# Enabling Security on the Login Node 

* Ensure that `enable_secure_login_node` is set to **true** in `omnia_config.yml`
* Set the following parameters in `omnia_security_config.yml`

|  Variables    [Required/ Optional]	                                                   |  **Default**,   Accepted values                       |  Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|--------------------------------------------------------------------------------------|-------------------------------------------------------| |
| domain_name                                                                          | **omnia.test**                                        | The domain name should not contain   an underscore ( _ )                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| realm_name                                                                           | **OMNIA.TEST**                                        | The realm name should follow the   following rules per   https://www.freeipa.org/page/Deployment_Recommendations   <br> * The realm name must not   conflict with any other existing     Kerberos realm name (e.g. name used by Active Directory). <br> *   The   realm name should be upper-case   (EXAMPLE.COM) version of primary DNS domain name (example.com).                                                                                                                                                                                                                                                                                                                                                |
| max_failures                                                                         | **3**                                                 | Failures allowed before lockout.   <br> This value cannot currently     be changed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| failure_reset_interval                                                               | **60**                                                | Period (in seconds) after which the   number of failed login attempts is     reset <br> Accepted Values: 30-60                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| lockout_duration                                                                     | **10**                                                | Period (in seconds) for which users are   locked out. <br> Accepted     Values: 5-10                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| session_timeout                                                                      | **180**                                               | Period (in seconds) after which idle   users get logged out automatically     <br> Accepted Values: 30-90                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| alert_email_address                                                                  |                                                       | Email address used for sending alerts in   case of authentication failure. Currently, only one email address is   supported in this field.   <br>   If this variable is left blank, authentication failure alerts will   be disabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| user                                                                                 |                                                       | Array of users that are allowed or   denied based on the `allow_deny`     value. Multiple users must be separated by a space.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| allow_deny                                                                           | **Allow**                                             | This variable sets whether the user list   is Allowed or Denied. <br>     Accepted Values: Allow, Deny                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| restrict_program_support                                                             | **false**                                             | This variable sets whether the network   services/protocols listed in `restrict_softwares` are to be blocked.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| restrict_softwares                                                                   |                                                       | Array of services/protocols to be   blocked by Omnia. Values are to be separated by commas. <br> Accepted   values: telnet,lpd,bluetooth,rlogin,rexec <br> Non Accepted values:   ftp,smbd,nmbd,automount,portmap                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |

>> __Note:__ For 389ds/SSSD to work, an external LDAP server has to be set up in your environment as Omnia does not configure LDAP.

## Kernel Lockdown

* RockyOS has Kernel Lockdown mode (Integrity) enabled by default
* SUSE/Leap allows users to set Kernel Lockdown mode to Confidentiality or Integrity.
