January 27, 2017 AWS CentOS: New CIS Hardened ImagesOperating SystemsBy Rich AllowayIt's important to use STIG and CIS hardened images for CentOS on AWS. In this blog, we give you an overview of our new AWS CentOS images, which are STIG and CIS hardened.FAQ: New AWS CentOS ImagesIn addition to the CentOS 6.8 and 7.3 images that we released earlier in January 2017, we are happy to announce updated images for our security-hardened offerings. These enhanced security images include the same support that is included with our other images that are available in the AWS Marketplace.What Does OpenLogic Mean by Security-Hardened Images?We have taken our standard images and modified them to increase the security of the images by minimizing your system’s exposure to outside threats and taking full advantage of mature solutions like SELinux and auditing.Are Security-Hardened Images Difficult to Use?Not at all! You can have an instance of any of our images up and running in minutes. Here’s a demo on how to launch one of our security-hardened images, but the process is the same for our standard images:As with our standard images, our security-hardened AWS images are minimal by design, taking up as little space as is necessary to provide a fully-functional AWS instance. This maximizes the available space for you to customize the instance to meet your specific needs.Get the CentOS AWS ImagesDownload any of the OpenLogic CentOS images — standard or security-hardened — on the AWS marketplace.AWS MARKETPLACESTIG & CIS Hardened Images: What This MeansOur AWS CentOS images are STIG and CIS hardened. This includes the CIS Level 1, CIS Level 2, and STIGs security profiles.There are certain security measures that cannot be applied to CentOS AWS images — or are not appropriate for CentOS AWS images. The complete exclusion list is detailed below.AWS CentOS Images: ExclusionsOur AWS images consist of a single partition, excluding the following:CIS 1.1.1 – Separate Partition for /tmpCIS 1.1.2 – Add nodev Option to /tmpCIS 1.1.3 – Add nosuid Option to /tmpCIS 1.1.4 – Add noexec Option to /tmpCIS 1.1.5 – Separate Partition for /varCIS 1.1.7 – Separate Partition for /var/logCIS 1.1.8 – Separate Partition for /var/log/auditCIS 1.1.9 – Separate Partition for /homeAWS images do not have removable media, excluding the following:CIS 1.1.11 – Add nodev Option to Removable Media PartitionsCIS 1.1.12 – Add noexec Option to Removable Media PartitionsCIS 1.1.13 – Add nosuid Option to Removable Media PartitionsAWS instances do not allow access to the bootloader or console when the instance is started, excluding the following:CIS 1.5.3 – Set Boot Loader PasswordSTIGs – Encrypt PartitionsOur AWS images are fresh installs from official media, excluding the following:CIS 1.2.3 – Ensure Software Patches are InstalledCIS 1.2.4 – RPM Package IntegrityCIS 9.1.1 – Verify System File PermissionsSTIGs - Ensure No Device Files are Unlabeled by SELinuxOur AWS images include the chrony package and do not include the NTP package, excluding the following:CIS 3.6 – Configure NTPAWS images do not have wireless interfaces:CIS 4.3.1 – Deactivate Wireless Network InterfacesOur AWS images do not use TCP Wrappers (since it is impossible to know where our customers will connect to the instances from), excluding the following:CIS 4.5.4 – Create /etc/hosts.denyAWS images are firewalled by the EC2 security groups, excluding the following:CIS 4.7 – Enable iptables/firewalldCIS 4.8 – Enable ip6tablesSTIGs – Set Default iptables Policy for Forwarded PacketsSTIGs – Set Default iptables/ip6tables Policy for Incoming PacketsCIS and STIGs conflict, excluding the following:CIS 5.2.1.2 – Configure auditd admin_space_left Action on Low Disk SpaceSTIGs - Configure auditd admin_space_left Action on Low Disk SpaceSTIGs – Configure LDAP Client To Use TLS For All TransactionsOur AWS images only have a single user account (centos) created by the CentOS installer, so we do not restrict user access, excluding the following:CIS 6.2.13 – Limit Access via SSHCIS 9.2.16 – Check That Reserved UIDs Are Assigned to System AccountsOur AWS images are explicitly configured to not display a SSH banner, excluding the following:CIS 6.2.14 – Set SSH BannerOur AWS images do not contain any non-open source software, excluding the following:McAfee VirusScan Enterprise for LinuxMcAfee Host-based Security System (HBSS) – not generally available to non-US Government entitiesSTIGs – Endpoint Protection SoftwareEven with these exceptions, our images pass well over 200 security tests prescribed in the CIS 1, CIS 2, and STIGs profiles. The results of the tests is available within the instances in the /var/log/hardened/ directory.Why Use OpenLogic STIG and CIS Hardened Images?Our automated image hardening process enables us to replicate our image building process with both speed and accuracy. Before we automated the process, it would take us over 8 hours to manually apply the security hardening recommendations to each image that we built, which was then put through rigorous quality assurance (QA) to ensure that we did not miss any steps and that each step was correctly applied.Even after automating our hardening process, we still put our images through the same rigorous QA to ensure that each image that we release is complete, functional, and hardened the same way.Sure, you could spend hours performing all of these steps yourself each time a new CentOS release is announced, but why would you want to? Our images are vetted, available and, best of all, include support from our team of Tier 3/4 open source architects and engineers.Need Additional Assistance?The AWS images include 9x5 support which may very well cover your support needs. But if you need 24x7 support, you're better off getting in touch with the OpenLogic CentOS experts. Our experts can help you ensure security with CentOS on AWS — and so much more.In fact, when you choose CentOS supported by OpenLogic, you'll get:50% cost-savings.Long-term support.Backporting.Guaranteed SLAs.Architectural minimization.Multi-platform support.CentOS distributions.Expert guidance.Supported CentOS options in Microsoft Azure and Amazon Web Services (AWS).Get in touch with a CentOS expert today to learn how we can help you.Talk to an Expert Related Content:CentOS 6 EOLCentOS 8 FeaturesCentOS Guide
Rich AllowayEnterprise Linux Developer, OpenLogic by Perforce Rich Alloway has over 25 years of professional Linux experience in academic, Internet service provider and telco carrier environments. He has filled many production roles: SysAdmin, Systems/Network/RF Engineer and CTO. He is currently a member of the Enterprise Linux Team at OpenLogic by Perforce, specializing in CentOS.
April 6, 2021 Google vs. Oracle Supreme Court Ruling: Overview and Potential ImpactOperating SystemsOpen Source