WorldDrknss/Guide-to-AlmaLinux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vscode-server

Browse Source
This commit is contained in:
Charles Showalter 2023-01-27 18:37:58 +00:00
parent 5cde8f6840
commit 2c7d43644e
2 changed files with 236 additions and 236 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
LICENSE
View File

@ -1,9 +1,9 @@
MIT License MIT License
Copyright (c) <year> <copyright holders> Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

454
README.md
View File

@ -1,228 +1,228 @@
<div id="top"></div> <div id="top"></div>
<!-- PROJECT LOGO --> <!-- PROJECT LOGO -->
<br /> <br />
<div align="center"> <div align="center">
<a href="https://github.com/github_username/repo_name"> <a href="https://github.com/github_username/repo_name">
<img src="images/almalinux.jpg" alt="Logo"> <img src="images/almalinux.jpg" alt="Logo">
</a> </a>
<h3 align="center">AlmaLinux</h3> <h3 align="center">AlmaLinux</h3>
<p align="center"> <p align="center">
Gettings started with AlmaLinux Gettings started with AlmaLinux
<br /> <br />
<br /> <br />
<a href="https://labs.xtechnology.org/cshowalter/SkyNet/issues">Report Bug</a> <a href="https://labs.xtechnology.org/cshowalter/SkyNet/issues">Report Bug</a>
· ·
<a href="https://labs.xtechnology.org/cshowalter/SkyNet/issues">Request Feature</a> <a href="https://labs.xtechnology.org/cshowalter/SkyNet/issues">Request Feature</a>
</p> </p>
</div> </div>
<!-- TABLE OF CONTENTS --> <!-- TABLE OF CONTENTS -->
<details> <details>
<summary>Table of Contents</summary> <summary>Table of Contents</summary>
<ol> <ol>
<li> <li>
<a href="#about-the-project">About The Project</a> <a href="#about-the-project">About The Project</a>
<ul> <ul>
<li><a href="#built-with">Built With</a></li> <li><a href="#built-with">Built With</a></li>
</ul> </ul>
</li> </li>
<li> <li>
<a href="#getting-started">Getting Started</a> <a href="#getting-started">Getting Started</a>
<ul> <ul>
<li><a href="#prerequisites">Prerequisites</a></li> <li><a href="#prerequisites">Prerequisites</a></li>
<li><a href="#installation">Installation</a></li> <li><a href="#installation">Installation</a></li>
</ul> </ul>
</li> </li>
<li> <li>
<a href="#hardening">Hardening</a> <a href="#hardening">Hardening</a>
<ul> <ul>
<li><a href="#ssh-creating">Creating Private/Public SSH Key</a></li> <li><a href="#ssh-creating">Creating Private/Public SSH Key</a></li>
<li><a href="#ssh-adding">Adding SSH Public Key</a></li> <li><a href="#ssh-adding">Adding SSH Public Key</a></li>
<li><a href="#ssh-chmod">SSH Permissions</a></li> <li><a href="#ssh-chmod">SSH Permissions</a></li>
<li><a href="#ssh-chmod">Disabling password based SSH</a></li> <li><a href="#ssh-chmod">Disabling password based SSH</a></li>
<li><a href="#ssh-chmod">Allow user to SUDO without password</a></li> <li><a href="#ssh-chmod">Allow user to SUDO without password</a></li>
<li><a href="#fapolicyd">fapolicyd</a></li> <li><a href="#fapolicyd">fapolicyd</a></li>
<li><a href="#fapolicyd">wget issues</a></li> <li><a href="#fapolicyd">wget issues</a></li>
</ul> </ul>
</li> </li>
<li><a href="#license">License</a></li> <li><a href="#license">License</a></li>
<li><a href="#contact">Contact</a></li> <li><a href="#contact">Contact</a></li>
<li><a href="#acknowledgments">Acknowledgments</a></li> <li><a href="#acknowledgments">Acknowledgments</a></li>
</ol> </ol>
</details> </details>
<!-- ABOUT THE PROJECT --> <!-- ABOUT THE PROJECT -->
## About The Project ## About The Project
[![Product Name Screen Shot][product-screenshot]](https://almalinux.org) [![Product Name Screen Shot][product-screenshot]](https://almalinux.org)
Proof of concept e-commerce store using Angular, .Net Core and Stripe for payment processing Proof of concept e-commerce store using Angular, .Net Core and Stripe for payment processing
* Installation of AlmaLinux * Installation of AlmaLinux
* Utilizing DISA STIG Profiles * Utilizing DISA STIG Profiles
* Creating `ssh` keys * Creating `ssh` keys
* Disabling password based `ssh` logins * Disabling password based `ssh` logins
* Allow user to `sudo` without password * Allow user to `sudo` without password
* Working with `fapolicyd` * Working with `fapolicyd`
* Getting `wget` to work in FIPS Mode * Getting `wget` to work in FIPS Mode
* Optional Cloud Packages * Optional Cloud Packages
* Cloud-Init * Cloud-Init
* Cloud-Utils-Growpart * Cloud-Utils-Growpart
* GDisk * GDisk
<p align="right">(<a href="#top">back to top</a>)</p> <p align="right">(<a href="#top">back to top</a>)</p>
### Built With ### Built With
* [Almalinux](https://almalinux.org) * [Almalinux](https://almalinux.org)
<p align="right">(<a href="#top">back to top</a>)</p> <p align="right">(<a href="#top">back to top</a>)</p>
<!-- GETTING STARTED --> <!-- GETTING STARTED -->
## Getting Started ## Getting Started
To get a local copy up and running follow these simple example steps. To get a local copy up and running follow these simple example steps.
### Prerequisites ### Prerequisites
This is an example of how to list things you need to use the software and how to install them. This is an example of how to list things you need to use the software and how to install them.
Downloading AlmaLinux Downloading AlmaLinux
```sh ```sh
https://almalinux.org https://almalinux.org
``` ```
Make bootable USB Make bootable USB
1. **Linux:** 1. **Linux:**
Insert your target USB and locate it. There are different ways to do it but here are some of them: Insert your target USB and locate it. There are different ways to do it but here are some of them:
* `sudo fdisk -l` - this command shows you the connected block storage devices, including the USB devices. * `sudo fdisk -l` - this command shows you the connected block storage devices, including the USB devices.
* `lsblk` - this command gives you all the available block storage devices, including the USB block storage devices. * `lsblk` - this command gives you all the available block storage devices, including the USB block storage devices.
* `sudo blkid` - this command gives you the same information as lsblk, but you have to rub it as root. * `sudo blkid` - this command gives you the same information as lsblk, but you have to rub it as root.
You need to look for /dev/sda or /dev/sdb or /dev/sdc, which is your target USB. You need to look for /dev/sda or /dev/sdb or /dev/sdc, which is your target USB.
After you found out the location of your target USB, navigate to the location of your source ISO. Run dd command to copy files from ISO to USB: After you found out the location of your target USB, navigate to the location of your source ISO. Run dd command to copy files from ISO to USB:
```sh ```sh
sudo dd if=/AlmaLinux-9-latest-x86_64-dvd.iso of=/dev/sdc status=progress sudo dd if=/AlmaLinux-9-latest-x86_64-dvd.iso of=/dev/sdc status=progress
``` ```
`dd` : Start the dd command to write DVD/CD iso image. `if=AlmaLinux-8-x86_64-Live-GNOME-Mini-beta-1.iso` : path to the input file. `of=/dev/sdc` : path to destination USB disk/stick. status=progress: display a progress bar while writing the image to the USB stick such as `/dev/sdb`. That’s all! You now have ready Live AlmaLinux on a USB stick. `dd` : Start the dd command to write DVD/CD iso image. `if=AlmaLinux-8-x86_64-Live-GNOME-Mini-beta-1.iso` : path to the input file. `of=/dev/sdc` : path to destination USB disk/stick. status=progress: display a progress bar while writing the image to the USB stick such as `/dev/sdb`. That’s all! You now have ready Live AlmaLinux on a USB stick.
2. **Windows**: 2. **Windows**:
For Windows OS there is a helpful free and open-source application - Rufus. For Windows OS there is a helpful free and open-source application - Rufus.
Open the application, choose your target USB, ISO you need to burn, press start - and Live OS is ready to run. Open the application, choose your target USB, ISO you need to burn, press start - and Live OS is ready to run.
3. **MacOS:** 3. **MacOS:**
The cross-platform tool balenaEtcher is used to write images on macOS. It is simple too. Open banlenaEtcher, choose the image and the USB, press Flash. The cross-platform tool balenaEtcher is used to write images on macOS. It is simple too. Open banlenaEtcher, choose the image and the USB, press Flash.
More details and information about AlmaLinux Live Media can be found on Live Media SIG. More details and information about AlmaLinux Live Media can be found on Live Media SIG.
### Installation ### Installation
Coming Soons Coming Soons
<p align="right">(<a href="#top">back to top</a>)</p> <p align="right">(<a href="#top">back to top</a>)</p>
<!-- HARDENING --> <!-- HARDENING -->
## Hardening ## Hardening
## Creating Private/Public SSH Key ## Creating Private/Public SSH Key
**Windows:** **Windows:**
**Linux:** **Linux:**
**MacOS:** **MacOS:**
### Adding SSH Public Key ### Adding SSH Public Key
Replace $SSH with the content of the public key. Replace $SSH with the content of the public key.
```sh ```sh
echo "$SSH" >> ~/.ssh/authorized_keys echo "$SSH" >> ~/.ssh/authorized_keys
``` ```
### SSH Permissions ### SSH Permissions
```sh ```sh
mkdir -p ~/.ssh mkdir -p ~/.ssh
touch ~/.ssh/authorized_keys touch ~/.ssh/authorized_keys
chmod 700 ~/.ssh chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys
``` ```
### Disabling password based SSH ### Disabling password based SSH
```sh ```sh
cd /etc/ssh cd /etc/ssh
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' sshd_config sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' sshd_config
systemctl restart sshd systemctl restart sshd
``` ```
### Allow user to SUDO without password ### Allow user to SUDO without password
```sh ```sh
sudo su - sudo su -
visudo visudo
``` ```
Press `Insert` on keyboard, substitute `$USER` with the user you created during installation. Press `Insert` on keyboard, substitute `$USER` with the user you created during installation.
```sh ```sh
$USER ALL=(ALL) NOPASSWD: ALL $USER ALL=(ALL) NOPASSWD: ALL
``` ```
### Working with fapolicyd ### Working with fapolicyd
fapolicyd starts in protection mode. We need to set fapolicyd to permissive mode to allow us to build the necessary rule sets for our individual systems. fapolicyd starts in protection mode. We need to set fapolicyd to permissive mode to allow us to build the necessary rule sets for our individual systems.
```sh ```sh
cd /etc/fapolicyd/ cd /etc/fapolicyd/
sed -i 's/permissive = 0/permissive = 1/g' fapolicyd.conf sed -i 's/permissive = 0/permissive = 1/g' fapolicyd.conf
systemctl restart fapolicyd systemctl restart fapolicyd
``` ```
See <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_blocking-and-allowing-applications-using-fapolicyd_security-hardening">RHEL: Blocking and Allowing applications with fapolicyd</a> for more information on building rules. See <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_blocking-and-allowing-applications-using-fapolicyd_security-hardening">RHEL: Blocking and Allowing applications with fapolicyd</a> for more information on building rules.
### Fixing wget ### Fixing wget
As of current GnuTLS is not properly working with FIPS. To correct this we tell GnuTLS to disable health checks. As of current GnuTLS is not properly working with FIPS. To correct this we tell GnuTLS to disable health checks.
```sh ```sh
cd /etc/profile.d/ cd /etc/profile.d/
touch gnutls.sh touch gnutls.sh
echo "export GNUTLS_SKIP_FIPS_INTEGRITY_CHECKS=1" > gnutls.sh echo "export GNUTLS_SKIP_FIPS_INTEGRITY_CHECKS=1" > gnutls.sh
``` ```
`wget` will now function as intended. `wget` will now function as intended.
<p align="right">(<a href="#top">back to top</a>)</p> <p align="right">(<a href="#top">back to top</a>)</p>
<!-- LICENSE --> <!-- LICENSE -->
## License ## License
Distributed under the MIT License. See `LICENSE` for more information. Distributed under the MIT License. See `LICENSE` for more information.
<p align="right">(<a href="#top">back to top</a>)</p> <p align="right">(<a href="#top">back to top</a>)</p>
<!-- CONTACT --> <!-- CONTACT -->
## Contact ## Contact
Twitter - [@skynetinctech](https://twitter.com/skynetinctech) Twitter - [@skynetinctech](https://twitter.com/skynetinctech)
Linkedin - [Charles Showalter](https://linkedin.com/in/charles-showalter) Linkedin - [Charles Showalter](https://linkedin.com/in/charles-showalter)
Instagram - [@skynetinc.tech](https://twitter.com/skynetinc.tech) Instagram - [@skynetinc.tech](https://twitter.com/skynetinc.tech)
Facebook - [@skynetinctech](https://facebook.com/skynetinctech) Facebook - [@skynetinctech](https://facebook.com/skynetinctech)
Project Link: [https://labs.xtechnology.org/cshowalter/SkyNet/](https://labs.xtechnology.org/cshowalter/SkyNet/) Project Link: [https://labs.xtechnology.org/cshowalter/SkyNet/](https://labs.xtechnology.org/cshowalter/SkyNet/)
<p align="right">(<a href="#top">back to top</a>)</p> <p align="right">(<a href="#top">back to top</a>)</p>
<!-- MARKDOWN LINKS & IMAGES --> <!-- MARKDOWN LINKS & IMAGES -->
<!-- https://www.markdownguide.org/basic-syntax/#reference-style-links --> <!-- https://www.markdownguide.org/basic-syntax/#reference-style-links -->
[twitter-shield]: https://img.shields.io/twitter/follow/skynetinctech?style=for-the-badge [twitter-shield]: https://img.shields.io/twitter/follow/skynetinctech?style=for-the-badge
[twitter-url]: https://twitter.com/skynetinctech [twitter-url]: https://twitter.com/skynetinctech
[linkedin-shield]: https://img.shields.io/badge/-LinkedIn-black.svg?style=for-the-badge&logo=linkedin&colorB=555 [linkedin-shield]: https://img.shields.io/badge/-LinkedIn-black.svg?style=for-the-badge&logo=linkedin&colorB=555
[linkedin-url]: https://linkedin.com/company/skynetinc [linkedin-url]: https://linkedin.com/company/skynetinc
[product-screenshot]: Screenshot.png [product-screenshot]: Screenshot.png