Security Guide Wishlist

History

The current (Fedora 20) Security Guide (minus the SELinux stuff) is a mash together of the RHEL 6 Security Guide and the hardening advice that was posted on the Fedora wiki around the time of Fedora 12. It's quite obvious to anyone reading the entire document that the beginning of the guide reads one way while the end reads differently as if they had different missions (they do!).

Looking forward

It's okay to look at the guide and say that while much of the guide is okay much of it is crap. There may be a need for basic security education I feel that it is best suited to other documentation and training resources. I'd like to go into the next version of this guide with a fresh look at what is needed: hardening advice, auditing advice, how to use the security tools that are available, etc. This will not be easy but it's doable.

The recommended configuration should disable any algorithms that don't provide 128bits of security (see NIST SP 800-57 and ENISA "Algorithms, Key Sizes and Parameters Report. 2013 recommendations" for details). The guide should (whenever possible) also provide information about possible compatibility problems introduced by the changed settings and ways to diagnose issues if they arise.

Topics to be covered

SELinux

There is a lot of SELinux stuff in guide. It needs to be combed through and evaluated to determine what is needed, necessary, and up to date. There is also a treasure trove of stuff on Dan Walsh's blog that needs to be converted and brought into the mix. I'm sure we're missing some rather large topics regarding what SELinux can do now.

Firewalls

Yeah, there is currently no good documentation on setting up firewalld.

SCAP

Man, this is going to be a huge topic. From setup to auditing to writing your own rules... SCAP should be written up well. (Leverage all the work Shawn Wells has done)

Encryption

It's hard. Lets try to make it a little easier.

• Hardware-based full disk encryption. Caveat: Certain firmware does not prompt for the password on warm reboots, so you need to add a GRUB password (otherwise someone at the console could just switch to a VTY, reboot, and access the box), which is currently not supported (bug 840160).

Address FIPS compliance, or specifically that it is not FIPS-compliant, and explain why.

Use cases

httpd

How do I setup Apache to be secure and use good ciphers?

dovecot

How do I setup dovecot to be secure and use good ciphers?

ssh

How to setup secure root logon (PermintRootLogin)? How to regenerate host keys (because early boot is entropy starved). How to generate host and user keys that provide 128 bits of security (3072bit RSA, 256bit ECDSA). Best practice on ssh key usage, distribution, key signing, ssh-agent usage. How to setup two factor authentication. How to disable insecure algorithms in server in client (group1 DH key exchange, single DES and arc4 encryption).

When using ECC, which curves match the best practices, and how can users enable them? How does http://safecurves.cr.yp.to/ fit in?

Application and daemons sandboxing

How to sandbox an application or system service.