@CopepodLover AFAIK even SSH is not running (I use it here), but only for remote access on my local network…
The Aeon files have sha256 checksums?
https://download.opensuse.org/tumbleweed/appliances/
1 Like
Oh thank you. My error, I was only looking at the official download page and didn’t check further. Thanks for the link! I’ll have a look at it then. 
Mastering systemd: Securing and sandboxing applications and services
https://documentation.suse.com/en-us/smart/security/html/systemd-securing/index.html
https://docs.rockylinux.org/guides/security/systemd_hardening/
https://www.redhat.com/en/blog/mastering-systemd
https://linux-audit.com/systemd/how-to-harden-a-systemd-service-unit/
Check linux capabilities:
$ zypper install libcap-ng-utils
$ pscap -a
@GrandDixence2 Many systemd services are already hardened for sometime… See https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
Running fwupdmgr security also offers insight.
2 Likes
Security audit of Linux systems with fwupdmgr security and lynis:
# zypper install lynis
# lynis audit system
https://cisofy.com/documentation/lynis/
https://github.com/CISOfy/lynis
https://linuxconfig.org/automating-security-audits-with-lynis-on-linux-systems
3 Likes
Yet another tool:
kernel-hardening-checker => https://github.com/a13xp0p0v/kernel-hardening-checker
# zypper install git
# cd /var/spool/mail
# git clone https://github.com/a13xp0p0v/kernel-hardening-checker.git
# cd kernel-hardening-checker/
# git checkout v0.6.17.1
# zypper install python311
# python3.11 bin/kernel-hardening-checker --autodetect
2 Likes
- Disable kernel module loading after boot.
# more /etc/sysctl.d/99-myMachine.conf |grep modules_disabled
kernel.modules_disabled = 1
# ls -alh /etc/sysctl.d/99-myMachine.conf
-rw-r--r-- ... root root ... 99-myMachine.conf
# man systemd-sysctl.service
# man sysctl.d
https://www.kernel.org/doc/html/latest/admin-guide/sysctl/kernel.html#modules-disabled
- Prepare a whitelist of all the necessary kernel modules.
# lsmod |awk {'print $1'} |sort > /etc/modules-load.d/99-myMachine.conf
# ls -alh /etc/modules-load.d/99-myMachine.conf
-rw-r--r-- ... root root ... /etc/modules-load.d/99-myMachine.conf
# man systemd-modules-load.service
# man modules-load.d
- Check the whitelist and remove all unwanted kernel modules
# lsmod
# modinfo --field description <kernel module>
# modinfo --field description exfat
Do not forget to add any necessary USB or filesystem kernel module to the whitelist:
uas, snd_usb_audio, usbhid, usblp, cdc_acm, exfat, vfat?
- Rebuild initramfs and reboot
# dracut -f
# reboot
# cat /proc/sys/kernel/modules_disabled
1
# dmesg -l warn
# journalctl -b --priority 3
# lsmod
2 Likes