Operating System Hardening¶
ARTESCA comes with its own hardened operating system to protect data and system integrity against threats. It is achieved with the following protections which are automatically applied during an installation or an upgrade.
Unprivileged user¶
artesca-os is the default operating system user account.
This unprivileged user is the only one who can log in using SSH and
who can run sudo commands.
Concerning filesystem permissions, the artesca-os user can only write
in the home directory /home/artesca-os.
Concerning application permissions, the artesca-os user can execute a subset
of commands required for ARTESCA administration and maintenance.
All other operations are forbidden.
No root login when using SSH¶
You cannot log in as root when using SSH.
Once logged in as the artesca-os user, any attempts to become root will fail. For
example, those commands are not permitted:
su -sudo su -sudo -s
Use sudo for everything¶
If you are logging in as an artesca-os user, you must use the sudo
command for all procedures requiring root privileges.
Reduced operating system footprint¶
ARTESCA OS only installs the minimum required packages to run ARTESCA. Everything else is removed. It reduces the possibilities of bugs, vulnerabilities, and consequently, cyber attacks.
Password Constraints¶
ARTESCA comes with built-in hardening based on CIS (Center for Internet Security) Rocky benchmark 2.0.0. One of the recommendations is to enforce password constraints, such as length, complexity, and history.
Refer to password constraints for the full list of enforced password constraints.
