Security and compliance¶

Herd is hardened by default — a freshly installed server comes with a sensible security profile, with no configuration needed from you. This page explains what's enabled, how to audit, and how to adjust.

What's hardened¶

Area	Herd default
SELinux	`enforcing`
Firewall	`firewalld` allowing only SSH and Cockpit (plus `dhcpv6-client`); `mdns` off
SSH	key-only; no root; login attempt limits (see below)
Passwords	quality minimum (`pwquality`) and password aging
umask	`027` on login sessions (new files aren't world-readable)
Packages	`gpgcheck=1` (signature verification in dnf)

SSH — default policy¶

File: /etc/ssh/sshd_config.d/50-capivaraos-herd.conf

PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 30
AllowAgentForwarding no

Password policy¶

Quality — /etc/security/pwquality.conf.d/50-capivaraos-herd.conf: minimum length 12, at least 3 character classes, no long repeats/sequences.
Aging — /etc/login.defs: maximum 90 days, minimum 7 days.

Ciphers (crypto policy)

SSH and TLS ciphers/MACs/KEX follow the system crypto-policy (already strong by default on Fedora), rather than values hardcoded in Herd.

Audit: `herd-compliance-scan`¶

Herd embeds an OpenSCAP scanner with Fedora's SCAP Security Guide content. Run:

sudo herd-compliance-scan

This evaluates the system against the standard profile and generates:

/root/herd-compliance-<date>.html      # readable report (open in a browser)
/root/herd-compliance-<date>.xml       # XCCDF results (machine)
/root/herd-compliance-<date>.arf.xml   # ARF: re-renderable evidence / auditing

To list available profiles or run another one (it accepts the same aliases as herd-harden — standard, ospp, cis-l1, cis-l2, pci — or the full id):

herd-compliance-scan --list
sudo herd-compliance-scan ospp

ARF is the evidence

The .arf.xml is the machine-readable format that bundles datastream + results together: you can regenerate the report later without re-scanning, and it's what auditing/aggregation tools consume.

Copy the report to your PC

scp user@<ip>:/root/herd-compliance-*.html .

(or open the file via Cockpit's Terminal/Files.)

Community's baseline profile

Herd Community focuses on a solid baseline (SSH, firewall, SELinux, password, umask). Heavier controls like full auditd, AIDE and the complete CIS profile are the Enterprise path; the embedded datastream already includes the cis/cis_server_l1 profiles should you want to evaluate them.

Adjust¶

All configuration comes from the capivaraos-herd-hardening package. You can override it to match your policy.

SSH — enable password (with a caveat)¶

Think twice

SSH password authentication increases the attack surface (brute force). Prefer keys. Only enable password auth if you really need it, and combine it with fail2ban/firewall source limits.

Create a drop-in that comes after ours (alphabetical order):

sudo tee /etc/ssh/sshd_config.d/60-local.conf >/dev/null <<'EOF'
PasswordAuthentication yes
EOF
sudo systemctl restart sshd

Adjust password rules¶

sudo tee /etc/security/pwquality.conf.d/60-local.conf >/dev/null <<'EOF'
minlen = 14
EOF
# aging: edit /etc/login.defs (PASS_MAX_DAYS / PASS_MIN_DAYS)

Add your SSH key¶

install -d -m 700 ~/.ssh
echo "ssh-ed25519 AAAA... you@machine" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Planning to apply ospp/cis or FIPS mode? Don't rely on ed25519

These profiles switch the system crypto-policy to FIPS, which does not accept ed25519 keys (nor ciphers outside the FIPS set). Generate an RSA (ssh-keygen -t rsa -b 3072) or ECDSA (ssh-keygen -t ecdsa -b 384) key before hardening and confirm a fresh login. For the default baseline, ed25519 is still great. See One-command hardening.

Production best practices¶

Expose the minimum: only the necessary ports in firewalld.
Access Cockpit over VPN/tunnel, not open to the internet.
Keep the system updated (dnf upgrade) — Fedora security updates.
Run herd-compliance-scan periodically and address what makes sense for your environment.

Encryption at rest and FIPS (optional)¶

Two reinforcements that are off by default (so they don't get in the way of headless servers and cloud), which you enable when your policy calls for them.

Disk encryption (LUKS)¶

Protects data at rest (a stolen/discarded disk leaks nothing). It's an install-time decision. Since the Herd installer is text-mode (no "Encrypt my data" checkbox from the graphical version), encryption is set via the kickstart — since 1.0.1 the cryptsetup package ships in the ISO payload, so an encrypted install works offline. Use the Herd kickstart template:

clearpart --all --initlabel
autopart --type=lvm --encrypted --passphrase=YOUR-PASSPHRASE

Point the installer at that kickstart either by building your own ISO (KS=my.ks ./build-iso.sh, see the repository) or by passing inst.ks=<url> at boot.

Verify afterward:

lsblk                       # the device should show up as "crypt"
sudo cryptsetup status luks-<uuid>

Headless server: the passphrase is asked at boot

A LUKS volume prompts for the passphrase on every boot. Without a console (physical/IPMI/serial), the machine won't come up on its own after a reboot. For server auto-unlock, use NBDE — clevis with TPM2 (local seal) or Tang (key over the network). Do not use LUKS on the cloud image (qcow2).

FIPS mode¶

FIPS 140 forces the use of validated cryptographic modules only and restricts the allowed algorithms. Useful for government/sector requirements.

Fedora 44 no longer ships fips-mode-setup

Fedora removed fips-mode-setup. FIPS is now turned on with fips=1 on the kernel command line — preferably at install time (enabling it afterward "has subtle bugs and is no longer recommended", per Fedora). The initramfs already ships the fips module and the crypto-policy switches to FIPS on its own when the kernel is in FIPS mode.

Recommended — at install: on the ISO boot menu, edit the entry (e/Tab) and append fips=1 to the kernel line. The installed system boots in FIPS.

Post-install (with the caveat above): on Herd /boot is a separate partition, so fips=1 must be paired with boot=UUID=<uuid of /boot>. This block detects the UUID for you:

if findmnt /boot >/dev/null 2>&1; then
  UUID=$(sudo blkid -s UUID -o value "$(findmnt -no SOURCE /boot)")
  ARGS="fips=1 boot=UUID=$UUID"
else
  ARGS="fips=1"
fi
sudo grubby --update-kernel=ALL --args="$ARGS"
sudo reboot

Verify:

cat /proc/sys/crypto/fips_enabled     # 1 = active
update-crypto-policies --show          # FIPS

To disable: remove fips=1 (sudo grubby --update-kernel=ALL --remove-args="fips=1") and reboot.

Test access before relying on it

FIPS mode restricts algorithms: in particular, ed25519 SSH keys stop being accepted (use RSA or ECDSA), along with ciphers and certificates outside the approved set. Confirm SSH login on a second session right after rebooting, before closing the access you have.

Third-party credits and licenses¶

herd-compliance-scan uses the SCAP Security Guide (ComplianceAsCode project). Herd redistributes the SSG datastream for Fedora (ssg-fedora-ds.xml), licensed under BSD-3-Clause:

Copyright (c) 2012-2017, Red Hat, Inc. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided the BSD-3-Clause conditions are met (retain the copyright notice, conditions and disclaimer; the holders' names may not be used for endorsement). The full text ships with the capivaraos-herd-hardening package under /usr/share/licenses/capivaraos-herd-hardening/ and is available in the SSG repository.

Profile names (standard, cis, cis_server_l1, etc.) come from the SSG itself. "CIS" refers to the Center for Internet Security benchmarks; Herd does not reproduce the benchmark text, it only runs the corresponding profiles shipped by the SSG.

Content produced with AI assistance, under continuous review. Found an error? Open an issue.