Security hardening Red Hat Enterprise Linux 9 Enhancing security of Red Hat Enterprise Linux 9 systems Red Hat Customer Content Services

Commands:
dnf update
systemctl start firewalld systemctl enable firewalld
systemctl disable cups
systemctl list-units | grep service
fips-mode-setup --check FIPS mode is enabled.
fips-mode-setup --enable Kernel initramdisks are being regenerated. This might take some time. Setting system policy to FIPS Note: System-wide crypto policies are applied on application start-up. It is recommended to restart the system for the change of policies to fully take place. FIPS mode will be enabled. Please reboot the system for the setting to take effect.
reboot
fips-mode-setup --check FIPS mode is enabled.
update-crypto-policies --show DEFAULT
update-crypto-policies --set <POLICY> <POLICY>
reboot
update-crypto-policies --show <POLICY>
update-crypto-policies --set LEGACY Setting system policy to LEGACY
update-crypto-policies --set DEFAULT:SHA1 Setting system policy to DEFAULT:SHA1 Note: System-wide crypto policies are applied on application start-up. It is recommended to restart the system for the change of policies to fully take place.
reboot
update-crypto-policies --show DEFAULT:SHA1
wget --secure-protocol= TLSv1_1 --ciphers=" SECURE128 " https://example.com
curl https://example.com --ciphers '@SECLEVEL=0:DES-CBC3-SHA:RSA-DES-CBC3-SHA'
cd /etc/crypto-policies/policies/modules/
touch MYCRYPTO-1 .pmod touch SCOPES-AND-WILDCARDS .pmod
vi MYCRYPTO-1 .pmod
min_rsa_size = 3072 hash = SHA2-384 SHA2-512 SHA3-384 SHA3-512
vi SCOPES-AND-WILDCARDS .pmod
Disable the AES-128 cipher, all modes cipher = -AES-128-* Disable CHACHA20-POLY1305 for the TLS protocol (OpenSSL, GnuTLS, NSS, and OpenJDK) cipher@TLS = -CHACHA20-POLY1305 Allow using the FFDHE-1024 group with the SSH protocol (libssh and OpenSSH) group@SSH = FFDHE-1024+ Disable all CBC mode ciphers for the SSH protocol (libssh and OpenSSH) cipher@SSH = -*-CBC Allow the AES-256-CBC cipher in applications using libssh cipher@libssh = AES-256-CBC+
update-crypto-policies --set DEFAULT: MYCRYPTO-1 : SCOPES-AND-WILDCARDS
reboot
cat /etc/crypto-policies/state/CURRENT.pol | grep rsa_size min_rsa_size = 3072
cd /etc/crypto-policies/policies/ touch MYPOLICY .pol
cp /usr/share/crypto-policies/policies/ DEFAULT .pol /etc/crypto-policies/policies/ MYPOLICY .pol
vi /etc/crypto-policies/policies/ MYPOLICY .pol
update-crypto-policies --set MYPOLICY
reboot
--- - name: Configure cryptographic policies hosts: managed-node-01.example.com tasks: - name: Configure the FUTURE cryptographic security policy on the managed node ansible.builtin.include_role: name: rhel-system-roles.crypto_policies vars: - crypto_policies_policy: FUTURE - crypto_policies_reboot_ok: true
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Verification hosts: managed-node-01.example.com tasks: - name: Verify active cryptographic policy ansible.builtin.include_role: name: rhel-system-roles.crypto_policies - name: Display the currently active cryptographic policy ansible.builtin.debug: var: crypto_policies_active
ansible-playbook --syntax-check ~/verify_playbook.yml
ansible-playbook ~/verify_playbook.yml TASK [debug] ************************** ok: [host] => { "crypto_policies_active": "FUTURE" }
cat /usr/share/p11-kit/modules/opensc.module module: opensc-pkcs11.so
ssh-keygen -D pkcs11: > keys.pub
ssh-copy-id -f -i keys.pub <username@ssh-server-example.com>
ssh -i "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
ssh -i "pkcs11:id=%01" <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
ssh -i pkcs11: <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
cat ~/.ssh/config IdentityFile "pkcs11:id=%01?module-path=/usr/lib64/pkcs11/opensc-pkcs11.so" ssh <ssh-server-example.com> Enter PIN for 'SSH key': [ssh-server-example.com] USD
wget --private-key 'pkcs11:token=softhsm;id=%01;type=private?pin-value=111111' --certificate 'pkcs11:token=softhsm;id=%01;type=cert' https://example.com/
curl --key 'pkcs11:token=softhsm;id=%01;type=private?pin-value=111111' --cert 'pkcs11:token=softhsm;id=%01;type=cert' https://example.com/
SSLCertificateFile "pkcs11:id=%01;token=softhsm;type=cert" SSLCertificateKeyFile "pkcs11:id=%01;token=softhsm;type=private?pin-value=111111"
ssl_certificate /path/to/cert.pem ssl_certificate_key "engine:pkcs11:pkcs11:token=softhsm;id=%01;type=private?pin-value=111111";
Authentication is required to access the PC/SC daemon
journalctl -b | grep pcsc Process 3087 (user: 1001) is NOT authorized for action: access_pcsc
journalctl -u polkit polkitd[NNN]: Error compiling script /etc/polkit-1/rules.d/00-debug-pcscd.rules polkitd[NNN]: Operator of unix-session:c2 FAILED to authenticate to gain authorization for action org.debian.pcsc-lite.access_pcsc for unix-process:4800:14441 [/usr/libexec/gsd-smartcard] (owned by unix-user:group)
#!/bin/bash cd /proc for p in [0-9]* do if grep libpcsclite.so.1.0.0 USDp/maps &> /dev/null then echo -n "process: " cat USDp/cmdline echo " (USDp)" fi done
./pcsc-apps.sh process: /usr/libexec/gsd-smartcard (3048) enable-sync --auto-ssl-client-auth --enable-crashpad (4828)
touch /etc/polkit-1/rules.d/00-test.rules
vi /etc/polkit-1/rules.d/00-test.rules
polkit.addRule(function(action, subject) { if (action.id == "org.debian.pcsc-lite.access_pcsc" || action.id == "org.debian.pcsc-lite.access_card") { polkit.log("action=" + action); polkit.log("subject=" + subject); } });
systemctl restart pcscd.service pcscd.socket polkit.service
journalctl -u polkit --since "1 hour ago" polkitd[1224]: <no filename>:4: action=[Action id='org.debian.pcsc-lite.access_pcsc'] polkitd[1224]: <no filename>:5: subject=[Subject pid=2020481 user=user' groups=user,wheel,mock,wireshark seat=null session=null local=true active=true]
wget -O - https://www.redhat.com/security/data/oval/v2/RHEL9/rhel-9.oval.xml.bz2 | bzip2 --decompress > rhel-9.oval.xml
oscap oval eval --report vulnerability.html rhel-9.oval.xml
firefox vulnerability.html &
wget -O - https://www.redhat.com/security/data/oval/v2/RHEL9/rhel-9.oval.xml.bz2 | bzip2 --decompress > rhel-9.oval.xml
oscap-ssh <username> @ <hostname> <port> oval eval --report <scan-report.html> rhel-9.oval.xml
Data stream ├── xccdf | ├── benchmark | ├── profile | | ├──rule reference | | └──variable | ├── rule | ├── human readable data | ├── oval reference ├── oval ├── ocil reference ├── ocil ├── cpe reference └── cpe └── remediation
ls /usr/share/xml/scap/ssg/content/ ssg-rhel9-ds.xml
oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml Profiles: ... Title: Australian Cyber Security Centre (ACSC) Essential Eight Id: xccdf_org.ssgproject.content_profile_e8 Title: Health Insurance Portability and Accountability Act (HIPAA) Id: xccdf_org.ssgproject.content_profile_hipaa Title: PCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 9 Id: xccdf_org.ssgproject.content_profile_pci-dss ...
oscap info --profile hipaa /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml ... Profile Title: Health Insurance Portability and Accountability Act (HIPAA) Description: The HIPAA Security Rule establishes U.S. national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. ...
oscap xccdf eval --report <scan-report.html> --profile <profileID> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap-ssh <username> @ <hostname> <port> xccdf eval --report <scan-report.html> --profile <profileID> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap xccdf eval --profile <profileID> --remediate /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap xccdf eval --report <scan-report.html> --profile <profileID> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
ansible-playbook -i localhost, -c local /usr/share/scap-security-guide/ansible/rhel9-playbook-hipaa.yml
oscap xccdf eval --profile hipaa --report <scan-report.html> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap xccdf eval --profile hipaa --results <hipaa-results.xml> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap info <hipaa-results.xml>
oscap xccdf generate fix --fix-type ansible --result-id <xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_hipaa> --output <hipaa-remediations.yml> <hipaa-results.xml>
oscap xccdf eval --profile hipaa --results <hipaa-results.xml> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap info <hipaa-results.xml>
oscap xccdf generate fix --fix-type bash --result-id <xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_hipaa> --output <hipaa-remediations.sh> <hipaa-results.xml>
scap-workbench &
oscap xccdf eval --profile ospp --report eval_postinstall_report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
oscap xccdf eval --profile ospp --report eval_postinstall_report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
wget -O - https://www.redhat.com/security/data/oval/v2/RHEL9/rhel-9.oval.xml.bz2 | bzip2 --decompress > rhel-9.oval.xml
podman images REPOSITORY TAG IMAGE ID CREATED SIZE registry.access.redhat.com/ubi9/ubi latest 096cae65a207 7 weeks ago 239 MB
oscap-podman 096cae65a207 oval eval --report vulnerability.html rhel-9.oval.xml
firefox vulnerability.html &
oscap-podman <ID> xccdf eval --report <scan-report.html> --profile <profileID> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
firefox <scan-report.html> &amp;
dnf install keylime-verifier
[verifier] ip = <verifier_IP_address>
[verifier] database_url = <protocol>://<name>:<password>@<ip_address_or_hostname>/<properties>
[verifier] tls_dir = /var/lib/keylime/cv_ca server_key = </path/to/server_key> server_key_password = <passphrase1> server_cert = </path/to/server_cert> trusted_client_ca = [' </path/to/ca/cert1> ', ' </path/to/ca/cert2> '] client_key = </path/to/client_key> client_key_password = <passphrase2> client_cert = </path/to/client_cert> trusted_server_ca = [' </path/to/ca/cert3> ', ' </path/to/ca/cert4> ']
firewall-cmd --add-port 8881/tcp firewall-cmd --runtime-to-permanent
systemctl enable --now keylime_verifier
systemctl status keylime_verifier ● keylime_verifier.service - The Keylime verifier Loaded: loaded (/usr/lib/systemd/system/keylime_verifier.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2022-11-09 10:10:08 EST; 1min 45s ago
dnf install keylime-verifier
[verifier] ip = *
[verifier] database_url = <protocol>://<name>:<password>@<ip_address_or_hostname>/<properties>
[verifier] tls_dir = /var/lib/keylime/cv_ca server_key = </path/to/server_key> server_cert = </path/to/server_cert> trusted_client_ca = [' </path/to/ca/cert1> ', ' </path/to/ca/cert2> '] client_key = </path/to/client_key> client_cert = </path/to/client_cert> trusted_server_ca = [' </path/to/ca/cert3> ', ' </path/to/ca/cert4> ']
firewall-cmd --add-port 8881/tcp firewall-cmd --runtime-to-permanent
podman run --name keylime-verifier -p 8881:8881 -v /etc/keylime/verifier.conf.d:/etc/keylime/verifier.conf.d:Z -v /var/lib/keylime/cv_ca:/var/lib/keylime/cv_ca:Z -d -e KEYLIME_VERIFIER_SERVER_KEY_PASSWORD= <passphrase1> -e KEYLIME_VERIFIER_CLIENT_KEY_PASSWORD= <passphrase2> registry.access.redhat.com/rhel9/keylime-verifier
podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 80b6b9dbf57c registry.access.redhat.com/rhel9/keylime-verifier:latest keylime_verifier 14 seconds ago Up 14 seconds 0.0.0.0:8881->8881/tcp keylime-verifier
dnf install keylime-registrar
[registrar] ip = <registrar_IP_address>
[registrar] database_url = <protocol>://<name>:<password>@<ip_address_or_hostname>/<properties>
[registrar] tls_dir = /var/lib/keylime/reg_ca server_key = </path/to/server_key> server_key_password = <passphrase1> server_cert = </path/to/server_cert> trusted_client_ca = [' </path/to/ca/cert1> ', ' </path/to/ca/cert2> ']
firewall-cmd --add-port 8890/tcp --add-port 8891/tcp firewall-cmd --runtime-to-permanent
systemctl enable --now keylime_registrar
systemctl status keylime_registrar ● keylime_registrar.service - The Keylime registrar service Loaded: loaded (/usr/lib/systemd/system/keylime_registrar.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2022-11-09 10:10:17 EST; 1min 42s ago
dnf install keylime-registrar
[registrar] ip = *
[registrar] database_url = &lt;protocol&gt;://&lt;name&gt;:&lt;password&gt;@&lt;ip_address_or_hostname&gt;/&lt;properties&gt;
[registrar] tls_dir = /var/lib/keylime/reg_ca server_key = &lt;/path/to/server_key&gt; server_cert = &lt;/path/to/server_cert&gt; trusted_client_ca = [' &lt;/path/to/ca/cert1&gt; ', ' &lt;/path/to/ca/cert2&gt; ']
firewall-cmd --add-port 8890/tcp --add-port 8891/tcp firewall-cmd --runtime-to-permanent
podman run --name keylime-registrar -p 8890:8890 -p 8891:8891 -v /etc/keylime/registrar.conf.d:/etc/keylime/registrar.conf.d:Z -v /var/lib/keylime/reg_ca:/var/lib/keylime/reg_ca:Z -d -e KEYLIME_REGISTRAR_SERVER_KEY_PASSWORD= &lt;passphrase1&gt; registry.access.redhat.com/rhel9/keylime-registrar
podman ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 07d4b4bff1b6 localhost/keylime-registrar:latest keylime_registrar 12 seconds ago Up 12 seconds 0.0.0.0:8881->8881/tcp, 0.0.0.0:8891->8891/tcp keylime-registrar
vi keylime-playbook.yml
--- - name: Manage keylime servers hosts: all vars: keylime_server_verifier_ip: "{{ ansible_host }}" keylime_server_registrar_ip: "{{ ansible_host }}" keylime_server_verifier_tls_dir: <ver_tls_directory > keylime_server_verifier_server_cert: <ver_server_certfile > keylime_server_verifier_server_key: <ver_server_key > keylime_server_verifier_server_key_passphrase: <ver_server_key_passphrase > keylime_server_verifier_trusted_client_ca: <ver_trusted_client_ca_list > keylime_server_verifier_client_cert: <ver_client_certfile > keylime_server_verifier_client_key: <ver_client_key > keylime_server_verifier_client_key_passphrase: <ver_client_key_passphrase > keylime_server_verifier_trusted_server_ca: <ver_trusted_server_ca_list > keylime_server_registrar_tls_dir: <reg_tls_directory > keylime_server_registrar_server_cert: <reg_server_certfile > keylime_server_registrar_server_key: <reg_server_key > keylime_server_registrar_server_key_passphrase: <reg_server_key_passphrase > keylime_server_registrar_trusted_client_ca: <reg_trusted_client_ca_list > roles: - rhel-system-roles.keylime_server
ansible-playbook <keylime-playbook.yml>
systemctl status keylime_verifier ● keylime_verifier.service - The Keylime verifier Loaded: loaded (/usr/lib/systemd/system/keylime_verifier.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2022-11-09 10:10:08 EST; 1min 45s ago
systemctl status keylime_registrar ● keylime_registrar.service - The Keylime registrar service Loaded: loaded (/usr/lib/systemd/system/keylime_registrar.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2022-11-09 10:10:17 EST; 1min 42s ago
dnf install keylime-tenant
[tenant] verifier_ip = <verifier_ip>
[tenant] registrar_ip = <registrar_ip>
[tenant] tls_dir = /var/lib/keylime/cv_ca client_key = tenant-key.pem client_key_password = <passphrase1> client_cert = tenant-cert.pem trusted_server_ca = [' </path/to/ca/cert> ']
keylime_tenant -c cvstatus Reading configuration from ['/etc/keylime/logging.conf'] 2022-10-14 12:56:08.155 - keylime.tpm - INFO - TPM2-TOOLS Version: 5.2 Reading configuration from ['/etc/keylime/tenant.conf'] 2022-10-14 12:56:08.157 - keylime.tenant - INFO - Setting up client TLS 2022-10-14 12:56:08.158 - keylime.tenant - INFO - Using default client_cert option for tenant 2022-10-14 12:56:08.158 - keylime.tenant - INFO - Using default client_key option for tenant 2022-10-14 12:56:08.178 - keylime.tenant - INFO - TLS is enabled. 2022-10-14 12:56:08.178 - keylime.tenant - WARNING - Using default UUID d432fbb3-d2f1-4a97-9ef7-75bd81c00000 2022-10-14 12:56:08.221 - keylime.tenant - INFO - Verifier at 127.0.0.1 with Port 8881 does not have agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000.
keylime_tenant -c regstatus Reading configuration from ['/etc/keylime/logging.conf'] 2022-10-14 12:56:02.114 - keylime.tpm - INFO - TPM2-TOOLS Version: 5.2 Reading configuration from ['/etc/keylime/tenant.conf'] 2022-10-14 12:56:02.116 - keylime.tenant - INFO - Setting up client TLS 2022-10-14 12:56:02.116 - keylime.tenant - INFO - Using default client_cert option for tenant 2022-10-14 12:56:02.116 - keylime.tenant - INFO - Using default client_key option for tenant 2022-10-14 12:56:02.137 - keylime.tenant - INFO - TLS is enabled. 2022-10-14 12:56:02.137 - keylime.tenant - WARNING - Using default UUID d432fbb3-d2f1-4a97-9ef7-75bd81c00000 2022-10-14 12:56:02.171 - keylime.registrar_client - CRITICAL - Error: could not get agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000 data from Registrar Server: 404 2022-10-14 12:56:02.172 - keylime.registrar_client - CRITICAL - Response code 404: agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000 not found 2022-10-14 12:56:02.172 - keylime.tenant - INFO - Agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000 does not exist on the registrar. Please register the agent with the registrar. 2022-10-14 12:56:02.172 - keylime.tenant - INFO - {"code": 404, "status": "Agent d432fbb3-d2f1-4a97-9ef7-75bd81c00000 does not exist on registrar 127.0.0.1 port 8891.", "results": {}}
dnf install keylime-agent
[agent] ip = ' <agent_ip> '
[agent] registrar_ip = ' <registrar_IP_address> '
[agent] uuid = ' <agent_UUID> '
[agent] server_key = ' </path/to/server_key> ' server_key_password = ' <passphrase1> ' server_cert = ' </path/to/server_cert> ' trusted_client_ca = '[ </path/to/ca/cert3> , </path/to/ca/cert4> ]'
firewall-cmd --add-port 9002/tcp firewall-cmd --runtime-to-permanent
systemctl enable --now keylime_agent
keylime_tenant -c regstatus --uuid <agent_uuid> Reading configuration from ['/etc/keylime/logging.conf'] ==\n-----END CERTIFICATE-----\n", "ip": "127.0.0.1", "port": 9002, "regcount": 1, "operational_state": "Registered"}}}
PROC_SUPER_MAGIC = 0x9fa0 dont_measure fsmagic=0x9fa0 SYSFS_MAGIC = 0x62656572 dont_measure fsmagic=0x62656572 DEBUGFS_MAGIC = 0x64626720 dont_measure fsmagic=0x64626720 TMPFS_MAGIC = 0x01021994 dont_measure fsmagic=0x1021994 RAMFS_MAGIC dont_measure fsmagic=0x858458f6 DEVPTS_SUPER_MAGIC=0x1cd1 dont_measure fsmagic=0x1cd1 BINFMTFS_MAGIC=0x42494e4d dont_measure fsmagic=0x42494e4d SECURITYFS_MAGIC=0x73636673 dont_measure fsmagic=0x73636673 SELINUX_MAGIC=0xf97cff8c dont_measure fsmagic=0xf97cff8c SMACK_MAGIC=0x43415d53 dont_measure fsmagic=0x43415d53 NSFS_MAGIC=0x6e736673 dont_measure fsmagic=0x6e736673 EFIVARFS_MAGIC dont_measure fsmagic=0xde5e81e4 CGROUP_SUPER_MAGIC=0x27e0eb dont_measure fsmagic=0x27e0eb CGROUP2_SUPER_MAGIC=0x63677270 dont_measure fsmagic=0x63677270 OVERLAYFS_MAGIC when containers are used we almost always want to ignore them dont_measure fsmagic=0x794c7630 MEASUREMENTS measure func=BPRM_CHECK measure func=FILE_MMAP mask=MAY_EXEC measure func=MODULE_CHECK uid=0
grubby --update-kernel DEFAULT --args 'ima_appraise=fix ima_canonical_fmt ima_policy=tcb ima_template=ima-ng'
systemctl status keylime_agent ● keylime_agent.service - The Keylime compute agent Loaded: loaded (/usr/lib/systemd/system/keylime_agent.service; enabled; preset: disabled) Active: active (running) since
/usr/share/keylime/scripts/create_allowlist.sh -o <allowlist.txt> -h sha256sum
scp <allowlist.txt> root@ <tenant . ip> :/root/ <allowlist.txt>
keylime_create_policy -a <allowlist.txt> -e <excludelist.txt> -o <policy.json>
keylime_tenant -c add -t <agent_ip> -u <agent_uuid> --runtime-policy <policy.json> --cert default
keylime_tenant -c add -t 127.0.0.1 -u d432fbb3-d2f1-4a97-9ef7-75bd81c00000 --runtime-policy policy.json --cert default
keylime_tenant -c cvstatus -u <agent.uuid> {" <agent.uuid> ": {"operational_state": "Get Quote"..."attestation_count": 5
{" <agent.uuid> ": {"operational_state": "Invalid Quote", ... "ima.validation.ima-ng.not_in_allowlist", "attestation_count": 5, "last_received_quote": 1684150329, "last_successful_attestation": 1684150327}}
journalctl -u keylime_verifier keylime.tpm - INFO - Checking IMA measurement list keylime.ima - WARNING - File not found in allowlist: /root/bad-script.sh keylime.ima - ERROR - IMA ERRORS: template-hash 0 fnf 1 hash 0 good 781 keylime.cloudverifier - WARNING - agent D432FBB3-D2F1-4A97-9EF7-75BD81C00000 failed, stopping polling
dnf -y install python3-keylime
/usr/share/keylime/scripts/create_mb_refstate /sys/kernel/security/tpm0/binary_bios_measurements <./measured_boot_reference_state.json>
scp root@ <agent_ip> : <./measured_boot_reference_state.json> <./measured_boot_reference_state.json>
keylime_tenant -c add -t <agent_ip> -u <agent_uuid> --mb_refstate <./measured_boot_reference_state.json> --cert default
keylime_tenant -c cvstatus -u <agent_uuid> {" <agent.uuid> ": {"operational_state": "Get Quote"..."attestation_count": 5
{" <agent.uuid> ": {"operational_state": "Invalid Quote", ... "ima.validation.ima-ng.not_in_allowlist", "attestation_count": 5, "last_received_quote": 1684150329, "last_successful_attestation": 1684150327}}
journalctl -u keylime_verifier {"d432fbb3-d2f1-4a97-9ef7-75bd81c00000": {"operational_state": "Tenant Quote Failed", ... "last_event_id": "measured_boot.invalid_pcr_0", "attestation_count": 0, "last_received_quote": 1684487093, "last_successful_attestation": 0}}
KEYLIME _<SECTION>_<ENVIRONMENT_VARIABLE> = <value>
dnf install aide
aide --init Start timestamp: 2024-07-08 10:39:23 -0400 (AIDE 0.16) AIDE initialized database at /var/lib/aide/aide.db.new.gz Number of entries: 55856 --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db.new.gz ... SHA512 : mZaWoGzL2m6ZcyyZ/AXTIowliEXWSZqx IFYImY4f7id4u+Bq8WeuSE2jasZur/A4 FPBFaBkoCFHdoE/FW/V94Q==
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
aide --check Start timestamp: 2024-07-08 10:43:46 -0400 (AIDE 0.16) AIDE found differences between database and filesystem!! Summary: Total number of entries: 55856 Added entries: 0 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Changed entries: --------------------------------------------------- f ... ..S : /root/.viminfo --------------------------------------------------- Detailed information about changes: --------------------------------------------------- File: /root/.viminfo SELinux : system_u:object_r:admin_home_t:s | unconfined_u:object_r:admin_home 0 | _t:s0 ...
05 4 * * * root /usr/sbin/aide --check
aide --update
umount /dev/mapper/vg00-lv00
lvextend -L+ 32M /dev/mapper/vg00-lv00
cryptsetup reencrypt --encrypt --init-only --reduce-device-size 32M /dev/mapper/ vg00-lv00 lv00_encrypted /dev/mapper/ lv00_encrypted is now active and ready for online encryption.
mount /dev/mapper/ lv00_encrypted /mnt/lv00_encrypted
cryptsetup luksUUID /dev/mapper/ vg00-lv00 a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325
vi /etc/crypttab lv00_encrypted UUID= a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325 none
dracut -f --regenerate-all
blkid -p /dev/mapper/ lv00_encrypted /dev/mapper/ lv00-encrypted : UUID=" 37bc2492-d8fa-4969-9d9b-bb64d3685aa9 " BLOCK_SIZE="4096" TYPE="xfs" USAGE="filesystem"
vi /etc/fstab UUID= 37bc2492-d8fa-4969-9d9b-bb64d3685aa9 /home auto rw,user,auto 0
cryptsetup reencrypt --resume-only /dev/mapper/ vg00-lv00 Enter passphrase for /dev/mapper/ vg00-lv00 : Auto-detected active dm device ' lv00_encrypted ' for data device /dev/mapper/ vg00-lv00 . Finished, time 00:31.130, 10272 MiB written, speed 330.0 MiB/s
cryptsetup luksDump /dev/mapper/ vg00-lv00 LUKS header information Version: 2 Epoch: 4 Metadata area: 16384 [bytes] Keyslots area: 16744448 [bytes] UUID: a52e2cc9-a5be-47b8-a95d-6bdf4f2d9325 Label: (no label) Subsystem: (no subsystem) Flags: (no flags) Data segments: 0: crypt offset: 33554432 [bytes] length: (whole device) cipher: aes-xts-plain64 [...]
cryptsetup status lv00_encrypted /dev/mapper/ lv00_encrypted is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/mapper/ vg00-lv00
umount /dev/ nvme0n1p1
cryptsetup reencrypt --encrypt --init-only --header /home/header /dev/ nvme0n1p1 nvme_encrypted WARNING! ======== Header file does not exist, do you want to create it? Are you sure? (Type 'yes' in capital letters): YES Enter passphrase for /home/header : Verify passphrase: /dev/mapper/ nvme_encrypted is now active and ready for online encryption.
mount /dev/mapper/ nvme_encrypted /mnt/nvme_encrypted
cryptsetup reencrypt --resume-only --header /home/header /dev/ nvme0n1p1 Enter passphrase for /dev/ nvme0n1p1 : Auto-detected active dm device 'nvme_encrypted' for data device /dev/ nvme0n1p1 . Finished, time 00m51s, 10 GiB written, speed 198.2 MiB/s
cryptsetup luksDump /home/header LUKS header information Version: 2 Epoch: 88 Metadata area: 16384 [bytes] Keyslots area: 16744448 [bytes] UUID: c4f5d274-f4c0-41e3-ac36-22a917ab0386 Label: (no label) Subsystem: (no subsystem) Flags: (no flags) Data segments: 0: crypt offset: 0 [bytes] length: (whole device) cipher: aes-xts-plain64 sector: 512 [bytes] [...]
cryptsetup status nvme_encrypted /dev/mapper/ nvme_encrypted is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/ nvme0n1p1
cryptsetup luksFormat /dev/ nvme0n1p1 WARNING! ======== This will overwrite data on /dev/nvme0n1p1 irrevocably. Are you sure? (Type 'yes' in capital letters): YES Enter passphrase for /dev/ nvme0n1p1 : Verify passphrase:
cryptsetup open /dev/ nvme0n1p1 nvme0n1p1_encrypted Enter passphrase for /dev/ nvme0n1p1 :
mkfs -t ext4 /dev/mapper/ nvme0n1p1_encrypted
mount /dev/mapper/ nvme0n1p1_encrypted mount-point
cryptsetup luksDump /dev/ nvme0n1p1 LUKS header information Version: 2 Epoch: 3 Metadata area: 16384 [bytes] Keyslots area: 16744448 [bytes] UUID: 34ce4870-ffdf-467c-9a9e-345a53ed8a25 Label: (no label) Subsystem: (no subsystem) Flags: (no flags) Data segments: 0: crypt offset: 16777216 [bytes] length: (whole device) cipher: aes-xts-plain64 sector: 512 [bytes] [...]
cryptsetup status nvme0n1p1_encrypted /dev/mapper/ nvme0n1p1_encrypted is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/ nvme0n1p1 sector size: 512 offset: 32768 sectors size: 20938752 sectors mode: read/write
ansible-vault create vault.yml New Vault password: <vault_password> Confirm New Vault password: <vault_password>
luks_password: <password>
--- - name: Manage local storage hosts: managed-node-01.example.com vars_files: - vault.yml tasks: - name: Create and configure a volume encrypted with LUKS ansible.builtin.include_role: name: rhel-system-roles.storage vars: storage_volumes: - name: barefs type: disk disks: - sdb fs_type: xfs fs_label: <label> mount_point: /mnt/data encryption: true encryption_password: "{{ luks_password }}"
ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml
ansible-playbook --ask-vault-pass ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'cryptsetup luksUUID /dev/sdb' 4e4e7970-1822-470e-b55a-e91efe5d0f5c
ansible managed-node-01.example.com -m command -a 'cryptsetup status luks-4e4e7970-1822-470e-b55a-e91efe5d0f5c' /dev/mapper/luks-4e4e7970-1822-470e-b55a-e91efe5d0f5c is active and is in use. type: LUKS2 cipher: aes-xts-plain64 keysize: 512 bits key location: keyring device: /dev/sdb
ansible managed-node-01.example.com -m command -a 'cryptsetup luksDump /dev/sdb' LUKS header information Version: 2 Epoch: 3 Metadata area: 16384 [bytes] Keyslots area: 16744448 [bytes] UUID: 4e4e7970-1822-470e-b55a-e91efe5d0f5c Label: (no label) Subsystem: (no subsystem) Flags: (no flags) Data segments: 0: crypt offset: 16777216 [bytes] length: (whole device) cipher: aes-xts-plain64 sector: 512 [bytes]
dnf install tang
semanage port -a -t tangd_port_t -p tcp 7500
firewall-cmd --add-port= 7500 /tcp firewall-cmd --runtime-to-permanent
systemctl enable tangd.socket
systemctl edit tangd.socket
[Socket] ListenStream= ListenStream= 7500
systemctl daemon-reload
systemctl show tangd.socket -p Listen Listen=[::]:7500 (Stream)
systemctl restart tangd.socket
echo test | clevis encrypt tang '{"url":" <tang.server.example.com:7500> "}' -y | clevis decrypt test
cd /var/db/tang ls -l -rw-r--r--. 1 root root 349 Feb 7 14:55 UV6dqXSwe1bRKG3KbJmdiR020hY.jwk -rw-r--r--. 1 root root 354 Feb 7 14:55 y9hxLTQSiSB5jSEGWnjhY8fDTJU.jwk mv UV6dqXSwe1bRKG3KbJmdiR020hY.jwk .UV6dqXSwe1bRKG3KbJmdiR020hY.jwk mv y9hxLTQSiSB5jSEGWnjhY8fDTJU.jwk .y9hxLTQSiSB5jSEGWnjhY8fDTJU.jwk
ls -l total 0
/usr/libexec/tangd-keygen /var/db/tang ls /var/db/tang 3ZWS6-cDrCG61UPJS2BMmPU4I54.jwk zyLuX6hijUy_PSeUEFDi7hi38.jwk
tang-show-keys 7500 3ZWS6-cDrCG61UPJS2BMmPU4I54
clevis luks list -d /dev/sda2 1: tang '{"url":" http://tang.srv "}' clevis luks report -d /dev/sda2 -s 1 Report detected that some keys were rotated. Do you want to regenerate luks metadata with "clevis luks regen -d /dev/sda2 -s 1"? [ynYN]
clevis luks regen -d /dev/sda2 -s 1
cd /var/db/tang rm .*.jwk
tang-show-keys 7500 x100_1k6GPiDOaMlL3WbpCjHOy9ul1bSfdhI3M08wO0
lsinitrd | grep clevis-luks lrwxrwxrwx 1 root root 48 Jan 4 02:56 etc/systemd/system/cryptsetup.target.wants/clevis-luks-askpass.path -> /usr/lib/systemd/system/clevis-luks-askpass.path ...
clevis encrypt tang '{"url":" http://tang.srv:port "}' < input-plain.txt > secret.jwe The advertisement contains the following signing keys: _OsIk0T-E2l6qjfdDiwVmidoZjA Do you wish to trust these keys? [ynYN] y
curl -sfg http://tang.srv:port /adv -o adv.jws
echo 'hello' | clevis encrypt tang '{"url":" http://tang.srv:port ","adv":" adv.jws "}'
clevis decrypt < secret.jwe > output-plain.txt
clevis encrypt tpm2 '{}' < input-plain.txt > secret.jwe
clevis encrypt tpm2 '{"hash":"sha256","key":"rsa"}' < input-plain.txt > secret.jwe
clevis decrypt < secret.jwe > output-plain.txt
clevis encrypt tpm2 '{"pcr_bank":"sha256","pcr_ids":"0,7"}' < input-plain.txt > secret.jwe
clevis encrypt tang Usage: clevis encrypt tang CONFIG < PLAINTEXT > JWE
dnf install clevis-luks
lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 12G 0 disk ├─sda1 8:1 0 1G 0 part /boot └─sda2 8:2 0 11G 0 part └─luks-40e20552-2ade-4954-9d56-565aa7994fb6 253:0 0 11G 0 crypt ├─rhel-root 253:0 0 9.8G 0 lvm / └─rhel-swap 253:1 0 1.2G 0 lvm [SWAP]
clevis luks bind -d /dev/sda2 tang '{"url":" http://tang.srv "}' The advertisement contains the following signing keys: _OsIk0T-E2l6qjfdDiwVmidoZjA Do you wish to trust these keys? [ynYN] y You are about to initialize a LUKS device for metadata storage. Attempting to initialize it may result in data loss if data was already written into the LUKS header gap in a different format. A backup is advised before initialization is performed. Do you wish to initialize /dev/sda2? [yn] y Enter existing LUKS password:
dnf install clevis-dracut
dracut -fv --regenerate-all --hostonly-cmdline
echo "hostonly_cmdline=yes" > /etc/dracut.conf.d/clevis.conf dracut -fv --regenerate-all
grubby --update-kernel=ALL --args="rd.neednet=1"
clevis luks list -d /dev/sda2 1: tang '{"url":"http://tang.srv:port"}'
lsinitrd | grep clevis-luks lrwxrwxrwx 1 root root 48 Jan 4 02:56 etc/systemd/system/cryptsetup.target.wants/clevis-luks-askpass.path -> /usr/lib/systemd/system/clevis-luks-askpass.path ...
dracut -fv --regenerate-all --kernel-cmdline "ip=192.0.2.10::192.0.2.1:255.255.255.0::ens3:none nameserver=192.0.2.100"
cat /etc/dracut.conf.d/static_ip.conf kernel_cmdline="ip=192.0.2.10::192.0.2.1:255.255.255.0::ens3:none nameserver=192.0.2.100" dracut -fv --regenerate-all
dnf install clevis-luks
lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 12G 0 disk ├─sda1 8:1 0 1G 0 part /boot └─sda2 8:2 0 11G 0 part └─luks-40e20552-2ade-4954-9d56-565aa7994fb6 253:0 0 11G 0 crypt ├─rhel-root 253:0 0 9.8G 0 lvm / └─rhel-swap 253:1 0 1.2G 0 lvm [SWAP]
clevis luks bind -d /dev/sda2 tpm2 '{"hash":"sha256","key":"rsa"}' Do you wish to initialize /dev/sda2? [yn] y Enter existing LUKS password:
clevis luks bind -d /dev/sda2 tpm2 '{"hash":"sha256","key":"rsa","pcr_bank":"sha256","pcr_ids":"0,1"}'
dnf install clevis-dracut dracut -fv --regenerate-all
clevis luks list -d /dev/sda2 1: tpm2 '{"hash":"sha256","key":"rsa"}'
clevis luks unbind -d /dev/sda2 -s 1
cryptsetup luksDump /dev/sda2 LUKS header information Version: 2 Keyslots: 0: luks2 1: luks2 Key: 512 bits Priority: normal Cipher: aes-xts-plain64 Tokens: 0: clevis Keyslot: 1
cryptsetup token remove --token-id 0 /dev/sda2
luksmeta wipe -d /dev/sda2 -s 1
cryptsetup luksKillSlot /dev/sda2 1
part /boot --fstype="xfs" --ondisk=vda --size=256 part / --fstype="xfs" --ondisk=vda --grow --encrypted --passphrase=temppass
part /boot --fstype="xfs" --ondisk=vda --size=256 part / --fstype="xfs" --ondisk=vda --size=2048 --encrypted --passphrase=temppass part /var --fstype="xfs" --ondisk=vda --size=1024 --encrypted --passphrase=temppass part /tmp --fstype="xfs" --ondisk=vda --size=1024 --encrypted --passphrase=temppass part /home --fstype="xfs" --ondisk=vda --size=2048 --grow --encrypted --passphrase=temppass part /var/log --fstype="xfs" --ondisk=vda --size=1024 --encrypted --passphrase=temppass part /var/log/audit --fstype="xfs" --ondisk=vda --size=1024 --encrypted --passphrase=temppass
%packages clevis-dracut clevis-luks clevis-systemd %end
%post clevis luks bind -y -k - -d /dev/vda2 tang '{"url":"http://tang.srv"}' <<< "temppass" cryptsetup luksRemoveKey /dev/vda2 <<< "temppass" dracut -fv --regenerate-all %end
%post curl -sfg http://tang.srv/adv -o adv.jws clevis luks bind -f -k - -d /dev/vda2 tang '{"url":"http://tang.srv","adv":"adv.jws"}' <<< "temppass" cryptsetup luksRemoveKey /dev/vda2 <<< "temppass" dracut -fv --regenerate-all %end
dnf install clevis-udisks2
clevis luks bind -d /dev/sdb1 tang '{"url":" http://tang.srv "}'
clevis luks unlock -d /dev/sdb1
clevis luks bind -d /dev/sda1 sss '{"t":1,"pins":{"tang":[{"url":" http://tang1.srv "},{"url":" http://tang2.srv "}]}}'
{ "t":1, "pins":{ "tang":[ { "url":"http://tang1.srv" }, { "url":"http://tang2.srv" } ] } }
clevis luks bind -d /dev/sda1 sss '{"t":2,"pins":{"tang":[{"url":" http://tang1.srv "}], "tpm2": {"pcr_ids":"0,7"}}}'
{ "t":2, "pins":{ "tang":[ { "url":"http://tang1.srv" } ], "tpm2":{ "pcr_ids":"0,7" } } }
podman pull registry.redhat.io/rhel9/tang
podman run -d -p 7500:7500 -v tang-keys:/var/db/tang --name tang registry.redhat.io/rhel9/tang
podman run --rm -v tang-keys:/var/db/tang registry.redhat.io/rhel9/tang tangd-rotate-keys -v -d /var/db/tang Rotated key 'rZAMKAseaXBe0rcKXL1hCCIq-DY.jwk' -> .'rZAMKAseaXBe0rcKXL1hCCIq-DY.jwk' Rotated key 'x1AIpc6WmnCU-CabD8_4q18vDuw.jwk' -> .'x1AIpc6WmnCU-CabD8_4q18vDuw.jwk' Created new key GrMMX_WfdqomIU_4RyjpcdlXb0E.jwk Created new key _dTTfn17sZZqVAp80u3ygFDHtjk.jwk Keys rotated successfully.
echo test | clevis encrypt tang '{"url":"http://localhost:7500"}' | clevis decrypt The advertisement contains the following signing keys: x1AIpc6WmnCU-CabD8_4q18vDuw Do you wish to trust these keys? [ynYN] y test
--- - name: Deploy a Tang server hosts: tang.server.example.com tasks: - name: Install and configure periodic key rotation ansible.builtin.include_role: name: rhel-system-roles.nbde_server vars: nbde_server_rotate_keys: yes nbde_server_manage_firewall: true nbde_server_manage_selinux: true
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'echo test | clevis encrypt tang '{"url":" <tang.server.example.com> "}' -y | clevis decrypt' test
--- - name: Configure clients for unlocking of encrypted volumes by Tang servers hosts: managed-node-01.example.com tasks: - name: Create NBDE client bindings ansible.builtin.include_role: name: rhel-system-roles.nbde_client vars: nbde_client_bindings: - device: /dev/rhel/root encryption_key_src: /etc/luks/keyfile nbde_client_early_boot: true state: present servers: - http://server1.example.com - http://server2.example.com - device: /dev/rhel/swap encryption_key_src: /etc/luks/keyfile servers: - http://server1.example.com - http://server2.example.com
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'clevis luks list -d /dev/rhel/root' 1: tang '{"url":" <http://server1.example.com/> "}' 2: tang '{"url":" <http://server2.example.com/> "}'
ansible managed-node-01.example.com -m command -a 'lsinitrd | grep clevis-luks' lrwxrwxrwx 1 root root 48 Jan 4 02:56 etc/systemd/system/cryptsetup.target.wants/clevis-luks-askpass.path -> /usr/lib/systemd/system/clevis-luks-askpass.path ...
clients: managed-node-01.example.com: ip_v4: 192.0.2.1 gateway_v4: 192.0.2.254 netmask_v4: 255.255.255.0 interface: enp1s0 managed-node-02.example.com: ip_v4: 192.0.2.2 gateway_v4: 192.0.2.254 netmask_v4: 255.255.255.0 interface: enp1s0
- name: Configure clients for unlocking of encrypted volumes by Tang servers hosts: managed-node-01.example.com,managed-node-02.example.com vars_files: - ~/static-ip-settings-clients.yml tasks: - name: Create NBDE client bindings ansible.builtin.include_role: name: rhel-system-roles.network vars: nbde_client_bindings: - device: /dev/rhel/root encryption_key_src: /etc/luks/keyfile servers: - http://server1.example.com - http://server2.example.com - device: /dev/rhel/swap encryption_key_src: /etc/luks/keyfile servers: - http://server1.example.com - http://server2.example.com - name: Configure a Clevis client with static IP address during early boot ansible.builtin.include_role: name: rhel-system-roles.bootloader vars: bootloader_settings: - kernel: ALL options: - name: ip value: "{{ clients[inventory_hostname]['ip_v4'] }}::{{ clients[inventory_hostname]['gateway_v4'] }}:{{ clients[inventory_hostname]['netmask_v4'] }}::{{ clients[inventory_hostname]['interface'] }}:none"
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
# service auditd start
# systemctl enable auditd
auditctl -w /etc/ssh/sshd_config -p warx -k sshd_config
USD cat /etc/ssh/sshd_config
type=SYSCALL msg=audit(1364481363.243:24287): arch=c000003e syscall=2 success=no exit=-13 a0=7fffd19c5592 a1=0 a2=7fffd19c4b50 a3=a items=1 ppid=2686 pid=3538 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=1 comm="cat" exe="/bin/cat" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="sshd_config" type=CWD msg=audit(1364481363.243:24287): cwd="/home/shadowman" type=PATH msg=audit(1364481363.243:24287): item=0 name="/etc/ssh/sshd_config" inode=409248 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=PROCTITLE msg=audit(1364481363.243:24287) : proctitle=636174002F6574632F7373682F737368645F636F6E666967
# ausearch --interpret --exit -13
# find / -inum 409248 -print /etc/ssh/sshd_config
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/selinux/ -p wa -k selinux_changes
auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change
auditctl -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete
auditctl -a always,exit -F exe=/bin/id -F arch=b64 -S execve -k execution_bin_id
auditctl -R /usr/share/audit/sample-rules/30-stig.rules
cd /usr/share/audit/sample-rules/ cp 10-base-config.rules 30-stig.rules 31-privileged.rules 99-finalize.rules /etc/audit/rules.d/ augenrules --load
augenrules --load /sbin/augenrules: No change No rules enabled 1 failure 1 pid 742 rate_limit 0
cp -f /usr/lib/systemd/system/auditd.service /etc/systemd/system/
vi /etc/systemd/system/auditd.service
#ExecStartPost=-/sbin/augenrules --load ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
systemctl daemon-reload
service auditd restart
cp /usr/share/audit/sample-rules/44-installers.rules /etc/audit/rules.d/
augenrules --load
auditctl -l -p x-w /usr/bin/dnf-3 -k software-installer -p x-w /usr/bin/yum -k software-installer -p x-w /usr/bin/pip -k software-installer -p x-w /usr/bin/npm -k software-installer -p x-w /usr/bin/cpan -k software-installer -p x-w /usr/bin/gem -k software-installer -p x-w /usr/bin/luarocks -k software-installer
dnf reinstall -y vim-enhanced
ausearch -ts recent -k software-installer ---- time->Thu Dec 16 10:33:46 2021 type=PROCTITLE msg=audit(1639668826.074:298): proctitle=2F7573722F6C6962657865632F706C6174666F726D2D707974686F6E002F7573722F62696E2F646E66007265696E7374616C6C002D790076696D2D656E68616E636564 type=PATH msg=audit(1639668826.074:298): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=10092 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1639668826.074:298): item=1 name="/usr/libexec/platform-python" inode=4618433 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1639668826.074:298): item=0 name="/usr/bin/dnf" inode=6886099 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:rpm_exec_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1639668826.074:298): cwd="/root" type=EXECVE msg=audit(1639668826.074:298): argc=5 a0="/usr/libexec/platform-python" a1="/usr/bin/dnf" a2="reinstall" a3="-y" a4="vim-enhanced" type=SYSCALL msg=audit(1639668826.074:298): arch=c000003e syscall=59 success=yes exit=0 a0=55c437f22b20 a1=55c437f2c9d0 a2=55c437f2aeb0 a3=8 items=3 ppid=5256 pid=5375 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="dnf" exe="/usr/libexec/platform-python3.6" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="software-installer"
ausearch -m USER_LOGIN -ts ' 12/02/2020 ' ' 18:00:00 ' -sv no time->Mon Nov 22 07:33:22 2021 type=USER_LOGIN msg=audit(1637584402.416:92): pid=1939 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=10.37.128.108 terminal=ssh res=failed'
ausearch --raw | aulast --stdin root ssh 10.37.128.108 Mon Nov 22 07:33 - 07:33 (00:00) root ssh 10.37.128.108 Mon Nov 22 07:33 - 07:33 (00:00) root ssh 10.22.16.106 Mon Nov 22 07:40 - 07:40 (00:00) reboot system boot 4.18.0-348.6.el8 Mon Nov 22 07:33
aureport --login -i Login Report ============================================ date time auid host term exe success event ============================================ 1. 11/16/2021 13:11:30 root 10.40.192.190 ssh /usr/sbin/sshd yes 6920 2. 11/16/2021 13:11:31 root 10.40.192.190 ssh /usr/sbin/sshd yes 6925 3. 11/16/2021 13:11:31 root 10.40.192.190 ssh /usr/sbin/sshd yes 6930 4. 11/16/2021 13:11:31 root 10.40.192.190 ssh /usr/sbin/sshd yes 6935 5. 11/16/2021 13:11:33 root 10.40.192.190 ssh /usr/sbin/sshd yes 6940 6. 11/16/2021 13:11:33 root 10.40.192.190 /dev/pts/0 /usr/sbin/sshd yes 6945
dnf install fapolicyd
vi /etc/fapolicyd/fapolicyd.conf
permissive = 1
systemctl enable --now fapolicyd
auditctl -w /etc/fapolicyd/ -p wa -k fapolicyd_changes service try-restart auditd
ausearch -ts recent -m fanotify
systemctl restart fapolicyd
systemctl status fapolicyd ● fapolicyd.service - File Access Policy Daemon Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; preset: disabled) Active: active (running) since Tue 2024-10-08 05:53:50 EDT; 11s ago ... Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Loading trust data from rpmdb backend Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Loading trust data from file backend Oct 08 05:53:51 machine1.example.com fapolicyd[4974]: Starting to listen for events
cp /bin/ls /tmp /tmp/ls bash: /tmp/ls: Operation not permitted
cp /bin/ls /tmp /tmp/ls bash: /tmp/ls: Operation not permitted
fapolicyd-cli --file add /tmp/ls --trust-file myapp
fapolicyd-cli --update
/tmp/ls ls
cp /bin/ls /tmp /tmp/ls bash: /tmp/ls: Operation not permitted
systemctl stop fapolicyd
fapolicyd --debug-deny 2> fapolicy.output & [1] 51341
/tmp/ls bash: /tmp/ls: Operation not permitted
fg fapolicyd --debug 2> fapolicy.output ^C
kill 51341
cat fapolicy.output | grep 'deny_audit' rule=13 dec=deny_audit perm=execute auid=0 pid=6855 exe=/usr/bin/bash : path=/tmp/ls ftype=application/x-executable trust=0
ls /etc/fapolicyd/rules.d/ 10-languages.rules 40-bad-elf.rules 72-shell.rules 20-dracut.rules 41-shared-obj.rules 90-deny-execute.rules 21-updaters.rules 42-trusted-elf.rules 95-allow-open.rules 30-patterns.rules 70-trusted-lang.rules cat /etc/fapolicyd/rules.d/90-deny-execute.rules Deny execution for anything untrusted deny_audit perm=execute all : all
touch /etc/fapolicyd/rules.d/80-myapps.rules vi /etc/fapolicyd/rules.d/80-myapps.rules
allow perm=execute exe=/usr/bin/bash trust=1 : path=/tmp/ls ftype=application/x-executable trust=0
allow perm=execute exe=/usr/bin/bash trust=1 : dir=/tmp/ trust=0
sha256sum /tmp/ls 780b75c90b2d41ea41679fcb358c892b1251b68d1927c80fbc0d9d148b25e836 ls
allow perm=execute exe=/usr/bin/bash trust=1 : sha256hash= 780b75c90b2d41ea41679fcb358c892b1251b68d1927c80fbc0d9d148b25e836
fagenrules --check /usr/sbin/fagenrules: Rules have changed and should be updated fagenrules --load
fapolicyd-cli --list 13. allow perm=execute exe=/usr/bin/bash trust=1 : path=/tmp/ls ftype=application/x-executable trust=0 14. deny_audit perm=execute all : all
systemctl start fapolicyd
/tmp/ls ls
vi /etc/fapolicyd/fapolicyd.conf
integrity = sha256
systemctl restart fapolicyd
cp /bin/more /bin/more.bak
cat /bin/less > /bin/more
su example.user /bin/more /etc/redhat-release bash: /bin/more: Operation not permitted
mv -f /bin/more.bak /bin/more
rpm -i application .rpm
fapolicyd-cli --update
systemctl status fapolicyd
fapolicyd-cli --check-config Daemon config is OK fapolicyd-cli --check-trustdb /etc/selinux/targeted/contexts/files/file_contexts miscompares: size sha256 /etc/selinux/targeted/policy/policy.31 miscompares: size sha256
fapolicyd-cli --list 9. allow perm=execute all : trust=1 10. allow perm=open all : ftype=%languages trust=1 11. deny_audit perm=any all : ftype=%languages 12. allow perm=any all : ftype=text/x-shellscript 13. deny_audit perm=execute all : all
systemctl stop fapolicyd
fapolicyd --debug
fapolicyd --debug 2> fapolicy.output
fapolicyd --debug-deny
fapolicyd --debug-deny --permissive
systemctl stop fapolicyd fapolicyd-cli --delete-db
fapolicyd-cli --dump-db
rm -f /var/run/fapolicyd/fapolicyd.fifo
--- - name: Configuring fapolicyd hosts: managed-node-01.example.com tasks: - name: Allow only executables installed from RPM database and specific files ansible.builtin.include_role: name: rhel-system-roles.fapolicyd vars: fapolicyd_setup_permissive: false fapolicyd_setup_integrity: sha256 fapolicyd_setup_trust: rpmdb,file fapolicyd_add_trusted_file: - <path_to_allowed_command> - <path_to_allowed_service>
ansible-playbook ~/playbook.yml --syntax-check
ansible-playbook ~/playbook.yml
ansible managed-node-01.example.com -m command -a 'su -c "/bin/not_authorized_application " <user_name> ' bash: line 1: /bin/not_authorized_application: Operation not permitted non-zero return code
dnf install usbguard
usbguard generate-policy > /etc/usbguard/rules.conf
systemctl enable --now usbguard
systemctl status usbguard ● usbguard.service - USBGuard daemon Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2019-11-07 09:44:07 CET; 3min 16s ago Docs: man:usbguard-daemon(8) Main PID: 6122 (usbguard-daemon) Tasks: 3 (limit: 11493) Memory: 1.2M CGroup: /system.slice/usbguard.service └─6122 /usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf Nov 07 09:44:06 localhost.localdomain systemd[1]: Starting USBGuard daemon Nov 07 09:44:07 localhost.localdomain systemd[1]: Started USBGuard daemon.
usbguard list-devices 4: allow id 1d6b:0002 serial "0000:02:00.0" name "xHCI Host Controller" hash
usbguard list-devices 1: allow id 1d6b:0002 serial "0000:00:06.7" name "EHCI Host Controller" hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" parent-hash "4PHGcaDKWtPjKDwYpIRG722cB9SlGz9l9Iea93+Gt9c=" via-port "usb1" with-interface 09:00:00 6: block id 1b1c:1ab1 serial "000024937962" name "Voyager" hash "CrXgiaWIf2bZAU+5WkzOE7y0rdSO82XMzubn7HDb95Q=" parent-hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" via-port "1-3" with-interface 08:06:50
usbguard allow-device <6>
usbguard reject-device <6>
usbguard block-device <6>
semanage boolean -l | grep usbguard usbguard_daemon_write_conf (off , off) Allow usbguard to daemon write conf usbguard_daemon_write_rules (on , on) Allow usbguard to daemon write rules
semanage boolean -m --on usbguard_daemon_write_rules
usbguard list-devices 1: allow id 1d6b:0002 serial "0000:00:06.7" name "EHCI Host Controller" hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" parent-hash "4PHGcaDKWtPjKDwYpIRG722cB9SlGz9l9Iea93+Gt9c=" via-port "usb1" with-interface 09:00:00 6 : block id 1b1c:1ab1 serial "000024937962" name "Voyager" hash "CrXgiaWIf2bZAU+5WkzOE7y0rdSO82XMzubn7HDb95Q=" parent-hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" via-port "1-3" with-interface 08:06:50
usbguard allow-device 6 -p
usbguard reject-device 6 -p
usbguard block-device 6 -p
usbguard list-rules
usbguard generate-policy --no-hashes > ./rules.conf
vi ./rules.conf
allow with-interface equals { 08:*:* }
install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
systemctl restart usbguard
usbguard list-rules 4: allow with-interface 08:*:*
usbguard generate-policy --no-hashes > ./ policy.conf
vi ./ policy.conf allow id 04f2:0833 serial "" name "USB Keyboard" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
grep " USB Keyboard " ./ policy.conf > ./ 10keyboards.conf
install -m 0600 -o root -g root 10keyboards.conf /etc/usbguard/rules.d/ 10keyboards.conf
grep -v " USB Keyboard " ./policy.conf > ./rules.conf
install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
systemctl restart usbguard
usbguard list-rules 15: allow id 04f2:0833 serial "" name "USB Keyboard" hash "kxM/iddRe/WSCocgiuQlVs6Dn0VEza7KiHoDeTz0fyg=" parent-hash "2i6ZBJfTl5BakXF7Gba84/Cp1gslnNc1DM6vWQpie3s=" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
cat /etc/usbguard/rules.conf /etc/usbguard/rules.d/*.conf
vi /etc/usbguard/usbguard-daemon.conf
IPCAllowGroups=wheel
usbguard add-user joesec --devices ALL --policy modify,list --exceptions ALL
systemctl restart usbguard
vi /etc/usbguard/usbguard-daemon.conf
AuditBackend=LinuxAudit
systemctl restart usbguard
ausearch -ts recent -m USER_DEVICE
dnf install rsyslog-doc
firefox /usr/share/doc/rsyslog/html/index.html &
semanage port -a -t syslogd_port_t -p tcp 30514
firewall-cmd --zone= <zone-name> --permanent --add-port=30514/tcp success firewall-cmd --reload
Define templates before the rules that use them Per-Host templates for remote systems template(name="TmplAuthpriv" type="list") { constant(value="/var/log/remote/auth/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } template(name="TmplMsg" type="list") { constant(value="/var/log/remote/msg/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } Provides TCP syslog reception module(load="imtcp") Adding this ruleset to process remote messages ruleset(name="remote1"){ authpriv.* action(type="omfile" DynaFile="TmplAuthpriv") *.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg") } input(type="imtcp" port="30514" ruleset="remote1")
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run rsyslogd: End of config validation run. Bye.
systemctl status rsyslog
systemctl restart rsyslog
systemctl enable rsyslog
*.* action(type="omfwd" queue.type="linkedlist" queue.filename="example_fwd" action.resumeRetryCount="-1" queue.saveOnShutdown="on" target="example.com" port="30514" protocol="tcp" )
systemctl restart rsyslog
logger test
cat /var/log/remote/msg/ hostname /root.log Feb 25 03:53:17 hostname root[6064]: test
Set certificate files global( DefaultNetstreamDriverCAFile="/etc/pki/ca-trust/source/anchors/ca-cert.pem" DefaultNetstreamDriverCertFile="/etc/pki/ca-trust/source/anchors/server-cert.pem" DefaultNetstreamDriverKeyFile="/etc/pki/ca-trust/source/anchors/server-key.pem" ) TCP listener module( load="imtcp" PermittedPeer=["client1.example.com", "client2.example.com"] StreamDriver.AuthMode="x509/name" StreamDriver.Mode="1" StreamDriver.Name="ossl" ) Start up listener at port 514 input( type="imtcp" port="514" )
input( type="imtcp" Port="50515" StreamDriver.Name=" <driver> " streamdriver.CAFile="/etc/rsyslog.d/ <ca1> .pem" streamdriver.CertFile="/etc/rsyslog.d/ <server1-cert> .pem" streamdriver.KeyFile="/etc/rsyslog.d/ <server1-key> .pem" )
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run (level 1) rsyslogd: End of config validation run. Bye.
systemctl status rsyslog
systemctl restart rsyslog
systemctl enable rsyslog
Set certificate files global( DefaultNetstreamDriverCAFile="/etc/pki/ca-trust/source/anchors/ca-cert.pem" DefaultNetstreamDriverCertFile="/etc/pki/ca-trust/source/anchors/client-cert.pem" DefaultNetstreamDriverKeyFile="/etc/pki/ca-trust/source/anchors/client-key.pem" ) Set up the action for all messages *.* action( type="omfwd" StreamDriver="ossl" StreamDriverMode="1" StreamDriverPermittedPeers="server.example.com" StreamDriverAuthMode="x509/name" target="server.example.com" port="514" protocol="tcp" )
local1.* action( type="omfwd" StreamDriver="<driver>" StreamDriverMode="1" StreamDriverAuthMode="x509/certvalid" streamDriver.CAFile="/etc/rsyslog.d/<ca1>.pem" streamDriver.CertFile="/etc/rsyslog.d/<client1-cert>.pem" streamDriver.KeyFile="/etc/rsyslog.d/<client1-key>.pem" target="server.example.com" port="514" protocol="tcp" )
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run (level 1) rsyslogd: End of config validation run. Bye.
systemctl status rsyslog
systemctl restart rsyslog
systemctl enable rsyslog
logger test
cat /var/log/remote/msg/ <hostname> /root.log Feb 25 03:53:17 <hostname> root[6064]: test
semanage port -a -t syslogd_port_t -p udp portno
firewall-cmd --zone= zone --permanent --add-port= portno /udp success firewall-cmd --reload
firewall-cmd --reload
Define templates before the rules that use them Per-Host templates for remote systems template(name="TmplAuthpriv" type="list") { constant(value="/var/log/remote/auth/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } template(name="TmplMsg" type="list") { constant(value="/var/log/remote/msg/") property(name="hostname") constant(value="/") property(name="programname" SecurePath="replace") constant(value=".log") } Provides UDP syslog reception module(load="imudp") This ruleset processes remote messages ruleset(name="remote1"){ authpriv.* action(type="omfile" DynaFile="TmplAuthpriv") *.info;mail.none;authpriv.none;cron.none action(type="omfile" DynaFile="TmplMsg") } input(type="imudp" port="514" ruleset="remote1")
rsyslogd -N 1 rsyslogd: version 8.1911.0-2.el8, config validation run
systemctl restart rsyslog
systemctl enable rsyslog
*.* action(type="omfwd" queue.type="linkedlist" queue.filename=" example_fwd " action.resumeRetryCount="-1" queue.saveOnShutdown="on" target=" example.com " port=" portno " protocol="udp" )
systemctl restart rsyslog
systemctl enable rsyslog
logger test
cat /var/log/remote/msg/ hostname /root.log Feb 25 03:53:17 hostname root[6064]: test
action(type="omfwd" protocol="tcp" RebindInterval="250" target=" example.com " port="514" ...) action(type="omfwd" protocol="udp" RebindInterval="250" target=" example.com " port="514" ...) action(type="omrelp" RebindInterval="250" target=" example.com " port="6514" ...)
module(load="omrelp") *.* action(type="omrelp" target="_target_IP_" port="_target_port_")
systemctl restart rsyslog
systemctl enable rsyslog
ruleset(name="relp"){ *.* action(type="omfile" file="_log_path_") } module(load="imrelp") input(type="imrelp" port="_target_port_" ruleset="relp")
systemctl restart rsyslog
systemctl enable rsyslog
logger test
cat /var/log/remote/msg/hostname/root.log Feb 25 03:53:17 hostname root[6064]: test
ls /usr/lib64/rsyslog/{i,o}m *
dnf install netconsole-service
SYSLOGADDR= 192.0.2.1
systemctl enable --now netconsole
--- - name: Deploy the logging solution hosts: managed-node-01.example.com tasks: - name: Filter logs based on a specific value they contain ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: files_input type: basics logging_outputs: - name: files_output0 type: files property: msg property_op: contains property_value: error path: /var/log/errors.log - name: files_output1 type: files property: msg property_op: "!contains" property_value: error path: /var/log/others.log logging_flows: - name: flow0 inputs: [files_input] outputs: [files_output0, files_output1]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
rsyslogd -N 1 rsyslogd: version 8.1911.0-6.el8, config validation run rsyslogd: End of config validation run. Bye.
logger error
cat /var/log/errors.log Aug 5 13:48:31 hostname root[6778]: error
--- - name: Deploy the logging solution hosts: managed-node-01.example.com tasks: - name: Configure the server to receive remote input ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: remote_udp_input type: remote udp_ports: [ 601 ] - name: remote_tcp_input type: remote tcp_ports: [ 601 ] logging_outputs: - name: remote_files_output type: remote_files logging_flows: - name: flow_0 inputs: [remote_udp_input, remote_tcp_input] outputs: [remote_files_output] - name: Deploy the logging solution hosts: managed-node-02.example.com tasks: - name: Configure the server to output the logs to local files in directories named by remote host names ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: basic_input type: basics logging_outputs: - name: forward_output0 type: forwards severity: info target: <host1.example.com> udp_port: 601 - name: forward_output1 type: forwards facility: mail target: <host1.example.com> tcp_port: 601 logging_flows: - name: flows0 inputs: [basic_input] outputs: [forward_output0, forward_output1] [basic_input] [forward_output0, forward_output1]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
rsyslogd -N 1 rsyslogd: version 8.1911.0-6.el8, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: End of config validation run. Bye.
logger test
cat /var/log/ <host2.example.com> /messages Aug 5 13:48:31 <host2.example.com> root[6778]: test
--- - name: Configure remote logging solution using TLS for secure transfer of logs hosts: managed-node-01.example.com tasks: - name: Deploying files input and forwards output with certs ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_certificates: - name: logging_cert dns: ['localhost', 'www.example.com'] ca: ipa logging_pki_files: - ca_cert: /local/path/to/ca_cert.pem cert: /local/path/to/logging_cert.pem private_key: /local/path/to/logging_cert.pem logging_inputs: - name: input_name type: files input_log_path: /var/log/containers/*.log logging_outputs: - name: output_name type: forwards target: your_target_host tcp_port: 514 tls: true pki_authmode: x509/name permitted_server: 'server.example.com' logging_flows: - name: flow_name inputs: [input_name] outputs: [output_name]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Configure remote logging solution using TLS for secure transfer of logs hosts: managed-node-01.example.com tasks: - name: Deploying remote input and remote_files output with certs ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_certificates: - name: logging_cert dns: ['localhost', 'www.example.com'] ca: ipa logging_pki_files: - ca_cert: /local/path/to/ca_cert.pem cert: /local/path/to/logging_cert.pem private_key: /local/path/to/logging_cert.pem logging_inputs: - name: input_name type: remote tcp_ports: 514 tls: true permitted_clients: ['clients.example.com'] logging_outputs: - name: output_name type: remote_files remote_log_path: /var/log/remote/%FROMHOST%/%PROGRAMNAME:::secpath-replace%.log async_writing: true client_count: 20 io_buffer_size: 8192 logging_flows: - name: flow_name inputs: [input_name] outputs: [output_name]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Configure client-side of the remote logging solution using RELP hosts: managed-node-01.example.com tasks: - name: Deploy basic input and RELP output ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: basic_input type: basics logging_outputs: - name: relp_client type: relp target: logging.server.com port: 20514 tls: true ca_cert: /etc/pki/tls/certs/ca.pem cert: /etc/pki/tls/certs/client-cert.pem private_key: /etc/pki/tls/private/client-key.pem pki_authmode: name permitted_servers: - '*.server.example.com' logging_flows: - name: example_flow inputs: [basic_input] outputs: [relp_client]
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml
--- - name: Configure server-side of the remote logging solution using RELP hosts: managed-node-01.example.com tasks: - name: Deploying remote input and remote_files output ansible.builtin.include_role: name: rhel-system-roles.logging vars: logging_inputs: - name: relp_server type: relp port: 20514 tls: true ca_cert: /etc/pki/tls/certs/ca.pem cert: /etc/pki/tls/certs/server-cert.pem private_key: /etc/pki/tls/private/server-key.pem pki_authmode: name permitted_clients: - '*example.client.com' logging_outputs: - name: remote_files_output type: remote_files logging_flows: - name: example_flow inputs: relp_server outputs: remote_files_output
ansible-playbook --syntax-check ~/playbook.yml
ansible-playbook ~/playbook.yml