Revision as of 18:38, 20 June 2012 (edit) Mshinn (Talk | contribs) (→‎=) ← Older edit		Revision as of 19:11, 20 June 2012 (edit) (undo) Mshinn (Talk | contribs) (→‎SSH daemon configuration) Newer edit →
Line 298:		Line 298:
	=== SSH daemon configuration ===		=== SSH daemon configuration ===
		+
		+	Also, see the [[SSH debugging]] page in case you can't log into your ASL server via SSH.
	=== Rkhunter settings ===		=== Rkhunter settings ===

---

Revision as of 19:11, 20 June 2012

Contents 1 Introduction 1.1 Installation 1.2 Post Installation Configuration 1.2.1 Authentication Information 1.2.2 ASL Web Settings 1.2.2.1 ASL_DB_RETENTION 1.2.2.2 ASL_DB_ARCHIVE 1.2.3 Data Paths 1.2.3.1 PATH_RSS 1.2.4 General Settings 1.2.4.1 NOTIFY 1.2.4.2 EMAIL 1.2.4.3 HOSTNAME 1.2.4.4 ADMIN_USERS 1.2.4.5 SYSTEM_TYPE 1.2.4.6 AUTOMATIC_UPDATES 1.2.4.7 UPDATE_TYPE 1.2.4.8 RESTART_APACHE 1.2.4.9 ASL_USER 1.2.4.10 FEED_TYPE 1.2.4.11 COMPLIANCE 1.2.5 Firewall Configuration 1.2.6 Kernel configuration 1.2.7 ALLOW_kmod_loading 1.2.8 ENABLE_TPE 1.2.9 TPE_GROUP_POLICY 1.2.10 TPE_UNTRUSTED_USERS 1.2.11 TPE_TRUSTED_USERS 1.2.12 DISABLE_PRIVILEGED_IO 1.2.13 AUDIT_MOUNT 1.2.14 AUDIT_CHDIR 1.2.15 AUDIT_PTRACE 1.2.16 AUDIT_TEXTREL 1.2.17 CHROOT_CAPS 1.2.18 CHROOT_DENY_CHMOD 1.2.19 CHROOT_DENY_CHROOT 1.2.20 CHROOT_DENY_FCHDIR 1.2.21 CHROOT_DENY_MKNOD 1.2.22 CHROOT_DENY_MOUNT 1.2.23 CHROOT_DENY_PIVOT 1.2.24 CHROOT_DENY_SHMAT 1.2.25 CHROOT_DENY_SYSCTL 1.2.26 CHROOT_DENY_UNIX 1.2.27 CHROOT_ENFORCE_CHDIR 1.2.28 CHROOT_ENFORCE_CHDIR 1.2.29 CHROOT_EXECLOG 1.2.30 CHROOT_FINDTASK 1.2.31 CHROOT_RESTRICT_NICE 1.2.32 EXEC_LOGGING 1.2.33 EXEC_LOG_USERS 1.2.34 DMESG 1.2.35 EXECVE_LIMITING 1.2.36 FIFO_RESTRICTIONS 1.2.37 FORKFAIL_LOGGING 1.2.38 HARDEN_PTRACE 1.2.39 IP_BLACKHOLE 1.2.40 LASTACK_RETRIES 1.2.41 LINKING_RESTRICTIONS 1.2.42 RESOURCE_LOGGING 1.2.43 ROMOUNT_PROTECT 1.2.44 RWXMAP_LOGGING 1.2.45 SIGNAL_LOGGING 1.2.46 SOCKET_ALL 1.2.47 SOCKET_USERS 1.2.48 SOCKET_CLIENT 1.2.49 SOCKET_CLIENT_USERS 1.2.50 SOCKET_SERVER 1.2.51 SOCKET_SERVER_USERS 1.2.52 TIMECHANGE_LOGGING 1.2.53 ClamAV configuration 1.2.54 CLAMAV_ENABLED 1.2.55 CLAMAV_ENABLE_DAZUKO 1.2.56 CLAMAV_TCPADDRESS 1.2.57 CLAMAV_SCANONACCESS 1.2.58 CLAMAV_SCANONOPEN 1.2.59 CLAMAV_SCANONEXEC 1.2.60 CLAMAV_SCANONCLOSE 1.2.61 CLAMAV_CLAMUKO_MAXFILESIZE 1.2.62 PSMON configuration 1.2.63 PSMON_ENABLED 1.2.64 PSMON_NOTIFY 1.2.65 PSMON_EMAIL 1.2.66 PSMON_FROM 1.2.67 OSSEC configuration 1.2.68 OSSEC_ENABLED 1.2.69 OSSEC_NOTIFY 1.2.70 OSSEC_MODE 1.2.71 OSSEC_USE_MYSQL 1.2.72 OSSEC_DATABASE_SERVER 1.2.73 OSSEC_DATABASE 1.2.74 OSSEC_DATABASE_USERNAME 1.2.75 OSSEC_DATABASE_PASSWORD 1.2.76 OSSEC_SERVER 1.2.77 OSSEC_EMAIL 1.2.78 OSSEC_SMTP_SERVER 1.2.79 OSSEC_FROM 1.2.80 OSSEC_MAX_MSG 1.2.81 OSSEC_ACTIVE_RESPONSE 1.2.82 OSSEC_SHUN_ENABLE_TIMEOUT 1.2.83 OSSEC_SHUN_TIME 1.2.84 HIDS_SHUN_MULTIPLIER 1.2.85 HIDS_EMAIL_ALERT_LEVEL 1.2.86 Mod_security configuration 1.2.87 PHP configuration 1.2.88 SSH daemon configuration 1.2.89 Rkhunter settings 1.2.90 Mod_evasive 1.2.91 Web App Inventory 1.2.92 Plesk Security Settings

Introduction

ASL is configured to a secure set of defaults upon installation. Most users do not need to change these settings.

Installation

ASL Installation settings are documented on the ASL installation page, please see that page for installation configuration options.

Post Installation Configuration

You can access the ASL configuration settings by following this process:

Step 1) Log into the ASL GUI

Step 2) Click on the Configuration tab

Step 3) Select "ASL Configuration"

This will pull up all the ASL Configuration options, which are broken into classes and are documented below or links are provided to the specific documentation pages for those options.

Authentication Information

ASL Web Settings

In addition to the settings below, also, please see the ASL Web Settings page for documentation about configuring the ASL GUI itself.

ASL_DB_RETENTION

Period alert data is considered to be live before being moved into an archive table. Once this limit is reached, ASL will move the events into the database archive table.

The format for this field is an integer follow by "days" "weeks" "months" or "years". For example, if you want to archive events after 3 months, you would change this field to:

3 months

The default is 7 days. After 7 days, events are archived.

This value is ignored if ASL_DB_ARCHIVE is set to "no" below.

ASL_DB_ARCHIVE

ASL will store old data in monthly archive table if this is set to 'yes', or simply delete past retention data if it is set to 'no' once the ASL_DB_RETENTION period is reached for the data.

Data Paths

PATH_RSS

URL to the Atomicorp Security Bulletins RSS feed.

General Settings

NOTIFY

Determines if ASL will notify by email or not. Set this to yes if you want ASL to email you, and no if you do not.

EMAIL

Default email address used to send alerts to. This is also set during installation.

HOSTNAME

Hostname for the system. This is also set during installation.

ADMIN_USERS

Defines administrative users allowed to SSH to the system. If this is defined, AND the users exist, AND they have valid SSH keys, password auth and root logins will be automatically disabled.

SYSTEM_TYPE

Defines a basic services policy for the system. Currently webserver and custom are the only supported policies.

Setting the profile to "webserver" will configure ASL to disable the following services: portmap nfs nfslock rpcidmapd cups gpm xfs pcscd mcstrans kdump isdn hplip hidd messagebus haldaemon gpm bluetooth avahi-daemon autofs apmd.

If this is set to custom, no services will be automatically disabled.

AUTOMATIC_UPDATES

Configures the update frequency for ASL to download and install updates, such as new rules and signatures

NOTE: Updates can be run manually from the command line with asl -u.

This does not automatically patches on the system by design. If a software update is available you should follow your normal patch management procedure. See "UPDATE_TYPE" below for one exception to this.

UPDATE_TYPE

Configures the behavior of the AUTOMATIC_UPDATE event. There are three options:

All: This will install all ASL software, rule and signatures updates (this will not upgrade the kernel).

Exclude-kernel: This will install all ASL software, rule and signatures updates but not upgrade the kernel.

rules-only: This will exclude all software updates, yum package updates and kernel updates and will only install rule and signature updates.

All is the recommended setting. Some rule and signature updates will not work without ASL updates, so if you set this to "rules only" be sure to regularly check your system for any software updates for ASL to be fully protected.

RESTART_APACHE

Sets the restart policy for actions involving the web server. Updates to the WAF, mod_security, or mod_evasive policies will require a web server restart to go into effect. This setting has three options:

Yes: Restart apache when needed.

Graceful: Use the "graceful" method which tries to wait for all clients to finish being served before restarting Apache. If apache has a stuck thread or worker Graceful may not complete.

No: Do not restart apache.

Note: If you set this to "No", updates that require apache restarts will not be applied, such as new WAF rules. If you set this to "No" you will need to schedule regular restart intervals to install the latest rules. Only the latest rules are supported with the WAF.

ASL_USER

Sets the user to run ASL web activity under. This can be either "tortix" for use with ASL-Web, or "psaadm" for use with the Plesk ASL module. Note: this setting has been deprecated.

FEED_TYPE

This setting allows you to toggle between different WAF feeds. Currently this is only used by ASL Lite, and supports the Real-Time and 90-day delayed feeds. ASL Users should not change this setting.

COMPLIANCE

This a new and UNSUPPORTED feature. If you use this, we welcome your feedback but it is unsupported.

This enables a compliance module based on one of 5 standards (CIS, DISA, DHS, NISPOM, PCI). It is not recommended by Atomicorp that you use any of these. It should only be used if you are required by a 3rd party regulator.

These compliance standards are very generic, and will break things on your system. These are not Atomicorp standards, so if you enable them be prepared to fix things.

Firewall Configuration

Please see the ASL firewall page for documentation on these settings.

Kernel configuration

If you are not using the ASL Kernel these settings will have no effect.

ALLOW_kmod_loading

ENABLE_TPE

TPE_GROUP_POLICY

TPE_UNTRUSTED_USERS

TPE_TRUSTED_USERS

DISABLE_PRIVILEGED_IO

AUDIT_MOUNT

AUDIT_CHDIR

AUDIT_PTRACE

AUDIT_TEXTREL

CHROOT_CAPS

CHROOT_DENY_CHMOD

CHROOT_DENY_CHROOT

CHROOT_DENY_FCHDIR

CHROOT_DENY_MKNOD

CHROOT_DENY_MOUNT

CHROOT_DENY_PIVOT

CHROOT_DENY_SHMAT

CHROOT_DENY_SYSCTL

CHROOT_DENY_UNIX

CHROOT_ENFORCE_CHDIR

CHROOT_ENFORCE_CHDIR

CHROOT_EXECLOG

CHROOT_FINDTASK

CHROOT_RESTRICT_NICE

EXEC_LOGGING

EXEC_LOG_USERS

DMESG

EXECVE_LIMITING

FIFO_RESTRICTIONS

FORKFAIL_LOGGING

HARDEN_PTRACE

IP_BLACKHOLE

LASTACK_RETRIES

LINKING_RESTRICTIONS

RESOURCE_LOGGING

ROMOUNT_PROTECT

RWXMAP_LOGGING

SIGNAL_LOGGING

SOCKET_ALL

SOCKET_USERS

SOCKET_CLIENT

SOCKET_CLIENT_USERS

SOCKET_SERVER

SOCKET_SERVER_USERS

TIMECHANGE_LOGGING

ClamAV configuration

Also, see the anti virus page for important documentation about configuring the Real Time Antimalware system in ASL.

CLAMAV_ENABLED

CLAMAV_ENABLE_DAZUKO

CLAMAV_TCPADDRESS

CLAMAV_SCANONACCESS

CLAMAV_SCANONOPEN

CLAMAV_SCANONEXEC

CLAMAV_SCANONCLOSE

CLAMAV_CLAMUKO_MAXFILESIZE

PSMON configuration

PSMON_ENABLED

PSMON_NOTIFY

PSMON_EMAIL

PSMON_FROM

OSSEC configuration

OSSEC_ENABLED

OSSEC_NOTIFY

OSSEC_MODE

OSSEC_USE_MYSQL

OSSEC_DATABASE_SERVER

OSSEC_DATABASE

OSSEC_DATABASE_USERNAME

OSSEC_DATABASE_PASSWORD

OSSEC_SERVER

OSSEC_EMAIL

OSSEC_SMTP_SERVER

OSSEC_FROM

OSSEC_MAX_MSG

OSSEC_ACTIVE_RESPONSE

OSSEC_SHUN_ENABLE_TIMEOUT

OSSEC_SHUN_TIME

HIDS_SHUN_MULTIPLIER

HIDS_EMAIL_ALERT_LEVEL

Mod_security configuration

Please see the ASL WAF page for documentation on these settings.

PHP configuration

SSH daemon configuration

Also, see the SSH debugging page in case you can't log into your ASL server via SSH.

Rkhunter settings

Mod_evasive

Also, see the Mod evasive page for important documentation about configuring the DOS protection system for Apache.

Web App Inventory

Plesk Security Settings