Security Guide/9/SecureInstallation

From FedoraProject

Jump to: navigation, search

Contents

Chapter 3 - Secure Installation

Security begins with the first time you put that CD or DVD into your disk drive to install Fedora. Configuring your system securely from the beginning makes it easier to implement additional security settings later.

Disk Partitions

The NSA recommends creating separate partitions for /boot, /, /home, /tmp, and /var/tmp. The reasons for each are different and we will address each partition.

/boot

This partition is the first partition that is read by the system during boot up. The boot loader and kernel images that are used to boot your system into Fedora are stored in this partition. This partition should not be encrypted. If this partition is included in / and that partition is encrypted or otherwise becomes unavailable then your system will not be able to boot.

/home

When user data (/home) is stored in / instead of in a separate partition, the partition can fill up causing the operating system to become unstable. Also, when upgrading your system to the next version of Fedora it is a lot easier when you can keep your data in the /home partition as it will not be overwritten during installation.

If the root partition (/) becomes corrupt your data could be lost forever. By using a separate partition there is slightly more protection against data loss. You can also target this partition for frequent backups.

/tmp and /var/tmp

Both the /tmp and the /var/tmp directories are used to store data that doesn't need to be stored for a long period of time. However if a lot of data floods one of these directories it can consume all of your storage space. If this happens and these directories are stored within / then your system could become unstable and crash. For this reason, moving these directories into their own partitions is a good idea.

Utilize LUKS Partition Encryption

Fedora 9 supports the use of Linux Unified Key Setup-on-disk-format (LUKS) encryption natively. During the installation process an option to encrypt your partitions will be presented to the user. The user must supply a passphrase that will be the key to unlock the bulk encryption key that will be used to secure the partition's data.

Unlike Fedora 9, Fedora 8 does not have LUKS support built-in; however it is easily implemented. Step-by-step procedures are available that allow the user to implement partition encryption on their Fedora 8 installation.


2. General Principles of Security Table of Contents 4 Encryption
Retrieved from "https://fedoraproject.org/wiki/Security_Guide/9/SecureInstallation"