Plans for next generation linux desktop support.
Desktop Linux Distributions supported at SLAC
Ubuntu 16.04 LTS, codename "Xenial Xerus"
Long term support (LTS) releases are for 5 years.
- 16.04 = YY.MM of release date (released April 2016)
- End of Life date is April 2021
It is possible to upgrade (complete reinstall not required) from one LTS distro to the next (eg, 14.04 -> 16.04)
- CentOS 7
- 10 year support lifetime
- End of Life date is June 2024
- Red Hat sponsors the CentOS project: in 2014 CentOS officially joined forces with Red Hat
Desktop Linux Authentication Configuration
- Windows Active Directory will be used for authentication
- This aligns with the SCS long term plan to reduce dependence on Unix Heimdal Kerberos
Security Services/Features needed
These are taken directly from the SLAC MinSec Policy (which has 11 items that match the 11 items below)
These will be configured using Chef Configuration Management and Compliance scanning/reporting
- Anti-virus Software
- Install and configure ClamAV (optional, since not in moderate enclave)
- Application Patches
- Configure automatic updates for Applications via apt/yum config
- Authentication
- Global account authentication policy handled by Active Directory
- Use Chef Compliance to scan for any enabled insecure protocols such as telnet and ftp
- Logging
- Configure syslog to log to central syslog server, and enable logging locally to /var/log/everything
- Network Services
- Check for inappropriate network services via Chef Compliance
- Operating System Patches
- Configure automatic updates for OS patches via apt/yum
- Passwords
- Configure local password quality checks and policies (expiration time, etc) according to SLAC password policy
- Global account password policy handled by Active Directory
- Baseline Security Configuration
- CIS Level 1 Workstation Profile will be used (modified where appropriate)
- Chef Compliance scanning can report on compliance level for our baseline
- PDFs are available for the CIS Benchmarks for Ubuntu 16.04 and CentOS 7
- Training
- No additional changes needed (same SLAC Training Assignments are required)
- Security Scanning
- Local scanner account will be enabled to allow authenticated Nessus scans by Cyber Security team
- Banner
- The SLAC DOE login banner will be configured
- The SLAC DOE login banner will be configured
Additional Operating System Configuration needed
These will be configured using Chef Configuration Management and Compliance scanning/reporting
- NTP client
- DNS client
- logrotate
- mailgateway (mail client)
- sudo
- shells
- unixadmins (sets up unix-admin logins and scanner account)
- root (manage root password and root home environment)
Reference Documents
Published SLAC Policies and Governance SLAC Controlled Documents page:
https://docs.slac.stanford.edu/sites/pub/Pages/SLAC_Policies.aspxMinimum Security Requirements for Computing
https://docs.slac.stanford.edu/sites/pub/Publications/701-I02-001-00_Min_Sec_Req_for_Comp.pdfConfiguration Management Procedures in the SCS twiki:
https://novel.slac.stanford.edu/twiki/bin/view/SCCS/ConfigurationManagementSLAC Password Policy
http://www2.slac.stanford.edu/computing/security/password/passwordpolicy.htmCIS Benchmarks
CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf
CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf
CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v2.1.1.pdf
CIS_Red_Hat_Enterprise_Linux_6_Benchmark_v2.0.2.pdf
CIS_CentOS_Linux_6_Benchmark_v2.0.2.pdf