tencent cloud

TencentOS Server

문서TencentOS ServerUser GuideSecurity ConfigurationSystem Security Hardening Guide

System Security Hardening Guide

다운로드
포커스 모드
폰트 크기
마지막 업데이트 시간: 2026-10-19 17:22:49
AI 번역
This document describes system-level security configuration methods in TencentOS Server, including encryption policy management, certificate management, vulnerability scanning, integrity checking, block device encryption, audit system, USBGuard, and SELinux configuration. This document applies to TencentOS Server 3 and later versions.

System Encryption Policy

The system-wide Crypto policy is a configuration component of the encryption subsystem in TencentOS Server, covering TLS, IPSec, SSH, DNSSEC, and Kerberos protocols. After a system-wide policy is set, applications follow the policy and refuse to use algorithms and protocols that do not comply with it. To override the default behavior, you can customize individual applications.

Encryption Policy Level

Policy Level
Description
DEFAULT
Default level. Allows TLS 1.2 and 1.3 protocols, as well as IKEv2 and SSH2 protocols.
LEGACY
Compatibility policy. Additionally supports TLS 1.0 and 1.1 protocols on top of DEFAULT, and allows DSA, 3DES, and RC4 algorithms.
FUTURE
Conservative security level. SHA-1 is not allowed in signature algorithms. TLS 1.2 and 1.3 protocols, as well as IKEv2 and SSH2 protocols, are allowed.

Viewing and Configuring Encryption Policies

# View the current encryption policy
update-crypto-policies --show

# Set the policy to FUTURE
update-crypto-policies --set FUTURE
Warning:
After modifying the encryption policy, restart the system for the configuration to take full effect.
reboot

Excluding Specific Applications

To exempt a specific application from the system-wide encryption policy, you can configure supported cipher suites and protocols directly in that application, or remove the symbolic links associated with the application from the /etc/crypto-policies/back-ends/ directory.
# wget example: customizing TLS versions and cipher suites
wget --secure-protocol=TLSv1_1 --ciphers="SECURE128" https://example.com

# curl example: specifying a cipher list
curl https://example.com --ciphers '@SECLEVEL=0:DES-CBC3-SHA:RSA-DES-CBC3-SHA'

Customizing the Encryption Sub-policy

You can overlay custom subpolicies on top of the existing system-wide policy:
# 1. Create a subpolicy file.
cd /etc/crypto-policies/policies/modules/
touch MYCRYPTO-1.pmod
Add the following to MYCRYPTO-1.pmod:
min_rsa_size = 3072
hash = SHA2-384 SHA2-512 SHA3-384 SHA3-512
# 2. Enable the subpolicy.
update-crypto-policies --set DEFAULT:MYCRYPTO-1

# 3. Restart to take effect
reboot

# 4. Verification
cat /etc/crypto-policies/state/CURRENT.pol | grep rsa_size

Customizing a Complete Encryption Policy

# 1. Create a policy file. You can copy a system predefined policy as a base.
cp /usr/share/crypto-policies/policies/DEFAULT.pol /etc/crypto-policies/policies/MYPOLICY.pol

# 2. Edit the policy file content.
vim /etc/crypto-policies/policies/MYPOLICY.pol

# 3. Enable the custom policy.
update-crypto-policies --set MYPOLICY

# 4. Restart to take effect
reboot

# 5. Verification
update-crypto-policies --show

Sharing System Certificates

TencentOS Server's shared system certificate mechanism enables NSS, GNUTLS, OpenSSL, and Java to share a default certificate source, including CA certificate anchors and blocklist information. The default trust store contains the Mozilla CA list.

Certificate Storage Path

Purpose
Path
Trust anchor
/usr/share/pki/ca-trust-source/anchors/ or /etc/pki/ca-trust/source/anchors/
Untrusted certificates
/usr/share/pki/ca-trust-source/blacklist/ or /etc/pki/ca-trust/source/blacklist/
Certificates in extended format
/usr/share/pki/ca-trust-source/ or /etc/pki/ca-trust/source/
Note:
Settings in /etc/pki/ca-trust/ take precedence over those in /usr/share/pki/ca-trust-source/.

Adding a Trusted Certificate

# Install ca-certificates (usually preinstalled)
dnf install ca-certificates

# Copy the certificate to the trust anchor directory.
cp ~/certificate.pem /usr/share/pki/ca-trust-source/anchors/

# Update the system certificate store.
update-ca-trust

Manage Trusted Certificates

# List all trust anchors.
trust list

# Add a trust anchor.
trust anchor path/to/certificate.crt

# Delete a trust anchor.
trust anchor --remove path/to/certificate.crt

# View subcommand help.
trust list --help

Vulnerability and Configuration Compliance Scanning

TencentOS Server provides an automated compliance auditing tool based on the SCAP (Security Content Automation Protocol) standard, supporting configuration scanning, vulnerability scanning, and compliance remediation for systems.

Configuration Compliance Tool

Tool
Description
SCAP Workbench
Graphical interface tool that performs configuration and vulnerability scans on a single system and generates security reports.
OpenSCAP(oscap)
Command line tool that performs configuration and vulnerability scans on the local system and supports compliance remediation.
SCAP Security Guide(SSG)
Security policy collection that provides XCCDF configuration files and OVAL detection scripts for Linux systems.
Script Check Engine(SCE)
Optional extension that supports writing custom check logic with scripts such as Bash and Python.
Note: For detailed usage, contact your business representative.

Integrity Check (AIDE)

AIDE (Advanced Intrusion Detection Environment) detects whether system files have been tampered with by creating database snapshots of files.

Installation and Initialization

# Install AIDE.
dnf install aide

# Initialize the database.
aide --init

# Enable the database (remove .new from the filename).
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
Note:
The default configuration file is /etc/aide.conf, where you can define the directories and files to monitor.

Performing an Integrity Check

# Check whether files have been tampered with.
aide --check

# Update the database after system changes.
aide --update
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Block Device Encryption (LUKS)

TencentOS Server uses LUKS (Linux Unified Key Setup) as the default implementation for block device encryption. LUKS encrypts the entire block device, supports multiple key slots, and is suitable for protecting data on removable storage media and disk drives.
Warning:
LUKS protects data only when the system is shut down. After system startup and decryption, files are in plaintext.

LUKS Features

It encrypts the entire block device and is suitable for protecting removable storage media.
It provides password hardening to prevent dictionary attacks.
It supports multiple key slots, allowing you to add backup keys or passwords.
The default encryption algorithm is aes-xts-plain64, with a default key size of 512 bits.

Encrypting a Blank Block Device

# 1. Format as a LUKS partition.
cryptsetup luksFormat /dev/vdb1

# 2. Open the encrypted partition.
cryptsetup open /dev/vdb1 vdb1_encrypted

# 3. Create a file system.
mkfs -t ext4 /dev/mapper/vdb1_encrypted

# 4. Mount the file system.
mount /dev/mapper/vdb1_encrypted /mnt/encrypted

Encrypting a Block Device with Existing Data

Warning: Ensure that data is backed up before encryption.
# Unmount the partition.
umount /dev/vdb1

# Install cryptsetup.
dnf install cryptsetup

# Enable encryption (the LUKS header is stored at the beginning of the device)
cryptsetup reencrypt --encrypt --init-only --reduce-device-size 32M /dev/vdb1 vdb1_encrypted
Use detached header encryption (the header is stored in a specified location, providing higher security):
cryptsetup reencrypt --encrypt --init-only --header /path/to/header /dev/vdb1 vdb1_encrypted
After encryption, the partition can no longer be mounted directly. It must be accessed through the mapped device under /dev/mapper/.

Audit System (auditd)

The Linux audit system is used to record security policy violation events in the system and is critical for production environments.

Audit System Features

Collect the time, type, and result of security policy violation events.
Monitor file access and system calls.
Record user operations and authentication events.
Supports searching for events by criteria and generating reports.

auditd Configuration Parameters

The main configuration file is /etc/audit/auditd.conf. Common parameters:
Parameter
Description
log_file
Audit log path. Default: /var/log/audit/audit.log
max_log_file
Maximum log file size
max_log_file_action
Action when the log reaches its limit. Recommended value: keep_logs.
space_left
Disk free space threshold
space_left_action
Action when space is insufficient. Recommended value: email.
disk_full_action
Action when the disk is full. Set to halt or single.
flush
Log flush mode. Recommended value: incremental_async.

Starting and Managing

# Start the service and enable it to start on boot.
systemctl start auditd
systemctl enable auditd

# Check the status.
systemctl status auditd

# Reload the configuration.
service auditd reload

Defining an Audit Rule

# Monitor file access (record write operations to /etc/passwd)
auditctl -w /etc/passwd -p wa -k passwd_changes

# Monitor directories (record write operations to the /etc/selinux/ directory)
auditctl -w /etc/selinux/ -p wa -k selinux_changes

# System call rules (record time-related system calls)
auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change

# Record user file deletion operations.
auditctl -a always,exit -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete

# Record executable file execution.
auditctl -a always,exit -F exe=/bin/id -F arch=b64 -S execve -k execution_bin_id

Persisting an Audit Rule

Write the rules to the .rules file in the /etc/audit/rules.d/ directory, and then load them:
# Load rules
augenrules --load

# View loaded rules
auditctl -l

Querying Audit Logs

# Search for specific event types
ausearch -m AVC,USER_AVC -ts recent

# Search for login failure records
ausearch -m USER_LOGIN -ts '7/02/2022' '18:00:00' -sv no

# Generate login reports
aureport --login -i

# Generate reports for all events
aureport

USBGuard --Defending Against USB Device Attacks

USBGuard is a software framework that protects systems from malicious USB device attacks by using allow/deny device lists based on the kernel USB device authorization feature.

Installing and Enabling

Warning:
The initial rules generated by usbguard generate-policy only allow USB devices that are already connected when the command is run. After USBGuard is enabled on a physical server, newly connected devices such as keyboards and mice are denied by default, which may result in the loss of local access. You are advised to check the rule set and keep an out-of-band management channel (such as BMC/IPMI) available before enabling the service. If you are locked out, you can run systemctl stop usbguard through the out-of-band channel to recover.
# Install USBGuard
dnf install usbguard

# Generate an initial rule set based on currently connected devices.
usbguard generate-policy > /etc/usbguard/rules.conf

# Start the service and enable it to start on boot.
systemctl enable --now usbguard

# Check the service status.
systemctl status usbguard

Managing USB Devices

# List identified USB devices.
usbguard list-devices

# Temporarily authorize devices to interact with the system.
usbguard allow-device <device_id>

# Temporarily deny devices.
usbguard reject-device <device_id>

# Permanently authorize devices (write rules)
usbguard allow-device <device_id> -p

# Permanently deny devices.
usbguard block-device <device_id> -p

# View current rules.
usbguard list-rules

Create a custom policy

# Generate a policy (without hashes)
usbguard generate-policy --no-hashes > ./rules.conf

# Edit rules, for example, to allow only high-capacity storage devices.
vim ./rules.conf
# Add: allow with-interface equals { 08:*:* }

# Install a policy.
install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

# Restart to take effect
systemctl restart usbguard

Logging Audit Events to the Linux Audit Log

Edit /etc/usbguard/usbguard-daemon.conf and change AuditBackend to LinuxAudit:
AuditBackend=LinuxAudit
systemctl restart usbguard

# Verification
ausearch -ts recent -m USER_DEVICE

SELinux Configuration

SELinux (Security-Enhanced Linux) provides mandatory access control (MAC), adding an extra security layer to the system. TencentOS Server enables SELinux by default (enforcing mode, targeted policy).

Working Modes

Mode
Description
enforcing
Enforce security policies. Access that violates rules is denied and logged.
permissive
Permissive mode. Violations are only logged, not denied.
disabled
Disable SELinux.
# View the current mode.
getenforce
sestatus

# Temporarily switch modes
setenforce 0  # Switch to permissive mode
setenforce 1  # Switch to enforcing mode
To permanently change the mode, edit /etc/selinux/config, set SELINUX=enforcing|permissive|disabled, and then restart.

Managing Restricted Users

Note:
semanage login -m -s user_u -r s0 __default__ modifies the default user mapping and affects all subsequently logging-in unmapped users (except explicitly mapped users such as root). Verify the impact in a test environment before using it in production. To restore, run semanage login -m -s unconfined_u -r s0 __default__.
# View SELinux user mappings
semanage login -l

# Map the default user to user_u (restrict regular users)
semanage login -m -s user_u -r s0 __default__

# Create a restricted administrator user
adduser -G wheel -Z sysadm_u <username>

Troubleshooting SELinux Permission Issues

Note:
The policy automatically generated by audit2allow based on existing denial logs may be overly broad and grant more permissions than necessary. After generation, review the rules in mypolicy.te to confirm that the authorization scope is appropriate before installing it with semodule -i.
# 1. Search AVC denial logs
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent

# 2. If no logs are found, they may be suppressed by dontaudit rules
semodule -DB  # Temporarily disable dontaudit

# 3. Use sealert to view detailed analysis
sealert -l "*"

# 4. Automatically generate a policy with audit2allow
audit2allow -M mypolicy < /var/log/audit/audit.log
semodule -i mypolicy.pp

# 5. Restore the dontaudit rules.
semodule -B
이전 주제: Security Architecture and Feature Analysis다음 주제: SELinux User Guide

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백

키워드로 검색
    Enter keywords to search documentation