Security SolutionsLogiciels de sécurité
Documentation

1. Prerequisites and base servers

Cette documentation technique est disponible en anglais.

Every server in a Sentinel ID deployment starts from the same hardened base. This page prepares that base. The following pages install each tier on top of it. Every component is an operating-system service on servers hosted inside the agency.

Supported operating systems

Use Recommended Also supported
All tiers Ubuntu Server 24.04 LTS Red Hat Enterprise Linux 9 / Rocky Linux 9
Application tier on Windows Windows Server 2022 Windows Server 2025

The commands below are for Ubuntu 24.04. RHEL equivalents use dnf and firewalld. Use one operating system per tier.

Network zones and addressing

Create one VLAN (or subnet) per zone and route between them only through firewalls:

Zone Example subnet Contains
Edge 10.10.0.0/24 HAProxy, VPN concentrators
Application 10.20.0.0/22 API / web and ingest servers
Matching 10.30.0.0/24 Shortlist index, native matchers, face index
Data 10.40.0.0/22 Oracle or MongoDB servers, central file storage (NFS or object storage)
Management 10.90.0.0/24 Bastion, monitoring, logs, backup, key management

Only the edge zone is reachable from outside. Administrators reach servers only through the bastion in the management zone.

Base installation (every server)

# 1. updates and essentials
sudo apt update && sudo apt full-upgrade -y
sudo apt install -y chrony unattended-upgrades auditd apparmor-utils nftables curl gnupg ca-certificates

# 2. time must be correct everywhere (tokens, logs, replication)
sudo systemctl enable --now chrony

# 3. security updates applied automatically, reboots scheduled by you
sudo dpkg-reconfigure -plow unattended-upgrades

# 4. a dedicated service account, no login shell
sudo useradd --system --home /opt/sentinel --shell /usr/sbin/nologin sentinel

SSH

In /etc/ssh/sshd_config.d/90-sentinel.conf:

PasswordAuthentication no
PermitRootLogin no
AllowGroups ssh-admins
X11Forwarding no
MaxAuthTries 3

Accept SSH only from the bastion's address (see the firewall below). Use hardware-backed keys for administrators.

Host firewall (default deny)

/etc/nftables.conf, adjusted per tier:

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    ip saddr 10.90.0.10 tcp dport 22 accept          # bastion only
    # tier-specific rules go here (see each installation page)
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output  { type filter hook output priority 0; policy accept; }
}

sudo systemctl enable --now nftables

Disk encryption

Encrypt every data disk with LUKS2 at installation time. Unlock with network-bound keys (Clevis + Tang servers in the management zone) or a TPM, so servers restart unattended but disks are unreadable away from your network.

Kernel and limits

/etc/sysctl.d/90-sentinel.conf:

net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.ip_local_port_range = 10240 65535
vm.swappiness = 1
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1

For services, raise the open-file limit in their systemd unit (LimitNOFILE=1048576).

Certificates

Run an internal certificate authority (or use the agency PKI) in the management zone. Every service gets its own certificate:

  • public names (for example sentinel.agency.gov) on the load balancers;
  • internal names (for example api01.app.internal, m07.match.internal, db-s12-a.data.internal) for TLS between tiers.

Renew automatically and alert 30 days before expiry.

Application runtime (application, ingest and matcher servers)

Install the application runtime (current LTS release, 22.x or later) from the official binaries, after checking the published SHA-256:

cd /tmp
curl -fsSLO https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt
curl -fsSLO https://nodejs.org/dist/latest-v22.x/node-v22.<x>.<y>-linux-x64.tar.xz
grep node-v22.<x>.<y>-linux-x64.tar.xz SHASUMS256.txt | sha256sum -c -
sudo tar -C /usr/local --strip-components=1 -xJf node-v22.<x>.<y>-linux-x64.tar.xz
node --version

Checklist before continuing

  • Zones, routing and firewalls between zones are in place
  • Every server has the base hardening, chrony, auditd and encrypted disks
  • Internal CA issues certificates; DNS names resolve in each zone
  • Bastion and monitoring are reachable; logs are forwarded

Next: Install the database tier.

← PrécédentSuivant →