IP forwarding is enabled.If the output is 0,the IP fowarding is disabled.Input ‘sysctl -w net.ipv4.ip_forward = 0’ to disable IP forewarding temporarily.Set ‘net.ipv4.ip_forward=0’ in “/etc/sysctl.conf” to disable IP forwarding permanently.
Set network parameters.’net.ipv4.conf.default.arp_announce’ is the network parameter in linux kernel.It control the source IP choosing strategy when default network interface sending network announcements.You can set ‘net.ipv4.conf.default.arp_announce’ in the configuration file ‘/etc/sysctl.conf’.0 means default,1 means retricted mode,2 means stricted mode.Single interface’s configuration of arp_announce has the highest priority,like ‘net.ipv4.conf.eth0.arp_announce’,used for specified interface.Default configuration of arp_announce used for new interfaces that have not been separately configured.All configuration of arp_announce used for all interfaces,but it can be covered by single interface or obvious default configuration.
Finally,when the setting finished,input ‘sysctl -p /etc/sysctl.conf’ to make ‘/etc/sysctl.conf’ configuration file available.
Leave a Reply