If other alternatives are unavailable, this can be accomplished by installing a SOHO router/firewall in between the network and the host to be protected.

Since /tmp is intended to be world writable, creating a separate partition for it can prevent resource exhaustion. Setting nodev prevents users from creating or using block or special character devices. Setting noexec prevents users from running binary executables from /tmp. Setting nosuid prevents users from creating set userid files in /tmp.

Install and use the yum-security plugin. 
To install the plugin run:

yum install yum-security

To list all updates that are security relevant, and get a reutrn code on whether there are security updates use:

yum --security check-update

To apply updates that are security relevant use:

yum --security update

Setting user/group ownership to root and file permissions to read and write only for root is recommended to prevent non-root users from viewing or changing the boot parameters.

A simple way to disable the GUI is to change the default run level. Edit the file /etc/inittab. Look for the line that contains the following:

id:5:initdefault:

Replace the "5" with "3". The line will then read:

id:3:initdefault:

Core dumps are intended to help determine why a program aborted. They may contain sensitive or confidential data from memory. It is recommended that core dumps be disabled or restricted. The system should be configured to prevent setuid programs from creating core dumps.

Add the following line to the /etc/sysctl.conf file:

kernel.randomize_va_space = 2  

Disable any xinetd services you do not absolutely require by setting "disable=yes" in /etc/xinetd.d/*.

Configure TCP wrappers for access control. 
Edit /etc/hosts.deny to include this entry as the first uncommented line in the file: ALL:ALL 
Ensure /etc/hosts.allow is edited appropriately to allow the administrator(s) to connect. 
Verify that you have disabled any unnecessary startup scripts under /etc, /etc/rc*.d, or /etc/init.d (or startup script directory for your system) and disabled any unneeded services from starting in these scripts.

Unnecessary services can be disabled with:

$ sudo chkconfig off

To check what services are listening use: 

$ lsof  \| grep '*:' 

or

$ sudo netstat \--tulp

Much more detailed information regarding services is available in the CIS benchmark documents.

Red Hat also provides a text-based interface for changing startup services: ntsysv

For example, the command

ntsysv \--level 345

configures runlevels 3, 4, and 5.

If no xinetd services are required, disable xinetd altogether:

sudo service xinetd stop; sudo chkconfig xinetd off

RHEL7 comes with firewalld, however iptables may be installed and used instead. This is documented at: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html

Below is a list of some iptables resources: 
http://firehol.sourceforge.net 
http://sourceforge.net/projects/fwbuilder 
http://www.simonzone.com/software/guarddog

If you decide to utilize SSH, the ISO highly recommends the following:

• Change the port from port 22 to something/anything else. There are scripts online that malicious hackers can use against an SSH server. These scripts almost always only attack port 22 since most people do not change the default port.
• Use SSH2 (by setting Protocol 2 in the sshd_config file) as it remediates many vulnerabilities from SSH1.
• Restrict access to the SSH port using a hardware or software firewall.
• If possible, use keys with passphrase instead of just passwords. To create rsa keys, follow these commands:
  • ssh-keygen \--t rsa
    ssh server "mkdir .ssh; chmod 0700 .ssh"
    scp ./ssh/ida_rsa.pub server:.ssh/authorized_keys2
• The CIS Solaris Benchmark covers some suggested basic settings to place in the configuration file. 
  You may also want to visit the SSL Web site.

INFO is a basic logging level that will capture user login and logout activity. Other logging levels may be used, but may generate more noise. The DEBUG logging level is not recommended for production servers.

Many resources exist for understanding and configuring SELinux:

• http://www.selinuxproject.org/page/Main_Page
• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/

SELinux is enabled by default with RHEL systems and should not be disabled unless absolutely necessary.

Auditd monitors various system activity, such as system logins, authentications, account modifications, and SELinux denials. These records may help administrators identify malicious activity or unauthorized access.

Splunk licenses are available through ITS at no charge. ITS also maintains a centrally-managed Splunk service that may be leveraged.

• Check in /etc/sudoers to see who has sudo rights
• Check in /etc/groups to see what groups your users belong to
• Check in /etc/passwd and/or /etc/shadow for blank passwords
• Check the strength of users' passwords with tools such as John the Ripper
• Seek approval from IT Owner. Consider using a simple dictionary for easily guessed passwords.
• Develop a procedure to report and remediate easily guessed passwords.

Ensure the following are set in /etc/pam.d/other:

• auth  required pam_deny.so
• auth   required pam_warn.so
• account  required pam_deny.so
• account  required pam_warn.so
• password  required pam_deny.so
• password  required pam_warn.so
• session  required pam_deny.so
• session  required pam_warn.so
• session  required pam_deny.so

Warn will report alerts to syslog.

To require strong passwords, in compliance with section 5.18 of the Information Resources Use and Security Policy:

For RHEL 6:

In /etc/pam.d/system-auth, add or change the file as required to read:

For RHEL 7:

In /etc/security/pwquality.conf, add:

In /etc/pam.d/system-auth, add or change the file as required to read:

Ensure that the terminal security file (for example, /etc/securetty or /etc/ttys) is configured to deny privileged (root) access. On a Red Hat box, this means that no virtual devices (such as /dev/pty*) appear in this file.

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

There are few viruses that infect Linux computers; therefore, it is understandable for most Linux servers to have an exception to this rule. See the Operations Manual for information on the exception process.

You may choose any proven anti-virus product. One option is ClamAV.

There are a variety of methods available to provide encrypted storage. Two good candidates are LUKS and GNUPG (free).