# View the current encryption policy
update-crypto-policies --show

# Set the policy to FUTURE
update-crypto-policies --set FUTURE

reboot

# wget example: customizing TLS versions and cipher suites
wget --secure-protocol=TLSv1_1 --ciphers="SECURE128" https://example.com

# curl example: specifying a cipher list
curl https://example.com --ciphers '@SECLEVEL=0:DES-CBC3-SHA:RSA-DES-CBC3-SHA'

# 1. Create a subpolicy file.
cd /etc/crypto-policies/policies/modules/
touch MYCRYPTO-1.pmod

min_rsa_size = 3072
hash = SHA2-384 SHA2-512 SHA3-384 SHA3-512

# 2. Enable the subpolicy.
update-crypto-policies --set DEFAULT:MYCRYPTO-1

# 3. Restart to take effect
reboot

# 4. Verification
cat /etc/crypto-policies/state/CURRENT.pol | grep rsa_size

# 1. Create a policy file. You can copy a system predefined policy as a base.
cp /usr/share/crypto-policies/policies/DEFAULT.pol /etc/crypto-policies/policies/MYPOLICY.pol

# 2. Edit the policy file content.
vim /etc/crypto-policies/policies/MYPOLICY.pol

# 3. Enable the custom policy.
update-crypto-policies --set MYPOLICY

# 4. Restart to take effect
reboot

# 5. Verification
update-crypto-policies --show

# Install ca-certificates (usually preinstalled)
dnf install ca-certificates

# Copy the certificate to the trust anchor directory.
cp ~/certificate.pem /usr/share/pki/ca-trust-source/anchors/

# Update the system certificate store.
update-ca-trust

# List all trust anchors.
trust list

# Add a trust anchor.
trust anchor path/to/certificate.crt

# Delete a trust anchor.
trust anchor --remove path/to/certificate.crt

# View subcommand help.
trust list --help

# Install AIDE.
dnf install aide

# Initialize the database.
aide --init

# Enable the database (remove .new from the filename).
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

# Check whether files have been tampered with.
aide --check

# Update the database after system changes.
aide --update
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

# 1. Format as a LUKS partition.
cryptsetup luksFormat /dev/vdb1

# 2. Open the encrypted partition.
cryptsetup open /dev/vdb1 vdb1_encrypted

# 3. Create a file system.
mkfs -t ext4 /dev/mapper/vdb1_encrypted

# 4. Mount the file system.
mount /dev/mapper/vdb1_encrypted /mnt/encrypted

# Unmount the partition.
umount /dev/vdb1

# Install cryptsetup.
dnf install cryptsetup

# Enable encryption (the LUKS header is stored at the beginning of the device)
cryptsetup reencrypt --encrypt --init-only --reduce-device-size 32M /dev/vdb1 vdb1_encrypted

cryptsetup reencrypt --encrypt --init-only --header /path/to/header /dev/vdb1 vdb1_encrypted

# Start the service and enable it to start on boot.
systemctl start auditd
systemctl enable auditd

# Check the status.
systemctl status auditd

# Reload the configuration.
service auditd reload

# Monitor file access (record write operations to /etc/passwd)
auditctl -w /etc/passwd -p wa -k passwd_changes

# Monitor directories (record write operations to the /etc/selinux/ directory)
auditctl -w /etc/selinux/ -p wa -k selinux_changes

# System call rules (record time-related system calls)
auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change

# Record user file deletion operations.
auditctl -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

# Record executable file execution.
auditctl -a always,exit -F exe=/bin/id -F arch=b64 -S execve -k execution_bin_id

# Load rules
augenrules --load

# View loaded rules
auditctl -l

# Search for specific event types
ausearch -m AVC,USER_AVC -ts recent

# Search for login failure records
ausearch -m USER_LOGIN -ts '7/02/2022' '18:00:00' -sv no

# Generate login reports
aureport --login -i

# Generate reports for all events
aureport

# Install USBGuard
dnf install usbguard

# Generate an initial rule set based on currently connected devices.
usbguard generate-policy > /etc/usbguard/rules.conf

# Start the service and enable it to start on boot.
systemctl enable --now usbguard

# Check the service status.
systemctl status usbguard

# List identified USB devices.
usbguard list-devices

# Temporarily authorize devices to interact with the system.
usbguard allow-device <device_id>

# Temporarily deny devices.
usbguard reject-device <device_id>

# Permanently authorize devices (write rules)
usbguard allow-device <device_id> -p

# Permanently deny devices.
usbguard block-device <device_id> -p

# View current rules.
usbguard list-rules

# Generate a policy (without hashes)
usbguard generate-policy --no-hashes > ./rules.conf

# Edit rules, for example, to allow only high-capacity storage devices.
vim ./rules.conf
# Add: allow with-interface equals { 08:*:* }

# Install a policy.
install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

# Restart to take effect
systemctl restart usbguard

AuditBackend=LinuxAudit

systemctl restart usbguard

# Verification
ausearch -ts recent -m USER_DEVICE

# View the current mode.
getenforce
sestatus

# Temporarily switch modes
setenforce 0  # Switch to permissive mode
setenforce 1  # Switch to enforcing mode

# View SELinux user mappings
semanage login -l

# Map the default user to user_u (restrict regular users)
semanage login -m -s user_u -r s0 __default__

# Create a restricted administrator user
adduser -G wheel -Z sysadm_u <username>

# 1. Search AVC denial logs
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent

# 2. If no logs are found, they may be suppressed by dontaudit rules
semodule -DB  # Temporarily disable dontaudit

# 3. Use sealert to view detailed analysis
sealert -l "*"

# 4. Automatically generate a policy with audit2allow
audit2allow -M mypolicy < /var/log/audit/audit.log
semodule -i mypolicy.pp

# 5. Restore the dontaudit rules.
semodule -B