Follow-up: MFS Meeting. Tue, 20 Nov. "NCSC End User Device security - Installer. AppArmor+auditd. GRUB."

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1007322386689153100==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="32eQ7HbiN10Jfh3b5sSZNOOlVtjr89X8l"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--32eQ7HbiN10Jfh3b5sSZNOOlVtjr89X8l
Content-Type: multipart/mixed; boundary="px2GoMLc6C2AhT0XeDOSkcoqSOlDR2OMn";
 protected-headers="v1"
From: Michael Dorrington <[email protected]>
To: Manchester Free Software <[email protected]>
Cc: Free Software and the United Kingdom <fsfe-uk-mXXj517/[email protected]>
Message-ID: <2e232f33-d1f2-e1f0-c983-e2eccdbe1fd7-IGUgQLVVQiRCV4ILt04nZQ@public.gmane.org>
Subject: Follow-up: MFS Meeting. Tue, 20 Nov. "NCSC End User Device security -
 Installer. AppArmor+auditd. GRUB."
References: <877f378e-3731-b41c-ffa3-d74cf56eb584-IGUgQLVVQiRCV4ILt04nZQ@public.gmane.org>
In-Reply-To: <877f378e-3731-b41c-ffa3-d74cf56eb584-IGUgQLVVQiRCV4ILt04nZQ@public.gmane.org>

--px2GoMLc6C2AhT0XeDOSkcoqSOlDR2OMn
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: quoted-printable

On 16/11/2018 00:17, Michael Dorrington wrote:
> Please forward this notice to those that would welcome it.
>=20
> You can subscribe to the Manchester Free Software mailing list at:
> https://lists.nongnu.org/mailman/listinfo/fsuk-manchester
>=20
> * Event: Manchester Free Software's November Meeting
>=20
> * 45 minute slot: AppArmor + auditd
> * 15 minute slot 1: Debian Installer Preseeding for security
> * 15 minute slot 2: Boot process hardening including GRUB
> * 15 minute slot 3: Security monthly round-up

The National Cyber Security Centre (NCSC) End User Device (EUD) Security
Guidance for GNU/Linux is at:
https://www.ncsc.gov.uk/guidance/eud-security-guidance-ubuntu-1804-lts

In January's MFS meeting we will do the remaining parts of the NCSC EUD
security; the large part will be on VPN with smaller parts on user
setup, file systems and automatic updates.  Over the Christmas and New
Year period you can put into practice the items we covered in November's
meeting, particularly:


1. Setup AppArmor and enforce the profiles in the guidance.

Some distros will require enabling AppArmor, hints:
apparmor=3D1 security=3Dapparmor
/etc/default/grub

Advanced: Produce a profile for an application that is missing one.

2. Setup auditd to start from boot and put in rules useful for your
situation.

Hints:
audit=3D1
/etc/default/grub
man audit.rules

3. Use 'Preseeding' (or the equivalent for your distro) to ensure
security setup is consistently done during Operating System installation.=


Advanced: Use a tool to ensure that the security setup is kept as
desired throughout the life of the Operating System.

4. Set a GRUB password

You could configure GRUB so it only needs a password if not doing the
default boot or you could require a password for doing anything.  It is
probably best to start with allowing a default boot without password in
case you make a mistake and so lock yourself out.


Post to the MFS mailing list if you need more hints or help.

See you at MFS Christmas meeting on Tuesday,
Mike.
MFS Chair.

--=20
FSF member #9429
http://www.fsf.org/register_form?referrer=3D9429
http://www.fsf.org/about
"The Free Software Foundation (FSF) is a nonprofit with a worldwide
mission to promote computer user freedom and to defend the rights of all
free software users."


--px2GoMLc6C2AhT0XeDOSkcoqSOlDR2OMn--

--32eQ7HbiN10Jfh3b5sSZNOOlVtjr89X8l
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEymnV/lrtCqpNhpze13JsPqr44+8FAlwSw3wACgkQ13JsPqr4
4++wEhAAl6Due7XQLGucA2pXx+qq8FOadITcS8BvbL9fodDcJPuPFdAwnuuLmOG/
RC004Y8mcZWsyzMeN5LvdxFxOlh0CFJyakPNyLDgwMvEJw+UKtNCId6jsZpaSwX6
TmW6uXUxRJtCXyUatGtboQ1GqnyHrnvLWwNcrYJtzLCPLmAs8anQG1AK7ZhR9at7
oN3h+Tpq0O0BT79iPbTEIIZW33IZmsDCJ7GzAQODifeimIB+t3PILuvtB2aamY/h
LE2ZkBvO0LW9Fu0OYJUIxWHKQcSMqO7Dy1Eyqc32FtaOxzMiiUxSsKG6lj8md6lT
FdW2/I/AeN0RsiIi+ZJ7ieQh2anUkHhG9NeTk3R3EUPBoFrHGgwG2QsH3F2ndpwC
wEKA0pYI3RHb0ews7LoGJIi0nyOz7ron+Nj4FYaV57Bex/O9aagzpQloAmBRSUad
46exaocUfk/ySVcRB9y05P9kccWvyNSdQr1YjdDFetQ8HrcVDidwvcHT6vqZ1Fri
Ik4CQ+LlXO55yycN1msT51OQlbLk4QogN2gyGeKEhHYUIOti/dq/hCaLCk2+W+G/
ufwVB8lGPxO5Qeha2BYkGPzvpqTP3aGVR69TRJOZboEBq2Oryjj3P7TULeHR0tOJ
DxIipBARTv0P3cEqDXOvuVH826P6Jn+VjICsH38zpTRAmhlDI+4=
=t/w2
-----END PGP SIGNATURE-----

--32eQ7HbiN10Jfh3b5sSZNOOlVtjr89X8l--


--===============1007322386689153100==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fsuk-manchester mailing list
[email protected]
https://lists.nongnu.org/mailman/listinfo/fsuk-manchester

--===============1007322386689153100==--