Hardening Accomplishments

Sets the system-wide cryptographic policy to disable weak algorithms like SHA-1, protecting all TLS, SSH, and certificate operations on the node.

Removes 'nullok' from PAM authentication so that accounts with empty passwords cannot log in to cluster nodes.

Configures the SSH daemon to reject login attempts using empty passwords.

Hardens SSH daemon settings: disables root login, GSSAPI, rhosts, user known hosts, user environment, and enables strict mode.

Applies kernel sysctl parameters to restrict core dumps, disable ICMP redirects, and harden memory protections.

Adds audit rules to track changes to file permissions and ownership (DAC modifications) so unauthorized access attempts are logged.

Adds audit rules to log SELinux policy changes and access control modifications on the node.

Adds audit rules to log loading and unloading of kernel modules, detecting rootkits or unauthorized drivers.

Adds audit rules to detect attempts to change the system clock, which could be used to tamper with log timestamps.

Adds audit rules to monitor login events, failed authentication attempts, and account lockouts.

Adds audit rules to log changes to network configuration files and hostname changes.

Configures the audit daemon (auditd) with proper hostname identification for centralized log correlation.

Enables encryption of etcd data at rest using AES-CBC, protecting secrets and sensitive API resources stored in the cluster database.

Ensures the cluster ingress controller uses strong TLS cipher suites. Passes by default on OCP 4.22+.

Sets the API server audit profile to WriteRequestBodies, logging the full content of write operations for forensic analysis.

Sets SSH daemon log level to capture detailed connection and authentication events. Passes by default on RHCOS 9.8+.

Restricts access to kernel ring buffer messages (dmesg) to root only, preventing information leakage to unprivileged users.

Extends audit coverage with 11 additional rules for file attribute changes (chmod, chown, fsetxattr, etc.).

Adds audit watches on 12 identity and authentication files (/etc/passwd, /etc/shadow, /etc/group, etc.) to detect unauthorized modifications.

Adds audit rules to log file deletion operations (unlink, rename, rmdir) for forensic tracking of removed files.

Adds audit rules for 32 system calls to log all unsuccessful file modification attempts, catching permission-denied and missing-file errors.

Adds audit rules to log execution of 22 privileged commands (sudo, chage, mount, etc.) to track administrative actions.

Adds audit rules for session initiation, MAC policy changes, audit log exports, and makes the audit configuration immutable until reboot.

Adds audit watches on user/group management files (/etc/passwd, /etc/group, /etc/gshadow, /etc/security/opasswd) to log account changes.

Configures audit log retention settings: maximum log file size, number of retained logs, and disk-full behavior.

Blacklists 18 kernel modules (USB storage, Firewire, Bluetooth, uncommon filesystems, etc.) to reduce the node attack surface.

Applies 20 network sysctl hardening parameters: disables IP forwarding, source routing, ICMP redirects, and enables reverse path filtering.

Sets kernel parameters to disable core dumps, block kexec_load, and increase perf_event paranoia level.

Adds 6 kernel boot arguments: enables audit at boot, sets audit backlog limit, disables USB, enables page poisoning, PTI, and disables vsyscall.

Configures Chrony NTP client to use designated time servers with restricted port access and polling intervals.

Disables systemd core dump collection, masks the Ctrl-Alt-Del reboot target, and masks the systemd-coredump socket.

Applies additional SSHD hardening from the Moderate profile: sets ClientAliveInterval and ClientAliveCountMax for idle session timeout.

Requires USBGuard daemon to control USB device access. Cannot be remediated — USBGuard RPM is not included in RHCOS.

Mixed group: restricts node-level terminal access (securetty, audit trail) and configures cluster login banner or OAuth templates.

Configures OAuth access token inactivity timeout and token max age to automatically expire idle sessions.

Manual review items: workload container security — verifying pod security standards, resource limits, and image provenance.

Manual review items: RBAC and access control — verifying least-privilege roles, service accounts, and cluster-admin restrictions.

Manual review items: secrets management — verifying that sensitive data is stored in Secrets resources, not in ConfigMaps or environment variables.

Manual review items: audit log storage — verifying that dedicated partitions or persistent volumes are used for audit log retention.

Manual review items: hardware BIOS settings, alerting rules, and physical security controls that cannot be checked by automated scans.