Hardening & Compliance on Flatcar Container Linux

Flatcar Container Linux FIPS guide

Mon, 01 Jan 0001 00:00:00 +0000

FIPS stands for Federal Information Processing Standards, a set of standards issued by the National Institute of Standards and Technology (NIST). While Flatcar is not officially FIPS certified, it is possible to deploy it so that it is compliant with two of these standards:

Enabling FIPS

Booting the instance with the kernel parameter fips=1 allows the instance to operate in a FIPS 200 mode. This means the kernel will use FIPS-compliant algorithms and will enforce some security practices like RSA key size . It’s also recommended to create the empty file /etc/system-fips for other software (like cryptsetup).

Flatcar Container Linux hardening guide

Mon, 01 Jan 0001 00:00:00 +0000

This guide covers the basics of securing a Flatcar Container Linux instance. Flatcar Container Linux has a very slim network profile and the only service that listens by default on Flatcar Container Linux is sshd on port 22 on all interfaces. There are also some defaults for local users and services that should be considered.

Remote listening services

Disabling sshd

To disable sshd from listening you can stop the socket:

Setting up the Linux Auditing System

Mon, 01 Jan 0001 00:00:00 +0000

On Flatcar Container Linux audit-rules.service loads the audit rules to set up the logging filters for the kernel messages. The auditd.service daemon to collect these logs does not run by default.

Enabling the standard rules or custom rules

There is an ignore rule by default that suppresses the standard rules, which means that certain PAM audit messages are not shown. It is also important to remove this default ignore rule when setting up own rules, or otherwise they will be ignored, too. The following Butane Config will overwrite the default ignore rule:

Trusted Computing requirements on Flatcar Container Linux

Mon, 01 Jan 0001 00:00:00 +0000

Trusted Computing requires support in both system hardware and firmware. This document specifies the required support and explains how to determine if a physical machine has the features needed to enable Trusted Computing in Flatcar Container Linux.

1. Check for Trusted Platform Module

Trusted Computing depends on the presence of a Trusted Platform Module (TPM). The TPM is a motherboard component responsible for storing the state of the system boot process, and providing a secure communication channel over which this state can be verified. To check for the presence of a TPM, install the latest Alpha version of Flatcar Container Linux and try to list the TPM device file in the /sys system control filesystem:

Disabling SMT on Flatcar Container Linux

Mon, 01 Jan 0001 00:00:00 +0000

Recent Intel CPU vulnerabilities ( L1TF and MDS ) cannot be fully mitigated in software without disabling Simultaneous Multi-Threading. This can have a substantial performance impact and is only necessary for certain workloads, so for compatibility reasons, SMT is enabled by default.

In addition, the Intel TAA vulnerability cannot be fully mitigated without disabling either of SMT or the Transactional Synchronization Extensions (TSX). Disabling TSX generally has less performance impact, so is the preferred approach on systems that don’t otherwise need to disable SMT. For compatibility reasons, TSX is enabled by default.