This chapter will walk a user through instructions on administering a SIMP system, including the processes for managing clients and users.
4.1.1. Level of Knowledge¶
SIMP is designed for use by system administrators/users with a strong background in Linux operating systems. The core technologies that require prerequisite knowledge are:
- Puppet - 5.5 or later
- Domain Name System (DNS) - BIND 9
- Dynamic Host Configuration Protocol (DHCP) - Internet Systems Consortium (ISC) DHCP
- Lightweight Directory Access Protocol (LDAP) - OpenLDAP
- RedHat Kickstart, including all technologies involved: Trivial File Transfer Protocol (TFTP), PXE, PXELinux, etc.
- The Apache HTTP Server
- The Yellowdog Updater, Modified (YUM) package manager
- Rsyslog 8+
- IPTables (Internet Protocol Tables)/Firewalld, basic knowledge of the rules
- Auditd, Basic knowledge of how the daemon works
- Advanced Intrusion Detection Environment (AIDE), basic knowledge of the rules
- Basic X.509-based PKI Key Management
SIMP handles as much of the initial setup and management of these tools as possible However, you will need at least some understanding of them in order to tailor a SIMP system to fit the desired environment. You will also need a general understanding of how to control and manipulate these tools from the command line interface (CLI); SIMP does not provide a graphical user interface (GUI).
Knowledge of scripting and Ruby programming will also help to further customize a SIMP install but is not required for routine use.
4.1.2. SIMP Defined¶
The System Integrity Management Platform (SIMP) is an Open Source framework designed around the concept that individuals and organizations should not need to repeat the work of automating the basic components of their operating system infrastructure.
By using the Puppet automation stack, SIMP is working toward the concept of a self-healing infrastructure that, when used with a consistent configuration management process, will allow users to have confidence that their systems not only start in compliance but remain in compliance over time.
Finally, SIMP has a goal of remaining flexible enough to properly maintain your operational infrastructure. To this end, where possible, the SIMP components are written to allow all security-related capabilities to be easily adjusted to meet the needs of individual applications.