oVirt Virtualization Shift Left Security —

oVirt Security

oVirt Virtualization Shift Left Security KVM libvirt VM Hardening Template Network Isolation Compliance OpenSCAP CIS Benchmark Audit Production

VM Hardening

=== oVirt VM Hardening Script ===

#!/bin/bash

# VM Hardening Script — CIS Benchmark Based

# 1. Update all packages

dnf update -y

# 2. Disable unnecessary services

systemctl disable --now cups avahi-daemon postfix bluetooth

# 3. SSH Hardening

sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config

sed -i 's/^#MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config

sed -i 's/^#ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config

sed -i 's/^#ClientAliveCountMax.*/ClientAliveCountMax 2/' /etc/ssh/sshd_config

echo "AllowGroups sshusers" >> /etc/ssh/sshd_config

systemctl restart sshd

# 4. Firewall — Allow only needed ports

firewall-cmd --set-default-zone=drop

firewall-cmd --permanent --add-service=ssh

firewall-cmd --permanent --add-port=443/tcp

firewall-cmd --reload

# 5. SELinux Enforcing

sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

setenforce 1

เนื้อหาเกี่ยวข้อง — Embedding Model SSL TLS Certificate

# 6. Audit Rules

cat >> /etc/audit/rules.d/hardening.rules << 'EOF'

-w /etc/passwd -p wa -k identity

-w /etc/shadow -p wa -k identity

-w /etc/sudoers -p wa -k sudo_changes

-w /var/log/ -p wa -k log_changes

-a always,exit -F arch=b64 -S execve -k command_exec

แนะนำเพิ่มเติม — ติดตาม XM Signal

EOF

augenrules --load

# 7. Sysctl Hardening

cat >> /etc/sysctl.d/99-hardening.conf << 'EOF'

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.tcp_syncookies = 1

kernel.randomize_va_space = 2

fs.suid_dumpable = 0

EOF

sysctl --system

from dataclasses import dataclass

@dataclass

class HardeningItem:

category: str

item: str

command: str

เนื้อหาเกี่ยวข้อง — ดูเพิ่มเติมเรื่อง Nginx Plus Consensus Algorithm

cis_ref: str

risk: str

items = [

HardeningItem("SSH", "Disable Root Login", "PermitRootLogin no", "5.2.10", "Critical"),

HardeningItem("SSH", "Key Only Auth", "PasswordAuthentication no", "5.2.4", "Critical"),

HardeningItem("Firewall", "Default Drop", "firewall-cmd --set-default-zone=drop", "3.4.1", "High"),

HardeningItem("SELinux", "Enforcing Mode", "setenforce 1", "1.6.1", "Critical"),

HardeningItem("Audit", "File Monitoring", "auditd rules for /etc/", "4.1.3", "High"),

HardeningItem("Network", "Disable ICMP Redirect", "sysctl net.ipv4", "3.3.2", "Medium"),

HardeningItem("Services", "Disable Unused", "systemctl disable cups", "2.2.x", "Medium"),

HardeningItem("Packages", "Remove Unnecessary", "dnf remove telnet", "2.3.x", "Medium"),

]

แนะนำเพิ่มเติม — คู่มือเทรดจาก SiamCafeBook

Compliance Scanning

=== OpenSCAP Compliance Scanning ===

Install OpenSCAP

dnf install -y openscap-scanner scap-security-guide

# List available profiles

oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# Run CIS Benchmark scan

oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \

เนื้อหาเกี่ยวข้อง — Asic คืออะไร — คู่มือฉบับสมบูรณ์ 2026

--results /tmp/scan-results.xml \
--report /tmp/scan-report.html \

/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# Remediate automatically

oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
--remediate \

/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Ansible Compliance Playbook

• name: Check VM Compliance

hosts: all

tasks:

• name: Check SELinux status

command: getenforce

register: selinux_status

failed_when: selinux_status.stdout != "Enforcing"

• name: Check SSH root login

lineinfile:

path: /etc/ssh/sshd_config

regexp: '^PermitRootLogin'

line: 'PermitRootLogin no'

check_mode: yes

register: ssh_root

failed_when: ssh_root.changed

• name: Check firewall active

service:

name: firewalld

state: started

check_mode: yes

register: fw_status

failed_when: fw_status.changed

เนื้อหาเกี่ยวข้อง — แนะนำให้อ่าน megaphone pattern — ข้อมูลครบถ้วน 2026

Lynis Security Audit

lynis audit system --quick --no-colors > /tmp/lynis-report.txt

grep "Hardening index" /tmp/lynis-report.txt

@dataclass

class ScanResult:

category: str

passed: int

failed: int

score: str

tool: str

results = [

ScanResult("CIS Level 1", 142, 8, "94.7%", "OpenSCAP"),

ScanResult("CIS Level 2", 185, 15, "92.5%", "OpenSCAP"),

ScanResult("STIG", 230, 12, "95.0%", "OpenSCAP"),

ScanResult("Lynis Hardening", 0, 0, "82/100", "Lynis"),

ScanResult("CVE Scan", 45, 2, "95.7%", "Trivy"),

ScanResult("Network Isolation", 12, 0, "100%", "Custom"),

]

total = r.passed + r.failed if r.passed > 0 else 0

if total > 0:

เคล็ดลับ

• Template: สร้าง Hardened Template ใช้สร้าง VM ใหม่ทุกครั้ง
• Scan: OpenSCAP Scan ทุกสัปดาห์ แก้ Finding ทันที
• VLAN: แยก Network Zone ด้วย VLAN ไม่ปนกัน
• Audit: เปิด auditd ทุก VM ส่ง Log ไป SIEM
• Automate: ใช้ Ansible Automate ทุก Security Task

oVirt คืออะไร

Open Source Virtualization KVM libvirt Web UI Engine VDSM Live Migration HA Storage Domain NFS iSCSI VLAN Bonding แทน VMware ฟรี