2

During a Lynis audit I found this on a system that uses Fedora 28:

Checking Linux single user mode authentication WARNING

enter image description here

And under results I got:

        No password set for single mode [AUTH-9308]

enter image description here

Rkhunter skips "Checking for hidden processes" enter image description here

What more can I do to harden this system? Thank you.

3

To password-protect single user mode, you need to replace the single user mode shell with something like sulogin. Here's a page that describes how to do it under the various major RHEL variants, which should cover your Fedora variant.

I'm assuming based on recentness of Fedora 28 that it looks somewhat like RHEL 7, in which case you'll want to check the ExecStart line of /usr/lib/systemd/system/rescue.service. The link above suggests it should look like this:

ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"

If you don't see sulogin in that line, that's your problem.

Please note that in most cases requiring a boot time password is meaningless unless you're also performing disk encryption, and that disk encryption should have a separate prompt for its password before you even get to this point. So this setting may be redundant, depending on your system configuration, which is the sort of nuance an audit tool might miss.

As for the rkhunter issue, do you have unhide installed? This link suggests that if it is missing, that would explain why hidden process checking is skipped.

  • After I installed unhide, the hidden process check was not skipped and it turned out well. – Patriot May 29 '18 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.