Monday, April 28, 2014

Questions asked by Bastille Linux and sensible defaults suggested

There are about 26 questions asked by Bastille linux when you run "$bastille -c" in the order below:-


  1. Q: Would you like to set more restrictive permissions on the administration utilities? [N]
  2. Q: Would you like to disable SUID status for mount/umount?[Y]
  3. Q: Would you like to disable SUID status for ping? [Y]
  4. Q: Would you like to disable SUID status for at? [Y]
  5. Q: Would you like to disable SUID status for usernetctl? [Y]
  6. Q: Should Bastille disable clear-text r-protocols that use IP-based authentication? [Y]
  7. Q: Would you like to enforce password aging? [Y]
  8. Q: Do you want to set the default umask? [Y]
  9. Q: What umask would you like to set for users on the system? [077]
  10. Q: Should we disallow root login on tty's 1-6? [N]
  11. Q: Would you like to password-protect the GRUB prompt? [N]
  12. Q: Would you like to password protect single-user mode? [Y]
  13. Q: Would you like to set a default-deny on TCP Wrappers and xinetd? [N]Not recommended for most users
  14. Q: Would you like to display "Authorized Use" messages at log-in time[Y]
  15. Q: Who is responsible for granting authorization to use this machine?
  16. Q: Would you like to put limits on system resource usage? [N]
  17. Q: Should we restrict console access to a small group of user accounts? [N]
  18. Q: Would you like to add additional logging? [Y]
  19. Q: Do you have a remote logging host? [N]
  20. Q: Would you like to set up process accounting? [N]
  21. Q: Would you like to deactivate NFS and Samba? [Y]
  22. Q: Would you like to deactivate the HP OfficeJet (hpoj) script on this machine?[Y]
  23. Q: Would you like to deactivate the ISDN script on this machine?[Y]
  24. Q: Would you like to install TMPDIR/TMP scripts? [N]->[Y]
  25. Q: Would you like to run the packet filtering script? [N]
  26. Q: Are you finished answering the questions, i.e. may we make the changes?[Y]


Once you answer yes [Y] to the last question, bastille linux will make the appropriate modifications to the system. Additionally, you can run a report using command

$sudo bastille --report

and the reports will be stored under /var/log/Bastille/Assessment/assessment-report.txt. It also contains a net score of how hard the system is, e.g. 8.87/10 based on the options you have chosen for the questions it prompted.


No comments:

Post a Comment