# echo 0 > /sys/block/DRIVE/queue/add_random

part / --fstype=ext3 --size=100 --onpart=hda1 --encrypted --passphrase=PASSPHRASE

$ sudo subscription-manager register

$ sudo rpm --import /media/cdrom/RPM-GPG-KEY

gpgcheck=1

gpgcheck=0

$ sudo yum update

PRELINKING=no

$ sudo /usr/sbin/prelink -ua

$ sudo yum install aide

$ sudo /usr/sbin/aide --init

$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

$ sudo /usr/sbin/aide --check

05 4 * * * root /usr/sbin/aide --check

$ rpm -Va | grep '^.M'

$ rpm -qf FILENAME

$ sudo rpm --setperms PACKAGENAME

rpm -Va | grep "^.....\(U\|.G\)"

$ rpm -qf FILENAME

$ sudo rpm --setugids PACKAGENAME

$ rpm -Va | grep '^..5'

$ rpm -qf FILENAME

$ sudo yum reinstall PACKAGENAME

$ sudo rpm -Uvh PACKAGENAME

$ sudo yum install dracut-fips

dracut -f

kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet fips=1

[daemon]
AutomaticLoginEnable=false

[daemon]
TimedLoginEnable=false

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gdm/simple-greeter/disable_user_list true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gdm/simple-greeter/disable_restart_buttons true

$ sudo gconftool-2 \
  --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type int \
  --set /desktop/gnome/session/idle_delay 

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gnome-screensaver/idle_activation_enabled true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gnome-screensaver/lock_enabled true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /apps/gnome-screensaver/mode blank-only

$ sudo gconftool-2 \
  --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type int \
  --set /desktop/gnome/session/max_idle_time 

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /desktop/gnome/session/max_idle_action "forced-logout"

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /apps/gnome_settings_daemon/keybindings/screensaver "<Control><Alt>l"

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /apps/gnome_settings_daemon/keybindings/power ""

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/panel/applets/clock/prefs/show_temperature false

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/panel/applets/clock/prefs/show_weather false

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/nm-applet/disable-wifi-create true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/nm-applet/disable-disconnected-notifications true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/nm-applet/disable-connected-notifications true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/nautilus/preferences/media_automount false
$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/nautilus/preferences/media_autorun_never true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /desktop/gnome/thumbnailers/disable_all true

/tmp     /var/tmp     none     rw,nodev,noexec,nosuid,bind     0 0

install usb-storage /bin/true

kernel /vmlinuz-VERSION ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb

$ sudo chkconfig autofs off

install cramfs /bin/true

install freevxfs /bin/true

install jffs2 /bin/true

install hfs /bin/true

install hfsplus /bin/true

install squashfs /bin/true

install udf /bin/true

$ sudo chown root /etc/shadow

$ sudo chgrp root /etc/shadow

$ sudo chmod 0000 /etc/shadow

$ sudo chown root /etc/group

$ sudo chgrp root /etc/group

$ sudo chmod 644 /etc/group

$ sudo chown root /etc/gshadow

$ sudo chgrp root /etc/gshadow

$ sudo chmod 0000 /etc/gshadow

$ sudo chown root /etc/passwd

$ sudo chgrp root /etc/passwd

$ sudo chmod 0644 /etc/passwd

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chmod go-w FILE

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chown root FILE

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin

$ sudo chmod go-w FILE

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin

$ sudo chown root FILE

$ sudo chmod +t DIR

umask 

*     hard   core    0

$ sudo sysctl -w fs.suid_dumpable=0

fs.suid_dumpable = 0

$ sudo sysctl -w kernel.exec-shield=1

kernel.exec-shield = 1

$ sudo sysctl -w kernel.randomize_va_space=2

kernel.randomize_va_space = 2

$ sudo yum install kernel-PAE

$ sudo sysctl -w kernel.dmesg_restrict=1

kernel.dmesg_restrict = 1

SELINUX=

SELINUXTYPE=

$ sudo chkconfig --level 2345 restorecond on

$ sudo yum erase setroubleshoot

$ sudo yum erase mcstrans

$ sudo ps -eZ | egrep "initrc" | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'

$ sudo echo > /etc/securetty

vc/1
vc/2
vc/3
vc/4

ttyS0
ttyS1

$ sudo usermod -s /sbin/nologin SYSACCT

$ sudo passwd -l SYSACCT

~/.profile

~/.bashrc

PASS_MIN_LEN 

PASS_MIN_DAYS 

PASS_MAX_DAYS 

PASS_WARN_AGE 

INACTIVE=

$ sudo chage -E YYYY-MM-DD USER

session       required     pam_lastlog.so showfailed

password required pam_cracklib.so maxrepeat=

* Upper-case characters
* Lower-case characters
* Digits
* Special characters (for example, punctuation)

• Add the following line immediately before the pam_unix.so statement in the AUTH section:

  auth required pam_faillock.so preauth silent deny= unlock_time= fail_interval=

• Add the following line immediately after the pam_unix.so statement in the AUTH section:

  auth [default=die] pam_faillock.so authfail deny= unlock_time= fail_interval=

• Add the following line immediately before the pam_unix.so statement in the ACCOUNT section:

  account required pam_faillock.so

• Add the following line immediately before the pam_unix.so statement in the AUTH section:

  auth required pam_faillock.so preauth silent deny= unlock_time= fail_interval=

• Add the following line immediately after the pam_unix.so statement in the AUTH section:

  auth [default=die] pam_faillock.so authfail deny= unlock_time= fail_interval=

• Add the following line immediately before the pam_unix.so statement in the ACCOUNT section:

  account required pam_faillock.so

• Add the following line immediately before the pam_unix.so statement in the AUTH section:

  auth required pam_faillock.so preauth silent deny= unlock_time= fail_interval=

• Add the following line immediately after the pam_unix.so statement in the AUTH section:

  auth [default=die] pam_faillock.so authfail deny= unlock_time= fail_interval=

• Add the following line immediately before the pam_unix.so statement in the ACCOUNT section:

  account required pam_faillock.so

• for the pam_unix.so case:

  password sufficient pam_unix.so existing_options remember=

• for the pam_pwhistory.so case:

  password requisite pam_pwhistory.so existing_options remember=

password    sufficient    pam_unix.so sha512 other arguments...

ENCRYPT_METHOD SHA512

crypt_style = sha512

* hard maxlogins 

PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin

$ sudo ls -ld DIR

$ sudo ls -ld /home/USER

$ sudo chmod g-w /home/USER
$ sudo chmod o-rwx /home/USER

umask 

umask 

umask 

UMASK 

$ sudo chown root /etc/grub.conf

$ sudo chgrp root /etc/grub.conf

$ sudo chmod 600 /boot/grub/grub.conf

$ grub-crypt --sha-512

password --encrypted password-hash

SINGLE=/sbin/sulogin

exec /sbin/shutdown -r now "Control-Alt-Delete pressed"

exec /usr/bin/logger -p security.info "Control-Alt-Delete pressed"

1. Edit the file /etc/sysconfig/init. Add or correct the line:

   PROMPT=no

2. Inspect the kernel boot arguments (which follow the word kernel) in /etc/grub.conf and ensure the confirm argument is not present.

$ sudo yum install screen

$ screen

ctrl+a x

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html

• https://access.redhat.com/solutions/82273

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type bool \
  --set /apps/gdm/simple-greeter/banner_message_enable true

$ sudo gconftool-2 --direct \
  --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
  --type string \
  --set /apps/gdm/simple-greeter/banner_message_text \
  "Text of the warning banner here"

NOZEROCONF=yes

$ ip link | grep PROMISC

$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0

net.ipv4.conf.default.send_redirects = 0

$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0

net.ipv4.conf.all.send_redirects = 0

$ sudo sysctl -w net.ipv4.ip_forward=0

net.ipv4.ip_forward = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0

net.ipv4.conf.all.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

net.ipv4.conf.all.accept_redirects = 0

$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0

net.ipv4.conf.all.secure_redirects = 0

$ sudo sysctl -w net.ipv4.conf.all.log_martians=1

net.ipv4.conf.all.log_martians = 1

$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0

net.ipv4.conf.default.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0

net.ipv4.conf.default.accept_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0

net.ipv4.conf.default.secure_redirects = 0

$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1

net.ipv4.icmp_echo_ignore_broadcasts = 1

$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

net.ipv4.icmp_ignore_bogus_error_responses = 1

$ sudo sysctl -w net.ipv4.tcp_syncookies=1

net.ipv4.tcp_syncookies = 1

$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1

net.ipv4.conf.all.rp_filter = 1

$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1

net.ipv4.conf.default.rp_filter = 1

$ ifconfig -a

$ iwconfig

$ sudo ifdown interface

$ sudo rm /etc/sysconfig/network-scripts/ifcfg-interface

$ sudo chkconfig bluetooth off

$ sudo service bluetooth stop

install bluetooth /bin/true

options ipv6 disable=1

NETWORKING_IPV6=no
IPV6INIT=no

udp6       tpi_clts      v     inet6    udp     -       -
tcp6       tpi_cots_ord  v     inet6    tcp     -       -

$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0

net.ipv6.conf.all.accept_source_route = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_ra=0

net.ipv6.conf.all.accept_ra = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_ra=0

net.ipv6.conf.default.accept_ra = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0

net.ipv6.conf.all.accept_redirects = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0

net.ipv6.conf.default.accept_redirects = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

net.ipv6.conf.default.accept_source_route = 0

$ sudo sysctl -w net.ipv6.conf.all.forwarding=0

net.ipv6.conf.all.forwarding = 0

IPV6ADDR=2001:0DB8::ABCD/64

IPV6_PRIVACY=rfc3041

IPV6_DEFAULTGW=2001:0DB8::0001

$ sudo chkconfig --level 2345 ip6tables on

:INPUT DROP [0:0]

$ sudo service ip6tables reload

$ sudo chkconfig --level 2345 iptables on

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

install dccp /bin/true

install sctp /bin/true

install rds /bin/true

install tipc /bin/true

$ sudo yum install openswan

$ sudo yum install libreswan

$ sudo yum install rsyslog

$ sudo chkconfig --level 2345 rsyslog on

$ ls -l LOGFILE

$ sudo chown root LOGFILE

$ ls -l LOGFILE

$ sudo chgrp root LOGFILE

$ ls -l LOGFILE

$ sudo chmod 0600 LOGFILE

*.* @loghost.example.com

*.* @@loghost.example.com

*.* :omrelp:loghost.example.com

$ModLoad imtcp
$InputTCPServerRun port
$ModLoad imudp
$UDPServerRun port
$ModLoad imrelp
$InputRELPServerRun port

$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imudp
$UDPServerRun 514

# rotate log files frequency
daily

 HostLimit = no 

 SplitHosts = yes 

 
$ sudo rm /etc/cron.daily/0logwatch 

$ sudo chkconfig --level 2345 auditd on

kernel /vmlinuz-version ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet audit=1

num_logs = NUMLOGS

max_log_file = STOREMB

max_log_file_action = ACTION

• ignore
• syslog
• suspend
• rotate
• keep_logs

space_left_action = ACTION

• ignore
• syslog
• email
• exec
• suspend
• single
• halt

admin_space_left_action = ACTION

space_left = SIZE_in_MB

action_mail_acct = 

disk_full_action = ACTION

disk_error_action = ACTION

flush = 

$ sudo service auditd restart

# audit_time_rules
-a always,exit -F arch=b32 -S adjtimex -k audit_time_rules

# audit_time_rules
-a always,exit -F arch=b64 -S adjtimex -k audit_time_rules

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

# audit_time_rules
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules

# audit_time_rules
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

# audit_time_rules
-a always,exit -F arch=b32 -S stime -k audit_time_rules

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

# time-change
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change

# time-change
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change

-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k audit_time_rules

-w /etc/localtime -p wa -k audit_time_rules

# audit_rules_usergroup_modification
-w /etc/group -p wa -k audit_rules_usergroup_modification
-w /etc/passwd -p wa -k audit_rules_usergroup_modification
-w /etc/gshadow -p wa -k audit_rules_usergroup_modification
-w /etc/shadow -p wa -k audit_rules_usergroup_modification
-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification

# audit_rules_networkconfig_modification
-a always,exit -F arch=ARCH -S sethostname -S setdomainname -k audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification

$ sudo chmod 0750 /var/log/audit

$ sudo chmod 0700 /var/log/audit

$ sudo chmod 0640 audit_file

$ sudo chmod 0600 audit_file

$ sudo chown root /var/log

-w /etc/selinux/ -p wa -k MAC-policy

-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S chmod  -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295 -k perm_mod

-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins

-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session

-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access

-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=500 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=4294967295 -k access

$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null

-a always,exit -F path=SETUID_PROG_PATH -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged

-a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k export

-a always,exit -F arch=ARCH -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k delete

-w /etc/sudoers -p wa -k actions

-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=ARCH -S init_module -S delete_module -k modules

-e 2

$ sudo chkconfig xinetd off

$ sudo yum erase xinetd

$ sudo chkconfig telnet off

$ sudo yum erase telnet-server

$ sudo yum erase rsh-server

$ sudo chkconfig rexec off

$ sudo chkconfig rsh off

$ sudo chkconfig rlogin off

$ sudo rm /etc/hosts.equiv

$ rm ~/.rhosts

$ sudo yum erase ypserv

$ sudo chkconfig ypbind off

$ sudo chkconfig tftp off

$ sudo yum erase tftp-server

server_args = -s /var/lib/tftpboot

$ sudo yum erase talk-server

$ sudo chkconfig abrtd off

$ sudo chkconfig acpid off

$ sudo chkconfig certmonger off

$ sudo chkconfig cgconfig off

$ sudo chkconfig cgred off

$ sudo chkconfig cpuspeed off

$ sudo chkconfig haldaemon off

$ sudo chkconfig --level 2345 irqbalance on

$ sudo chkconfig kdump off

$ sudo chkconfig mdmonitor off

$ sudo chkconfig messagebus off

$ sudo chkconfig netconsole off

$ sudo chkconfig ntpdate off

$ sudo chkconfig oddjobd off

$ sudo chkconfig portreserve off

$ sudo chkconfig --level 2345 psacct on

$ sudo chkconfig qpidd off

$ sudo chkconfig quota_nld off

$ sudo chkconfig rdisc off

$ sudo chkconfig rhnsd off

$ sudo chkconfig rhsmcertd off

$ sudo chkconfig saslauthd off

$ sudo chkconfig smartd off

$ sudo chkconfig sysstat off

$ sudo chkconfig --level 2345 crond on

$ sudo yum erase cronie-anacron

$ sudo chkconfig atd off

$ sudo chkconfig sshd off

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

Protocol 2

DenyUsers USER1 USER2

PrintLastLog yes

ClientAliveInterval 

ClientAliveCountMax 0

IgnoreRhosts yes

HostbasedAuthentication no

PermitRootLogin no

PermitEmptyPasswords no

Banner /etc/issue

PermitUserEnvironment no

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1

$ sudo yum install sssd

$ sudo systemctl enable sssd.service

[nss]
memcache_timeout = 86400

[pam]
offline_credentials_expiration = 1

[ssh]
ssh_known_hosts_timeout = 86400

id:3:initdefault:

$ sudo yum groupremove "X Window System"

$ sudo chkconfig avahi-daemon off

use-ipv6=no

use-ipv4=no

check-response-ttl=yes

disallow-other-stacks=yes

disable-publishing=yes

disable-user-service-publishing=yes

publish-addresses=no
publish-hinfo=no
publish-workstation=no
publish-domain=no

$ sudo chkconfig cups off

Browsing Off

Port 631

Listen localhost:631

$ sudo chkconfig dhcpd off

$ sudo yum erase dhcp

ddns-update-style none;

deny declines;

deny bootp;

option domain-name
option domain-name-servers
option nis-domain
option nis-servers
option ntp-servers
option routers
option time-offset

daemon.*           /var/log/daemon.log

• Correct the BOOTPROTO line to read:

  BOOTPROTO=none

• Add or correct the following lines, substituting the appropriate values based on your site's addressing scheme:

  NETMASK=255.255.255.0
  IPADDR=192.168.1.2
  GATEWAY=192.168.1.1

supersede setting value;

request setting;
require setting;

supersede domain-name "example.com";
supersede domain-name-servers 192.168.1.2;
supersede nis-domain "";
supersede nis-servers "";
supersede ntp-servers "ntp.example.com ";
supersede routers 192.168.1.1;
supersede time-offset -18000;
request subnet-mask;
require subnet-mask;

$ sudo chkconfig --level 2345 ntpd on

server ntpserver

server ntpserver

$ sudo chkconfig --level 2345 postfix on

$ sudo yum erase sendmail

inet_interfaces = localhost

$ sudo echo "root: " >> /etc/aliases
$ sudo newaliases

smtpd_banner = $myhostname ESMTP

ssl start_tls

tls_cacertdir /etc/pki/tls/CA

tls_cacertfile /etc/pki/tls/CA/cacert.pem

$ sudo yum erase openldap-servers

$ sudo chkconfig nfslock off

$ sudo chkconfig rpcgssd off

$ sudo chkconfig rpcidmapd off

$ sudo chkconfig rpcbind off

$ sudo chkconfig netfs off

LOCKD_TCPPORT=lockd-port

LOCKD_UDPPORT=lockd-port

STATD_PORT=statd-port

MOUNTD_PORT=statd-port

anonuid=value greater than UID_MAX from /etc/login.defs
anongid=value greater than GID_MAX from /etc/login.defs

$ sudo chkconfig nfs off

$ sudo chkconfig rpcsvcgssd off

$ sudo chkconfig named off

$ sudo yum erase bind

options {
  allow-transfer { none; };
  ...
}

$ cd /tmp
$ sudo dnssec-keygen -a HMAC-MD5 -b 128 -n HOST dns.example.com
Kdns.example.com .+aaa +iiiii

$ sudo cat Kdns.example.com .+NNN +MMMMM .key
dns.example.com IN KEY 512 3 157 base64-key-string

key zone-transfer-key {
  algorithm hmac-md5;
  secret "base64-key-string ";
};
zone "example.com " IN {
  type master;
  allow-transfer { key zone-transfer-key; };
  ...
};

key zone-transfer-key {
  algorithm hmac-md5;
  secret "base64-key-string ";
};

server IP-OF-MASTER {
  keys { zone-transfer-key; };
};

zone "example.com " IN {
  type slave;
  masters { IP-OF-MASTER ; };
  ...
};

zone "example.com " IN {
  allow-update { none; };
  ...
};

$ sudo chkconfig vsftpd off

$ sudo yum erase vsftpd

$ sudo yum install vsftpd

xferlog_enable=YES
xferlog_std_format=NO
log_ftp_protocol=YES

banner_file=/etc/issue

local_enable=NO

userlist_enable=YES
userlist_file=/etc/vsftp.ftpusers
userlist_deny=NO

USERNAME

anonymous
ftp

write_enable=NO

-A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT

IPTABLES_MODULES="ip_conntrack_ftp"

$ sudo chkconfig httpd off

$ sudo yum erase httpd

ServerTokens Prod

ServerSignature Off

#LoadModule auth_digest_module modules/mod_auth_digest.so

#LoadModule rewrite_module modules/mod_rewrite.so

#LoadModule ldap_module modules/mod_ldap.so
#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so

#LoadModule include_module modules/mod_include.so

#LoadModule mime_magic_module modules/mod_mime_magic.so

#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so

#LoadModule status_module modules/mod_status.so

#LoadModule info_module modules/mod_info.so

#LoadModule speling_module modules/mod_speling.so

#LoadModule proxy_module modules/mod_proxy.so

#LoadModule cache_module modules/mod_cache.so

#LoadModule cgi_module modules/mod_cgi.so

<Directory / >
   Options None
   AllowOverride None
   Order allow,deny
</Directory>

<Directory "/var/www/html">
#  ...
   Options SymLinksIfOwnerMatch
#  ...
</Directory>

<Directory /var/www/html>
# ...
   # Only allow specific methods (this command is case-sensitive!)
   <LimitExcept GET POST>
      Order allow,deny
   </LimitExcept>
# ...
</Directory>

$ sudo yum install mod_ssl

$ sudo yum install mod_security

$ sudo chmod 700 /var/log/httpd/

$ sudo chmod 750 /etc/httpd/conf/

$ sudo chmod 640 /etc/httpd/conf/*

$ sudo chkconfig dovecot off

$ sudo yum erase dovecot

ssl = yes

ssl_cert = </etc/pki/dovecot/certs/dovecot.pem

ssl_key = </etc/pki/dovecot/private/dovecot.pem

disable_plaintext_auth = yes

$ sudo chkconfig smb off

$ sudo yum erase samba

$ sudo yum install samba-common

[share]
  invalid users = root @wheel

client signing = mandatory

$ sudo chkconfig squid off

$ sudo yum erase squid

$ sudo chkconfig snmpd off

$ sudo yum erase net-snmp

$ sudo service snmpd restart

$ sudo service snmpd restart