This document describes how to configure security settings at the hardware level (BIOS/UEFI) and provides recommendations for disk partition security before TencentOS Server is installed.
BIOS Security
BIOS (Basic Input/Output System) is fundamental software in a computer system, responsible for starting and initializing hardware devices such as the CPU, memory, hard drives, and graphics cards. As the first software that runs during system startup, BIOS is critical to overall system security. Configuring and protecting BIOS before TencentOS Server is installed can reduce the risk of hacker attacks or virus infections, improving system security and stability.
Note: Modern servers often use UEFI (Unified Extensible Firmware Interface) instead of traditional BIOS. The following security measures also apply to UEFI firmware. For specific option locations, refer to your actual environment.
Enabling BIOS Password Protection
Enabling BIOS password protection is one of the key measures for securing the BIOS. You are advised to set a startup password in the BIOS to limit unauthorized access. Keep the password strictly confidential and change it regularly to ensure underlying hardware security.
Disabling Unnecessary Boot Devices
Disabling unnecessary boot devices (such as USB drives and optical drives) can prevent attackers from entering the system through bootable media and reduce the system's attack surface. These options are usually located in the Boot tab of the BIOS settings.
Enabling Secure Boot
Secure Boot uses software and firmware to ensure that the system is not attacked during system startup. You can enable Secure Boot in the Security tab of the BIOS settings. Secure Boot is a feature of UEFI firmware and is available only in UEFI boot mode. It is not supported in Legacy BIOS mode.
Enabling TPM (Trusted Platform Module)
TPM is a hardware security chip used to store encryption keys and verify system integrity. By enabling TPM, you can store sensitive data more securely and protect your system from attacks. After enabling TPM, you can use it to encrypt disks and verify software during system startup, improving system security.
Note:
The physical server must be equipped with a TPM chip (version 1.2 or 2.0), and this feature must be enabled in the BIOS/UEFI settings.
If the hardware does not have a TPM chip, TPM-related features cannot be used.
Disabling Remote Management Interfaces
If remote management interfaces (such as BMC, iLO, and IPMI) are not required in your business scenario, disable them in the BIOS settings to prevent attackers from using these interfaces to remotely compromise the system.
Note that the remote management interfaces of the BIOS can improve the efficiency and convenience of computer management, but they also require careful configuration and management by administrators. Administrators can reduce risks by limiting the IP addresses allowed for remote access or by permitting access only through secure VPN tunnels.
Keeping BIOS Firmware Up to Date
Keep the BIOS firmware up to date to achieve better security and performance. Regularly audit the BIOS settings and ensure that they comply with security best practices to guarantee system security and stability.
Disk Partitioning Security
Disk partitioning is the process of dividing a hard disk into multiple logical parts, each of which can be used independently to achieve the purpose of separating files, data, and operating systems. Disk partitioning security requires that certain measures be taken during the partitioning process to ensure the security and stability of system data.
The necessity of disk partitioning lies in the following aspects:
Improve data security: By storing the system and data in different partitions, data security can be effectively guaranteed. When the system is attacked or fails, the data can also be protected.
Improve system stability: Storing the system and data in different partitions can effectively prevent data anomalies or corruption from affecting the system. When a system fault occurs, you can quickly locate the problem and take appropriate measures to fix it.
Improve system performance: Disk partitioning can improve system read/write performance, thereby enhancing system operating efficiency.
Configuration recommendations for disk partitioning security are as follows:
Enabling Disk Encryption
Disk encryption is an important disk security feature that can encrypt an entire disk or specific partitions to protect system data from unauthorized access. In TencentOS Server, you can use LUKS (Linux Unified Key Setup) to encrypt disk partitions, and it can be used in combination with LVM (Logical Volume Manager). When partitioning a disk, you can choose to use encrypted partitions to protect the security of system data.
Note: LVM itself is a logical volume management tool and does not provide encryption. Disk encryption is implemented by LUKS through the cryptsetup tool. LVM can be used with LUKS, either by encrypting first and then creating logical volumes, or by creating logical volumes first and then encrypting them.
Separating the OS and Data
By storing the OS and user data in different partitions, data security and system stability can be effectively guaranteed. During disk partitioning, the OS and user data can be stored in different partitions, with corresponding access permissions and security policies configured for each partition to prevent data leakage and system exceptions.
Configuring Partition Permissions
In TencentOS Server, each partition has corresponding permission settings. Administrators can configure permissions for partitions based on actual needs to protect system security. For example, you can set critical directories in the system partition to read-only mode to prevent system files from being accidentally deleted or modified. You can also set appropriate read/write permissions for the user data partition to prevent unauthorized users from accessing or modifying data.
Enabling SELinux
SELinux (Security-Enhanced Linux) is a Linux kernel security module that protects system security through mandatory access control. TencentOS Server enables SELinux by default (enforcing mode, targeted policy), and users can enable/disable the corresponding feature as needed. Enabling SELinux allows security policy control over files, directories, and processes, limiting system access, permissions, and operations. When partitioning a disk, you can set an appropriate SELinux security context for each partition based on actual needs to protect system security.
Backing Up Data Regularly
Regularly backing up important data is a critical measure for ensuring data security. It is recommended to store backup data on a partition separate from the system partition or on an external storage device, and to periodically verify the integrity and availability of the backup data. Before performing system updates or configuration changes, back up data first to prevent data loss caused by operational errors.