Security hardening

Deployment options: Netezza Performance Server for Cloud Pak for Data System

If you are on version 11.2.1.X, you can apply STIG hardening to Netezza Performance Server by using the stig_nps.py tool.

Note: Only the root user can run this tool.

stig_nps.py command syntax

The stig_nps.py script manages security compliance on the Netezza Performance Server container.

/nzlocal/stig/scripts/stig_nps.py [-h] [--help]
[--restoreAll]
[--restoreSingleFile <restore_file_path>]
[--stigAll]
[--stigSingleFile <stig_file_path>]
[--status]

Optional arguments:

-h|--help
Displays help for the command.
--restoreAll
Performs restore on all files.
--restoreSingleFile <restore_file_path>
Restores a single file with its full path provided.
--stigAll
Performs STIG on all files.
--stigSingleFile <stig_file_path>
Performs STIG on a file with a given full path.
Examples of <stig_file_path>:
  • /etc/default/useradd
  • /etc/issue
  • /etc/login.defs
  • /etc/security/limits.conf
  • /etc/security/pwquality.conf
  • /etc/ssh/sshd_config
  • /etc/pam.d/system-auth-ac
  • /etc/pam.d/password-auth-ac
  • /etc/profile.d/tmout.sh
  • /etc/pam.d/postlogin-ac
  • /etc/sysctl.d/99-stig.sysctl.conf
You can edit the template files corresponding to the list of files that are in the /nzlocal/stig/templates directory before you run stig_nps.py with the --stigSingleFile option.
--status
Displays the status of each STIG file.

Procedure

Note: If you are on Netezza Performance Server 11.2.1.X, you can apply STIG hardening.
  1. Apply STIG hardening on the underlying Cloud Pak for Data System platform. Follow the steps that are described in STIG compliance.
  2. Stop Netezza Performance Server:
    nzstop
  3. As root, apply STIG hardening.
    • Full STIG hardening:
      /nzlocal/stig/scripts/stig_nps.py --stigAll
    • The /etc/issue file STIG hardening:
      /nzlocal/stig/scripts/stig_nps.py --stigSingleFile /etc/issue
  4. Check the STIG setting status:
    /nzlocal/stig/scripts/stig_nps.py --status
    Example:
    Template                                  | NPS Container
------------------------------------------------------------
/etc/pam.d/postlogin-ac                   | Passed
/etc/sysctl.d/99-stig.sysctl.conf         | Passed
/etc/default/useradd                      | Passed
/etc/pam.d/password-auth-ac               | Passed
/etc/security/pwquality.conf              | Passed
/etc/login.defs                           | Passed
/etc/issue                                | Passed
/etc/profile.d/tmout.sh                   | Passed
/etc/security/limits.conf                 | Passed
/etc/ssh/sshd_config                      | Passed
/etc/pam.d/system-auth-ac                 | Passed
  5. Redeploy the container on other control and connector nodes. Follow the steps that are described in Redeploying the container.