Red Hat Security: Linux in Physical, Virtual, and Cloud

Instructions

1. Log in to the serverd machine as the root user.

   1. Use the ssh student@serverd command to log in to the serverd machine.

      [student@workstation ~]$ ssh student@serverd
      ...output omitted...
      [student@serverd ~]$

   2. Use the sudo -i command to change to the root user with the student sudo password.

      [student@serverd ~]$ sudo -i
      [sudo] password for student: student
      [root@serverd ~]#

   Hide Solution

2. Apply the minimal security profile with the with-faillock additional option.

   1. Use the authselect select minimal with-faillock command to select the minimal security profile with the with-faillock option.

      [root@serverd ~]# authselect select minimal with-faillock
      Profile "minimal" was selected.
      The following nsswitch maps are overwritten by the profile:
      - aliases
      - automount
      - ethers
      - group
      - hosts
      - initgroups
      - netgroup
      - networks
      - passwd
      - protocols
      - publickey
      - rpc
      - services
      - shadow

   Hide Solution

3. Configure the pam_faillock module to lock an account after two failed attempts within a five-minute period and to unlock after five minutes.

   1. Use a text editor to modify the /etc/security/faillock.conf configuration file to contain the following settings:

      deny = 2
      fail_interval = 300
      unlock_time = 300

   Hide Solution

4. Configure the pam_pwquality module to use the password credit mechanism with the following requirements:

   Field	Value
   Minimum password length or complexity	15
   Minimum required lowercase characters	1
   Credits for uppercase characters	2
   Credits for digits	2
   Credits for special characters	3

   1. Use a text editor to modify the /etc/security/pwquality.conf configuration file to contain the following settings:

      minlen = 15
      lcredit = -1
      ucredit = 2
      dcredit = 2
      ocredit = 3

   2. Return to the workstation machine.

      [root@serverd ~]# logout
      [student@serverd ~]$ logout
      Connection to closed serverd closed.
      [student@workstation ~]$

   Hide Solution