From Fedora Project Wiki

Revision as of 17:31, 3 February 2014 by Hkario (talk | contribs) (→‎Use cases: add SSH section)


The current (Fedora 20) Security Guide (minus the SELinux stuff) is a mash together of the RHEL 6 Security Guide and the hardening advice that was posted on the Fedora wiki around the time of Fedora 12. It's quite obvious to anyone reading the entire document that the beginning of the guide reads one way while the end reads differently as if they had different missions (they do!).

Looking forward

It's okay to look at the guide and say that while much of the guide is okay much of it is crap. There may be a need for basic security education I feel that it is best suited to other documentation and training resources. I'd like to go into the next version of this guide with a fresh look at what is needed: hardening advice, auditing advice, how to use the security tools that are available, etc. This will not be easy but it's doable.

Topics to be covered


There is a lot of SELinux stuff in guide. It needs to be combed through and evaluated to determine what is needed, necessary, and up to date. There is also a treasure trove of stuff on Dan Walsh's blog that needs to be converted and brought into the mix. I'm sure we're missing some rather large topics regarding what SELinux can do now.


Yeah, there is currently no good documentation on setting up firewalld.


Man, this is going to be a huge topic. From setup to auditing to writing your own rules... SCAP should be written up well.


It's hard. Lets try to make it a little easier.

  • Hardware-based full disk encryption. Caveat: Certain firmware does not prompt for the password on warm reboots, so you need to add a GRUB password (otherwise someone at the console could just switch to a VTY, reboot, and access the box), which is currently not supported (bug 840160).

Use cases


How do I setup Apache to be secure and use good ciphers?


How do I setup dovecot to be secure and use good ciphers?


How to setup secure root logon (PermintRootLogin)? How to regenerate host keys (because early boot is entropy starved). How to generate host keys that provide 128 bits of security (3072bit RSA, 256bit ECDSA). Best practice on ssh key usage, distribution, key signing, ssh-agent usage.