Automate CentOS 6 deployments with CIS Security Benchmarks already applied

major@mhtx.net (Major Hayden) — Fri, 26 Apr 2013 14:15:24 +0000

A coworker heard me grumbling about Linux system administration standards and recommended that I review the CIS Security Benchmarks. After downloading the Red Hat Enterprise Linux 6 security benchmark PDF, I quickly started to see the value of the document. Some of the standards were the installation defaults, some were often forgotten settings, and some were completely brand new to me.

Automating the standards can be a little treacherous simply due to the number of things to adjust and check. I’ve created a kickstart for CentOS 6 and tossed it on Github:

https://github.com/rackerhacker/securekickstarts

Be sure to read the disclaimers in the README before getting started. Also, keep in mind that the kickstarts are in no way approved by or affiliated with the Center for Internet Security in any way. This is just something I’m offering up to the community in the hope that it helps someone.

Installing Fedora 16 in XenServer

major@mhtx.net (Major Hayden) — Sun, 12 Feb 2012 03:39:11 +0000

Getting Fedora 16 working in XenServer isn’t the easiest thing to do, but I’ve put together a repository on GitHub that should help. The repository contains a kickstart file along with some brief instructions to help with the installation. If you’re ready to get started right now, just clone the repository:

git clone git://github.com/rackerhacker/kickstarts.git kickstarts

There are some big issues with Fedora 16 which cause problems for installations within XenServer:

the installer sets up a console on something other than hvc0
anaconda won’t start without being in serial mode
anaconda tries to use GPT partitions by default
grub2 is now standard, but it causes problems for older XenServer versions

My kickstart works around the grub2 problem by throwing down an old-style grub configuration file and creating the proper symlinks. This config will still be updated when you upgrade kernels (at least in Fedora 16). It also sets up a very simple partitioning schema with one root and one swap partition. A DOS partition table is used in lieu of a GPT partition table.

When you start the installation, be sure to review the README.md in the git repository. It has some special instructions for boot options to meet the requirements of Fedora 16 and the kickstart file.

Kickstart on Major Hayden

Automate CentOS 6 deployments with CIS Security Benchmarks already applied

Installing Fedora 16 in XenServer