7

On AlmaLinux during setup there is an option to choose a Security Profile. I run live and public websites on this server, so security is good, but I don't know what these are and how it could benefit me.

enter image description here

enter image description here

Should I choose one of these, and if so, which one? Or, should I ignore this, is it only for special use cases?

unixaddict
  • 197
  • 6

2 Answers2

7

These are OpenSCAP profiles to ensure compliance with various government security standards. These are mostly used in situations when you are required to adhere to some specific security policy. So you'd usually choose a security policy if you are working for a governmental organization or your company is a government contractor or something similar.

The installer basically checks the policy rules and makes changes (or ask you to make changes) to follow the policy. The rules can define partition layout (for example force encryption), specify what packages should be installed (or should not), what services needs to be enabled and how should they be configured (for example SSH with root login disabled) etc. The rules are public, if you are interested, you can read for example the first one from your screenshot, the French ANSSI-BP-028.

You can read more about this in the RHEL installer guide. The rules generally can have some useful security "tips & tricks" but I wouldn't bother using them on a private machine, using some general guides for server hardening is probably better than picking a specific government policy.

Vojtech Trefny
  • 16,922
  • 6
  • 24
  • 48
4

While above answer is somewhat useful, giving some partial explanation, it does not really clarifies what does this installer choice actually do.

While it adds certain checking scripts and package setup given the policy as mentioned above, I believe the most important thing for you, is how it affects SELinux configuration, which has probably highest impact on the behavior of your machine.

etosan
  • 884
  • 4
  • 7