Chapter 1. Securing RHEL during and right after installation Security begins even before you start the installation of Red Hat Enterprise Linux. Configuring your system securely from the beginning makes it easier to implement additional security settings later. 1.1. Disk partitioning The recommended practices for disk partitioning differ for installations on bare-metal machines and for virtualized or cloud environments that support adjusting virtual disk hardware and file systems containing already-installed operating systems. To ensure separation and protection of data on bare-metal installations , create separate partitions for the /boot , / , /home , /tmp , and /var/tmp/ directories: /boot This partition is the first partition that is read by the system during boot up. The boot loader and kernel images that are used to boot your system into RHEL 9 are stored in this partition. This partition should not be encrypted. If this partition is included in / and that partition is encrypted or otherwise becomes unavailable then your system is not able to boot. /home When user data ( /home ) is stored in / instead of in a separate partition, the partition can fill up causing the operating system to become unstable. Also, when upgrading your system to the version of RHEL 9 it is a lot easier when you can keep your data in the /home partition as it is not be overwritten during installation. If the root partition ( / ) becomes corrupt your data could be lost forever. By using a separate partition there is slightly more protection against data loss. You can also target this partition for frequent backups. /tmp and /var/tmp/ Both the /tmp and /var/tmp/ directories are used to store data that does not need to be stored for a long period of time. However, if a lot of data floods one of these directories it can consume all of your storage space. If this happens and these directories are stored within / then your system could become unstable and crash. For this reason, moving these directories into their own partitions is a good idea. For virtual machines or cloud instances , the separate /boot , /home , /tmp , and /var/tmp partitions are optional because you can increase the virtual disk size and the / partition if it begins to fill up. Set up monitoring to regularly check the / partition usage so that it does not fill up before you increase the virtual disk size accordingly. Note During the installation process, you have an option to encrypt partitions. You must supply a passphrase. This passphrase serves as a key to unlock the bulk encryption key, which is used to secure the partition's data. 1.2. Restricting network connectivity during the installation process When installing RHEL 9, the installation medium represents a snapshot of the system at a particular time. Because of this, it may not be up-to-date with the latest security fixes and may be vulnerable to certain issues that were fixed only after the system provided by the installation medium was released. When installing a potentially vulnerable operating system, always limit exposure only to the closest necessary network zone. The safest choice is the "no network" zone, which means to leave your machine disconnected during the installation process. In some cases, a LAN or intranet connection is sufficient while the Internet connection is the riskiest. To follow the best security practices, choose the closest zone with your repository while installing RHEL 9 from a network. 1.3. Installing the minimum amount of packages required It is best practice to install only the packages you will use because each piece of software on your computer could possibly contain a vulnerability. If you are installing from the DVD media, take the opportunity to select exactly what packages you want to install during the installation. If you find you need another package, you can always add it to the system later. 1.4. Post-installation procedures The following steps are the security-related procedures that should be performed immediately after installation of RHEL 9. Update your system. Enter the following command as root: Even though the firewall service, firewalld , is automatically enabled with the installation of Red Hat Enterprise Linux, it might be explicitly disabled, for example, in the Kickstart configuration. In such a case, re-enable the firewall. To start firewalld enter the following commands as root: To enhance security, disable services you do not need. For example, if no printers are installed on your computer, disable the cups service by using the following command: To review active services, enter the following command: 1.5. Disabling SMT to prevent CPU security issues by using the web console Disable Simultaneous Multi Threading (SMT) in case of attacks that misuse CPU SMT. Disabling SMT can mitigate security vulnerabilities, such as L1TF or MDS. Important Disabling SMT might lower the system performance. Prerequisites You have installed the RHEL 9 web console. You have enabled the cockpit service. Your user account is allowed to log in to the web console. For instructions, see Installing and enabling the web console . Procedure Log in to the RHEL 9 web console. For details, see Logging in to the web console . In the Overview tab find the System information field and click View hardware details . On the CPU Security line, click Mitigations . If this link is not present, it means that your system does not support SMT, and therefore is not vulnerable. In the CPU Security Toggles table, turn on the Disable simultaneous multithreading (nosmt) option. Click the Save and reboot button. After the system restart, the CPU no longer uses SMT. Additional resources L1TF - L1 Terminal Fault Attack - CVE-2018-3620 & CVE-2018-3646 MDS - Microarchitectural Data Sampling - CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091

Commands:
dnf update
systemctl start firewalld systemctl enable firewalld
systemctl disable cups
systemctl list-units | grep service