Deploying Data Fabric on a Hardened OS

Describes how to install and deploy Data Fabric on a Hardened OS.

A hardened Operating system is a standard Linux distribution that has been configured to meet strict security security and compliance requirements, typically following guidelines such as CIS Benchmarks, DISA STIGs, or organizational security policies. Hardening reduces the attack surface of the OS by disbaling unneccesary services, enforcing file permission restrictions, applying kernel-level security controls, and restricting user privileges.

Data Fabric supports installation on hardened OS environments, but this type of installation requires additional planning and configuration compared to a standard installation.

Considerations for Hardened OS Installations

When you install Data Fabric on a standard supported OS (such as SUSE Linux Enterprise Server or Ubuntu), the installer and platform services assume a baseline set of system capabilities - default file permissions, writable directories, available kernel modules, and standard network configurations.

On a hardened OS, one or more of these assumptions may not apply. Common hardening controls that affect installation and operation include:
  • Restricted kernel parameters - Security profiles may disable or restrict kernel modules that Data Fabric components depend on (for example, NFS-related modules or network bridging).
  • Filesystem restrictions - Noexec or nousuid mount flags on /tmp or other directories can prevent the installer or runtime services from functioning correctly.
  • User and privilege controls - SELinux or AppArmor policies, restricted sudo access, or disabled root login can block installation steps that require elevated privileges.
  • Service and port restrictions - Firewall rules or disabling of specific system services may interfere with cluster communication, CLDB operations, or NFS gateway functionality.
  • Package and binary restrictions - Policies that block unsigned packages or restrict execution of binaries outside approved paths may require pre-approval of Data Fabric components.