Red Hat Security: Linux in Physical, Virtual, and Cloud

Instructions

1. Log in as the root user on the serverc machine.

   1. Use the ssh student@serverc command to log in to the student user on the serverc host.

      [student@workstation ~]$ ssh student@serverc
      ...output omitted...
      [student@serverc ~]$

   2. Use the sudo -i command to change to the root user. Use the student sudo password.

      [student@serverc ~]$ sudo -i
      [sudo] password for student: student
      [root@serverc ~]#

2. List the available security profiles by using the authselect list command.

   [root@serverc ~]# authselect list
   - minimal	 Local users only for minimal installations
   - sssd   	 Enable SSSD for system authentication (also for local users only)
   - winbind	 Enable winbind for system authentication

3. List the available options and view the documentation for the minimal security profile.

   1. Use the authselect list-features minimal command to list the available options for the minimal security profile.

      [root@serverc ~]# authselect list-features minimal
      with-altfiles
      with-custom-aliases
      with-custom-automount
      with-custom-ethers
      with-custom-group
      with-custom-hosts
      with-custom-initgroups
      with-custom-netgroup
      with-custom-networks
      with-custom-passwd
      with-custom-protocols
      with-custom-publickey
      with-custom-rpc
      with-custom-services
      with-custom-shadow
      with-ecryptfs
      with-faillock
      with-mkhomedir
      with-pamaccess
      with-pwhistory
      with-silent-lastlog
      without-nullok

   2. Use the authselect show minimal command to view the documentation for the minimal security profile.

      [root@serverc ~]# authselect show minimal
      Local users only for minimal installations
      ==========================================
      
      Selecting this profile will enable local files as the source of identity
      and authentication providers.
      
      This profile can be used on systems that require minimal installation to
      save disk and memory space. It serves only local users and groups directly
      from system files instead of going through other authentication providers.
      Therefore SSSD, winbind and fprintd packages can be safely removed.
      
      Unless this system has strict memory and disk constraints, it is recommended
      to keep SSSD running and use 'sssd' profile to avoid functional limitations.
      
      AVAILABLE OPTIONAL FEATURES
      +---------------------------+
      
      with-faillock::
          Enable account locking in case of too many consecutive
          authentication failures.
      
      with-mkhomedir::
      ...output omitted...

4. Select the minimal profile with the with-pwhistory option and verify the changes.

   1. View the existing PAM configuration in the /etc/pam.d/system-auth file.

      [root@serverc ~]# cat /etc/pam.d/system-auth
      ...output omitted...
      
      auth        required                                     pam_env.so
      auth        required                                     pam_faildelay.so delay=2000000
      auth        sufficient                                   pam_unix.so nullok
      auth        required                                     pam_deny.so
      
      account     required                                     pam_unix.so
      
      password    requisite                                    pam_pwquality.so
      password    sufficient                                   pam_unix.so sha512 shadow nullok use_authtok
      password    required                                     pam_deny.so
      
      session     optional                                     pam_keyinit.so revoke
      session     required                                     pam_limits.so
      -session    optional                                     pam_systemd.so
      session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
      session     required                                     pam_unix.so

      Note

      The /etc/pam.d/password-auth file is identical to the /etc/pam.d/system-auth file.

   2. Use the authselect select minimal with-pwhistory command to apply the minimal security profile with the with-pwhistory additional option.

      [root@serverc ~]# authselect select minimal with-pwhistory
      Profile "minimal" was selected.
      The following nsswitch maps are overwritten by the profile:
      - aliases
      - automount
      - ethers
      - group
      - hosts
      - initgroups
      - netgroup
      - networks
      - passwd
      - protocols
      - publickey
      - rpc
      - services
      - shadow

   3. Use the authselect current command to verify that the security profile is applied.

      [root@serverc ~]# authselect current
      Profile ID: minimal
      Enabled features:
      - with-pwhistory

   4. View the changes to the /etc/pam.d/system-auth file.

      [root@serverc ~]# cat /etc/pam.d/system-auth
      ...output omitted...
      
      auth        required                                     pam_env.so
      auth        required                                     pam_faildelay.so delay=2000000
      auth        sufficient                                   pam_unix.so nullok
      auth        required                                     pam_deny.so
      
      account     required                                     pam_unix.so
      
      password    requisite                                    pam_pwquality.so
      password    [default=1 ignore=ignore success=ok]         pam_localuser.so
      password    requisite                                    pam_pwhistory.so use_authtok
      password    sufficient                                   pam_unix.so sha512 shadow nullok use_authtok
      password    required                                     pam_deny.so
      
      session     optional                                     pam_keyinit.so revoke
      session     required                                     pam_limits.so
      -session    optional                                     pam_systemd.so
      session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
      session     required                                     pam_unix.so

5. Return to the workstation machine.

   [root@serverc ~]# logout
   [student@serverc ~]$ logout
   Connection to closed serverc closed.
   [student@workstation ~]$