Skip to content

Commit 6aae30e

Browse files
TommyTran732TommyTran732
authored
Add RHEL-10
1 parent 0a24a54 commit 6aae30e

File tree

2 files changed

+133
-2
lines changed

2 files changed

+133
-2
lines changed

‎README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,8 @@
44

55
Generic Linux setup scripts. Edit them to your liking before running them.
66

7-
## Notes on `io_uring`
8-
`io_uring` is disabled. On Proxmox, use `aio=native` for drives. You will need to manually edit the config for cdrom. Alternatively, if you do not want to deal with this, comment out the io_uring line in `/etc/sysctl.d/99-server.conf`
7+
## Notes
8+
These configurations are tailored for Metropolis.nexus environment:
9+
- Firewalling is handled by Proxmox (not the individual VMs)
10+
- DNSSEC validation is done by either OPNsense or a central VM dedicated to running the DNS resolver
11+
- `io_uring` is disabled. On Proxmox, use `aio=native` for drives. You will need to manually edit the config for cdrom. Alternatively, if you do not want to deal with this, comment out the io_uring line in `/etc/sysctl.d/99-server.conf`

‎RHEL-10.sh‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
#!/bin/sh
2+
3+
# Copyright (C) 2021-2025 Thien Tran
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
6+
# use this file except in compliance with the License. You may obtain a copy of
7+
# the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations under
15+
# the License.
16+
17+
set -eu
18+
19+
output(){
20+
printf '\e[1;34m%-6s\e[m\n' "${@}"
21+
}
22+
23+
unpriv(){
24+
sudo -u nobody "$@"
25+
}
26+
27+
# Compliance
28+
sudo systemctl mask debug-shell.service
29+
sudo systemctl mask kdump.service
30+
31+
# Setting umask to 077
32+
umask 077
33+
sudo sed -i 's/^UMASK.*/UMASK 077/g' /etc/login.defs
34+
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /etc/login.defs
35+
sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
36+
37+
# Make home directory private
38+
sudo chmod 700 /home/*
39+
40+
# Remove nullok
41+
sudo /usr/bin/sed -i 's/\s+nullok//g' /etc/pam.d/system-auth
42+
43+
# Setup NTS
44+
sudo dnf install -y chrony
45+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/chrony.conf | sudo tee /etc/chrony.conf > /dev/null
46+
sudo chmod 644 /etc/chrony.conf
47+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd > /dev/null
48+
sudo chmod 644 /etc/sysconfig/chronyd
49+
sudo systemctl restart chronyd
50+
51+
# Harden NetworkManager
52+
sudo mkdir -p /etc/systemd/system/NetworkManager.service.d
53+
unpriv curl -s https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf > /dev/null
54+
sudo chmod 644 /etc/systemd/system/NetworkManager.service.d/99-brace.conf
55+
sudo systemctl daemon-reload
56+
sudo systemctl restart NetworkManager
57+
58+
# Harden SSH
59+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/ssh/sshd_config.d/10-custom.conf | sudo tee /etc/ssh/sshd_config.d/10-custom.conf > /dev/null
60+
sudo chmod 644 /etc/ssh/sshd_config.d/10-custom.conf
61+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/ssh/ssh_config.d/10-custom.conf | sudo tee /etc/ssh/ssh_config.d/10-custom.conf > /dev/null
62+
sudo chmod 644 /etc/ssh/ssh_config.d/10-custom.conf
63+
sudo mkdir -p /etc/systemd/system/sshd.service.d/
64+
sudo chmod 755 /etc/systemd/system/sshd.service.d/
65+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/systemd/system/sshd.service.d/override.conf | sudo tee /etc/systemd/system/sshd.service.d/override.conf > /dev/null
66+
sudo systemctl daemon-reload
67+
sudo systemctl restart sshd
68+
69+
# Security kernel settings
70+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/modprobe.d/server-blacklist.conf | sudo tee /etc/modprobe.d/server-blacklist.conf > /dev/null
71+
sudo chmod 644 /etc/modprobe.d/server-blacklist.conf
72+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/sysctl.d/99-server.conf | sudo tee /etc/sysctl.d/99-server.conf > /dev/null
73+
sudo chmod 644 /etc/sysctl.d/99-server.conf
74+
sudo dracut -f
75+
sudo sysctl -p
76+
77+
# efi=disable_early_pci_dma seems to break boot on RHEL and only RHEL, dunno why yet
78+
sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off l1d_flush=on l1tf=full,force kvm-intel.vmentry_l1d_flush=always spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on kvm.nx_huge_pages=force amd_iommu=force_isolation intel_iommu=on iommu=force iommu.strict=1 iommu.passthrough=0 efi=disable_early_pci_dma slab_nomerge init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on lockdown=confidentiality module.sig_enforce=1 oops=panic vsyscall=none ia32_emulation=0 debugfs=off random.trust_bootloader=off random.trust_cpu=off console=tty0 console=ttyS0,115200'
79+
80+
# Disable coredump
81+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/security/limits.d/30-disable-coredump.conf | sudo tee /etc/security/limits.d/30-disable-coredump.conf > /dev/null
82+
sudo chmod 644 /etc/security/limits.d/30-disable-coredump.conf
83+
sudo mkdir -p /etc/systemd/coredump.conf.d
84+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/systemd/coredump.conf.d/disable.conf | sudo tee /etc/systemd/coredump.conf.d/disable.conf > /dev/null
85+
sudo chmod 644 /etc/systemd/coredump.conf.d/disable.conf
86+
87+
# Setup DNF
88+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/dnf/dnf.conf | sudo tee /etc/dnf/dnf.conf > /dev/null
89+
sudo chmod 644 /etc/dnf/dnf.conf
90+
sudo sed -i 's/^metalink=.*/&\&protocol=https/g' /etc/yum.repos.d/*
91+
92+
# Setup automatic updates
93+
sudo dnf install -y dnf-automatic
94+
sudo sed -i 's/apply_updates = no/apply_updates = yes\nreboot = when-needed/g' /etc/dnf/automatic.conf
95+
sudo systemctl enable --now dnf-automatic.timer
96+
97+
# Remove unnecessary packages
98+
sudo dnf disable --now firewalld
99+
sudo systemctl disable --now irqbalance
100+
sudo dnf remove -y cockpit* firewalld irqbalance
101+
102+
# Install hardened_malloc
103+
sudo dnf copr enable secureblue/hardened_malloc -y
104+
sudo dnf install -y hardened_malloc
105+
echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
106+
sudo chmod 644 /etc/ld.so.preload
107+
108+
# Setup yara
109+
sudo dnf install -y yara
110+
sudo insights-client --collector malware-detection
111+
sudo sed -i 's/test_scan: true/test_scan: false/' /etc/insights-client/malware-detection-config.yml
112+
113+
# Install guest agent
114+
sudo dnf install -y qemu-guest-agent
115+
116+
# Enable auto TRIM
117+
sudo systemctl enable fstrim.timer
118+
119+
# Setup tuned
120+
sudo dnf install -y tuned
121+
sudo systemctl enable --now tuned
122+
sudo tuned-adm profile virtual-guest
123+
124+
# Setup notices
125+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/issue | sudo tee /etc/issue > /dev/null
126+
sudo chmod 644 /etc/issue
127+
unpriv curl -s https://raw.githubusercontent.com/Metropolis-nexus/Common-Files/main/etc/issue | sudo tee /etc/issue.net > /dev/null
128+
sudo chmod 644 /etc/issue.net

0 commit comments

Comments
 (0)