mirror of
https://github.com/trailofbits/algo.git
synced 2025-04-22 00:57:08 +02:00
security remarks
This commit is contained in:
Evgeniy Ivanov
parent
b593986b0c
commit
de06b4fd9e
1 changed files with 80 additions and 80 deletions
|
|
@ -1,103 +1,103 @@
|
|||
## Using a two-pass approach for checking directories in order to support symlinks.
|
||||
#- name: Find directories for minimizing access
|
||||
#stat:
|
||||
#path: "{{ item }}"
|
||||
#register: minimize_access_directories
|
||||
#with_items:
|
||||
#- '/usr/local/sbin'
|
||||
#- '/usr/local/bin'
|
||||
#- '/usr/sbin'
|
||||
#- '/usr/bin'
|
||||
#- '/sbin'
|
||||
#- '/bin'
|
||||
# Using a two-pass approach for checking directories in order to support symlinks.
|
||||
- name: Find directories for minimizing access
|
||||
stat:
|
||||
path: "{{ item }}"
|
||||
register: minimize_access_directories
|
||||
with_items:
|
||||
- '/usr/local/sbin'
|
||||
- '/usr/local/bin'
|
||||
- '/usr/sbin'
|
||||
- '/usr/bin'
|
||||
- '/sbin'
|
||||
- '/bin'
|
||||
|
||||
#- name: Minimize access
|
||||
#file: path='{{ item.stat.path }}' mode='go-w' recurse=yes
|
||||
#when: item.stat.isdir
|
||||
#with_items: "{{ minimize_access_directories.results }}"
|
||||
#no_log: True
|
||||
- name: Minimize access
|
||||
file: path='{{ item.stat.path }}' mode='go-w' recurse=yes
|
||||
when: item.stat.isdir
|
||||
with_items: "{{ minimize_access_directories.results }}"
|
||||
no_log: True
|
||||
|
||||
#- name: Change shadow ownership to root and mode to 0600
|
||||
#file: dest='/etc/shadow' owner=root group=root mode=0600
|
||||
- name: Change shadow ownership to root and mode to 0600
|
||||
file: dest='/etc/shadow' owner=root group=root mode=0600
|
||||
|
||||
#- name: change su-binary to only be accessible to user and group root
|
||||
#file: dest='/bin/su' owner=root group=root mode=0750
|
||||
- name: change su-binary to only be accessible to user and group root
|
||||
file: dest='/bin/su' owner=root group=root mode=0750
|
||||
|
||||
#- name: Collect Use of privileged commands
|
||||
#shell: >
|
||||
#/usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }'
|
||||
#args:
|
||||
#executable: /bin/bash
|
||||
#register: privileged_programs
|
||||
- name: Collect Use of privileged commands
|
||||
shell: >
|
||||
/usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: privileged_programs
|
||||
|
||||
## Rsyslog
|
||||
# Rsyslog
|
||||
|
||||
#- name: Rsyslog configured
|
||||
#template: src=rsyslog.conf.j2 dest=/etc/rsyslog.conf
|
||||
#notify:
|
||||
#- restart rsyslog
|
||||
- name: Rsyslog configured
|
||||
template: src=rsyslog.conf.j2 dest=/etc/rsyslog.conf
|
||||
notify:
|
||||
- restart rsyslog
|
||||
|
||||
#- name: Rsyslog CIS configured
|
||||
#template: src=CIS.conf.j2 dest=/etc/rsyslog.d/CIS.conf owner=root group=root mode=0644
|
||||
#notify:
|
||||
#- restart rsyslog
|
||||
- name: Rsyslog CIS configured
|
||||
template: src=CIS.conf.j2 dest=/etc/rsyslog.d/CIS.conf owner=root group=root mode=0644
|
||||
notify:
|
||||
- restart rsyslog
|
||||
|
||||
#- name: Enable services
|
||||
#service: name=rsyslog enabled=yes
|
||||
- name: Enable services
|
||||
service: name=rsyslog enabled=yes
|
||||
|
||||
## Core dumps
|
||||
# Core dumps
|
||||
|
||||
#- name: Restrict core dumps (with PAM)
|
||||
#lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present
|
||||
- name: Restrict core dumps (with PAM)
|
||||
lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present
|
||||
|
||||
#- name: Restrict core dumps (with sysctl)
|
||||
#sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
- name: Restrict core dumps (with sysctl)
|
||||
sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
|
||||
## Kernel fixes
|
||||
# Kernel fixes
|
||||
|
||||
#- name: Disable Source Routed Packet Acceptance
|
||||
#sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
#with_items:
|
||||
#- net.ipv4.conf.all.accept_source_route
|
||||
#- net.ipv4.conf.default.accept_source_route
|
||||
#notify:
|
||||
#- flush routing cache
|
||||
- name: Disable Source Routed Packet Acceptance
|
||||
sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
with_items:
|
||||
- net.ipv4.conf.all.accept_source_route
|
||||
- net.ipv4.conf.default.accept_source_route
|
||||
notify:
|
||||
- flush routing cache
|
||||
|
||||
#- name: Disable ICMP Redirect Acceptance
|
||||
#sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
#with_items:
|
||||
#- net.ipv4.conf.all.accept_redirects
|
||||
#- net.ipv4.conf.default.accept_redirects
|
||||
- name: Disable ICMP Redirect Acceptance
|
||||
sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
with_items:
|
||||
- net.ipv4.conf.all.accept_redirects
|
||||
- net.ipv4.conf.default.accept_redirects
|
||||
|
||||
#- name: Disable Secure ICMP Redirect Acceptance
|
||||
#sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
#with_items:
|
||||
#- net.ipv4.conf.all.secure_redirects
|
||||
#- net.ipv4.conf.default.secure_redirects
|
||||
#notify:
|
||||
#- flush routing cache
|
||||
- name: Disable Secure ICMP Redirect Acceptance
|
||||
sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
with_items:
|
||||
- net.ipv4.conf.all.secure_redirects
|
||||
- net.ipv4.conf.default.secure_redirects
|
||||
notify:
|
||||
- flush routing cache
|
||||
|
||||
#- name: Enable Bad Error Message Protection
|
||||
#sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
#notify:
|
||||
#- flush routing cache
|
||||
- name: Enable Bad Error Message Protection
|
||||
sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
notify:
|
||||
- flush routing cache
|
||||
|
||||
#- name: Enable RFC-recommended Source Route Validation
|
||||
#sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
#with_items:
|
||||
#- net.ipv4.conf.all.rp_filter
|
||||
#- net.ipv4.conf.default.rp_filter
|
||||
#notify:
|
||||
#- flush routing cache
|
||||
- name: Enable RFC-recommended Source Route Validation
|
||||
sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
|
||||
with_items:
|
||||
- net.ipv4.conf.all.rp_filter
|
||||
- net.ipv4.conf.default.rp_filter
|
||||
notify:
|
||||
- flush routing cache
|
||||
|
||||
#- name: Enable packet forwarding for IPv4
|
||||
#sysctl: name=net.ipv4.ip_forward value=1
|
||||
- name: Enable packet forwarding for IPv4
|
||||
sysctl: name=net.ipv4.ip_forward value=1
|
||||
|
||||
#- name: Enable packet forwarding for IPv6
|
||||
#sysctl: name=net.ipv6.conf.all.forwarding value=1
|
||||
- name: Enable packet forwarding for IPv6
|
||||
sysctl: name=net.ipv6.conf.all.forwarding value=1
|
||||
|
||||
#- name: Do not send ICMP redirects (we are not a router)
|
||||
#sysctl: name=net.ipv4.conf.all.send_redirects value=0
|
||||
- name: Do not send ICMP redirects (we are not a router)
|
||||
sysctl: name=net.ipv4.conf.all.send_redirects value=0
|
||||
|
||||
- name: Iptables configured
|
||||
template: src="{{ item.src }}" dest="{{ item.dest }}" owner=root group=root mode=0640
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue