Installing NethServer on CIS hardened host

Support
1

Hi,
I am trying to install NethServer on a Rocky 9 host that has been hardened to CIS Level 1 Server benchmark using the hardening option during the OS installation.

During the installation, I get the following error while Traefik is being installed:

Install Traefik:
<6>podman-pull-missing ghcr.io/nethserver/traefik:4.2.1
Trying to pull ghcr.io/nethserver/traefik:4.2.1...
Getting image source signatures
Copying blob sha256:0850816191383de52de88b36ab08a35d66c6d54ae9ebde79acf610435c268194
Copying config sha256:1c6b2580d63abc2d526d9e9e135085eae17788f56c64858880f438f4c0e0d650
Writing manifest to image destination
1c6b2580d63abc2d526d9e9e135085eae17788f56c64858880f438f4c0e0d650
<6>extract-ui ghcr.io/nethserver/traefik:4.2.1
Extracting container filesystem ui to /var/lib/nethserver/cluster/ui/apps/traefik1
ui/index.html
0baf59dbd6cb66f4db2b324c0fc04cb1bf8d02b5fd0e5eb6909a34f9f5fee42e
Assertion failed
  File "/var/lib/nethserver/cluster/actions/add-module/50update", line 230, in <module>
    agent.assert_exp(create_module_result['exit_code'] == 0) # Ensure create-module is successful

Do you have any recommendations or best practices for hardening the host NethServer will be installed on?

Thanks :slightly_smiling_face:

2

Hi, thanks for the report.

I’m not familiar with the specifics of the CIS Level 1 hardening profile, so it would help if you could explain what changes it applies to the system (firewall rules, sysctl settings, SELinux policy, etc.) and describe your network environment a bit more.

The log you shared doesn’t have much detail on the actual failure - “create-module” failing right after the UI extraction of Traefik makes me suspect a network connectivity issue (e.g. outbound access to required services, DNS resolution, or a blocked port), rather than something specific to Traefik itself. Could you check whether your hardened setup meets all the requirements listed here: System requirements | NethServer 8 documentation ?

If you can confirm the CIS profile’s network/firewall changes and your environment (proxy, DNS, egress rules, etc.), that would help narrow this down.

3

I had installed NS8 on a clean rocky 9.7 installation with the CIS level 1 security profile applied during setup.

The only control that I had to revert was the one requiring umask.

I needed to change following:

/etc/bashrc:    [ `umask` -eq 0 ] && umask 022
/etc/profile: umask 022
/etc/login.defs: UMASK 022

Other than that, also revert the shell account expiration settings to avoid surprises in the future.