diff --git a/lynis/etc/lynis/custom.prf b/lynis/etc/lynis/custom.prf new file mode 100644 index 0000000..7dfa2ce --- /dev/null +++ b/lynis/etc/lynis/custom.prf @@ -0,0 +1,26 @@ +# Disable some tests that are not useful in cloud-based servers +skip-test=AUTH-9286 +skip-test=PRNT-2307 +skip-test=USB-1000 +skip-test=STRG-1846 +skip-test=STRG-1840 +skip-test=PRNT-2308 +skip-test=FILE-6310 +skip-test=BOOT-5122 +skip-test=BOOT-5260 +skip-test=KRNL-5788 +skip-test=AUTH-9308 + +# Disable /etc/issue checking +skip-test=BANN-7126 +skip-test=BANN-7130 + +# Disable some SSH feature checks that we intend to keep +skip-test=SSH-7408:tcpkeepalive +skip-test=SSH-7408:allowtcpforwarding +skip-test=SSH-7408:compression +skip-test=SSH-7408:port + +# Old packages +skip-test=CUST-0810 +skip-test=CUST-0285 diff --git a/modprobe/etc/modprobe.d/disable-ipv6.conf b/modprobe/etc/modprobe.d/disable-ipv6.conf new file mode 100644 index 0000000..84b10fc --- /dev/null +++ b/modprobe/etc/modprobe.d/disable-ipv6.conf @@ -0,0 +1 @@ +install ipv6 /bin/true diff --git a/modprobe/etc/modprobe.d/disable-rare-protocols.conf b/modprobe/etc/modprobe.d/disable-rare-protocols.conf new file mode 100644 index 0000000..92966bd --- /dev/null +++ b/modprobe/etc/modprobe.d/disable-rare-protocols.conf @@ -0,0 +1,4 @@ +install dccp /bin/true +install sctp /bin/true +install rds /bin/true +install tipc /bin/true diff --git a/rc.local/etc/rc.local b/rc.local/etc/rc.local new file mode 100644 index 0000000..6f8eb97 --- /dev/null +++ b/rc.local/etc/rc.local @@ -0,0 +1,9 @@ +#!/bin/bash +# /etc/rc.local + +# file needed to correctly load kernel parameters at boot time +# on Ubuntu (ex. to disable ipv6) without modifying grub +/etc/sysctl.d +/etc/init.d/procps restart + +exit 0 diff --git a/security/etc/security/limits.conf b/security/etc/security/limits.conf new file mode 100644 index 0000000..06db731 --- /dev/null +++ b/security/etc/security/limits.conf @@ -0,0 +1,62 @@ +# /etc/security/limits.conf +# +#This file sets the resource limits for the users logged in via PAM. +#It does not affect resource limits of the system services. +# +#Also note that configuration files in /etc/security/limits.d directory, +#which are read in alphabetical order, override the settings in this +#file in case the domain is the same or more specific. +#That means for example that setting a limit for wildcard domain here +#can be overriden with a wildcard setting in a config file in the +#subdirectory, but a user specific setting here can be overriden only +#with a user specific setting in the subdirectory. +# +#Each line describes a limit for a user in the form: +# +# +# +#Where: +# can be: +# - a user name +# - a group name, with @group syntax +# - the wildcard *, for default entry +# - the wildcard %, can be also used with %group syntax, +# for maxlogin limit +# +# can have the two values: +# - "soft" for enforcing the soft limits +# - "hard" for enforcing hard limits +# +# can be one of the following: +# - core - limits the core file size (KB) +# - data - max data size (KB) +# - fsize - maximum filesize (KB) +# - memlock - max locked-in-memory address space (KB) +# - nofile - max number of open file descriptors +# - rss - max resident set size (KB) +# - stack - max stack size (KB) +# - cpu - max CPU time (MIN) +# - nproc - max number of processes +# - as - address space limit (KB) +# - maxlogins - max number of logins for this user +# - maxsyslogins - max number of logins on the system +# - priority - the priority to run user process with +# - locks - max number of file locks the user can hold +# - sigpending - max number of pending signals +# - msgqueue - max memory used by POSIX message queues (bytes) +# - nice - max nice priority allowed to raise to values: [-20, 19] +# - rtprio - max realtime priority +# +# +# + +* soft core 0 +* hard core 0 +#* hard rss 10000 +#@student hard nproc 20 +#@faculty soft nproc 20 +#@faculty hard nproc 50 +#ftp hard nproc 0 +#@student - maxlogins 4 + +# End of file diff --git a/ssh/etc/ssh/sshd_config b/ssh/etc/ssh/sshd_config new file mode 100644 index 0000000..842db0f --- /dev/null +++ b/ssh/etc/ssh/sshd_config @@ -0,0 +1,27 @@ +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key + +SyslogFacility AUTHPRIV + +AllowGroups sshlogin + +PermitRootLogin WITHOUT-PASSWORD +PubkeyAuthentication yes +AuthorizedKeysFile .ssh/authorized_keys +IgnoreRhosts yes +MaxSessions 4 +MaxAuthTries 4 +ClientAliveCountMax 2 +LogLevel VERBOSE +PasswordAuthentication no +ChallengeResponseAuthentication no +GSSAPIAuthentication no +UsePAM yes +PrintMotd no +X11Forwarding no +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE +AcceptEnv XMODIFIERS +Subsystem sftp /usr/lib/openssh/sftp-server diff --git a/sysctl/etc/sysctl.conf b/sysctl/etc/sysctl.conf new file mode 100644 index 0000000..bd29550 --- /dev/null +++ b/sysctl/etc/sysctl.conf @@ -0,0 +1,49 @@ +# Hardened sysctl conf + +fs.protected_regular = 2 +fs.protected_fifos = 2 +fs.protected_hardlinks = 1 +fs.protected_symlinks = 1 +fs.suid_dumpable = 0 + +kernel.core_uses_pid = 1 +kernel.ctrl-alt-del = 0 +kernel.dmesg_restrict = 1 +kernel.kptr_restrict = 2 +kernel.randomize_va_space = 2 +kernel.sysrq = 0 +kernel.unprivileged_bpf_disabled = 1 + + +net.core.bpf_jit_harden = 2 +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.all.accept_source_route = 0 +net.ipv4.conf.all.bootp_relay = 0 +net.ipv4.conf.all.forwarding = 0 +net.ipv4.conf.all.log_martians = 1 +net.ipv4.conf.all.mc_forwarding = 0 +net.ipv4.conf.all.proxy_arp = 0 +net.ipv4.conf.all.rp_filter = 0 +net.ipv4.conf.all.send_redirects = 0 + +net.ipv4.conf.default.accept_redirects = 0 +net.ipv4.conf.default.accept_source_route = 0 +net.ipv4.conf.default.log_martians = 1 + +net.ipv4.icmp_echo_ignore_broadcasts = 1 +net.ipv4.icmp_ignore_bogus_error_responses = 1 +net.ipv4.tcp_syncookies = 1 +net.ipv4.tcp_timestamps = 1 + +# Uncomment do disable ipv6 +#net.ipv6.conf.all.disable_ipv6=1 +#net.ipv6.conf.default.disable_ipv6=1 +#net.ipv6.conf.lo.disable_ipv6=1 + +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.all.accept_source_route = 0 + +net.ipv6.conf.default.accept_redirects = 0 +net.ipv6.conf.default.accept_source_route = 0 + +vm.swappiness = 15