wallenstein/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2025-06-06 15:13:56 +02:00
Code Issues Projects Releases Wiki Activity

security remarks

Browse source
This commit is contained in:
Evgeniy Ivanov 2016-08-20 16:24:00 +03:00
parent b593986b0c
commit de06b4fd9e
1 changed files with 80 additions and 80 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

160
roles/security/tasks/main.yml
View file

@ -1,103 +1,103 @@
## Using a two-pass approach for checking directories in order to support symlinks. # Using a two-pass approach for checking directories in order to support symlinks.
#- name: Find directories for minimizing access - name: Find directories for minimizing access
#stat: stat:
#path: "{{ item }}" path: "{{ item }}"
#register: minimize_access_directories register: minimize_access_directories
#with_items: with_items:
#- '/usr/local/sbin' - '/usr/local/sbin'
#- '/usr/local/bin' - '/usr/local/bin'
#- '/usr/sbin' - '/usr/sbin'
#- '/usr/bin' - '/usr/bin'
#- '/sbin' - '/sbin'
#- '/bin' - '/bin'
#- name: Minimize access - name: Minimize access
#file: path='{{ item.stat.path }}' mode='go-w' recurse=yes file: path='{{ item.stat.path }}' mode='go-w' recurse=yes
#when: item.stat.isdir when: item.stat.isdir
#with_items: "{{ minimize_access_directories.results }}" with_items: "{{ minimize_access_directories.results }}"
#no_log: True no_log: True
#- name: Change shadow ownership to root and mode to 0600 - name: Change shadow ownership to root and mode to 0600
#file: dest='/etc/shadow' owner=root group=root mode=0600 file: dest='/etc/shadow' owner=root group=root mode=0600
#- name: change su-binary to only be accessible to user and group root - name: change su-binary to only be accessible to user and group root
#file: dest='/bin/su' owner=root group=root mode=0750 file: dest='/bin/su' owner=root group=root mode=0750
#- name: Collect Use of privileged commands - name: Collect Use of privileged commands
#shell: > shell: >
#/usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }' /usr/bin/find {/usr/local/sbin,/usr/local/bin,/sbin,/bin,/usr/sbin,/usr/bin} -xdev \( -perm -4000 -o -perm -2000 \) -type f | awk '{print "-a always,exit -F path=" $1 " -F perm=x -F auid>=500 -F auid!=4294967295 -k privileged" }'
#args: args:
#executable: /bin/bash executable: /bin/bash
#register: privileged_programs register: privileged_programs
## Rsyslog # Rsyslog
#- name: Rsyslog configured - name: Rsyslog configured
#template: src=rsyslog.conf.j2 dest=/etc/rsyslog.conf template: src=rsyslog.conf.j2 dest=/etc/rsyslog.conf
#notify: notify:
#- restart rsyslog - restart rsyslog
#- name: Rsyslog CIS configured - name: Rsyslog CIS configured
#template: src=CIS.conf.j2 dest=/etc/rsyslog.d/CIS.conf owner=root group=root mode=0644 template: src=CIS.conf.j2 dest=/etc/rsyslog.d/CIS.conf owner=root group=root mode=0644
#notify: notify:
#- restart rsyslog - restart rsyslog
#- name: Enable services - name: Enable services
#service: name=rsyslog enabled=yes service: name=rsyslog enabled=yes
## Core dumps # Core dumps
#- name: Restrict core dumps (with PAM) - name: Restrict core dumps (with PAM)
#lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present lineinfile: dest=/etc/security/limits.conf line="* hard core 0" state=present
#- name: Restrict core dumps (with sysctl) - name: Restrict core dumps (with sysctl)
#sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present sysctl: name=fs.suid_dumpable value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
## Kernel fixes # Kernel fixes
#- name: Disable Source Routed Packet Acceptance - name: Disable Source Routed Packet Acceptance
#sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
#with_items: with_items:
#- net.ipv4.conf.all.accept_source_route - net.ipv4.conf.all.accept_source_route
#- net.ipv4.conf.default.accept_source_route - net.ipv4.conf.default.accept_source_route
#notify: notify:
#- flush routing cache - flush routing cache
#- name: Disable ICMP Redirect Acceptance - name: Disable ICMP Redirect Acceptance
#sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
#with_items: with_items:
#- net.ipv4.conf.all.accept_redirects - net.ipv4.conf.all.accept_redirects
#- net.ipv4.conf.default.accept_redirects - net.ipv4.conf.default.accept_redirects
#- name: Disable Secure ICMP Redirect Acceptance - name: Disable Secure ICMP Redirect Acceptance
#sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present sysctl: name="{{item}}" value=0 ignoreerrors=yes sysctl_set=yes reload=yes state=present
#with_items: with_items:
#- net.ipv4.conf.all.secure_redirects - net.ipv4.conf.all.secure_redirects
#- net.ipv4.conf.default.secure_redirects - net.ipv4.conf.default.secure_redirects
#notify: notify:
#- flush routing cache - flush routing cache
#- name: Enable Bad Error Message Protection - name: Enable Bad Error Message Protection
#sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present sysctl: name=net.ipv4.icmp_ignore_bogus_error_responses value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
#notify: notify:
#- flush routing cache - flush routing cache
#- name: Enable RFC-recommended Source Route Validation - name: Enable RFC-recommended Source Route Validation
#sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present sysctl: name="{{item}}" value=1 ignoreerrors=yes sysctl_set=yes reload=yes state=present
#with_items: with_items:
#- net.ipv4.conf.all.rp_filter - net.ipv4.conf.all.rp_filter
#- net.ipv4.conf.default.rp_filter - net.ipv4.conf.default.rp_filter
#notify: notify:
#- flush routing cache - flush routing cache
#- name: Enable packet forwarding for IPv4 - name: Enable packet forwarding for IPv4
#sysctl: name=net.ipv4.ip_forward value=1 sysctl: name=net.ipv4.ip_forward value=1
#- name: Enable packet forwarding for IPv6 - name: Enable packet forwarding for IPv6
#sysctl: name=net.ipv6.conf.all.forwarding value=1 sysctl: name=net.ipv6.conf.all.forwarding value=1
#- name: Do not send ICMP redirects (we are not a router) - name: Do not send ICMP redirects (we are not a router)
#sysctl: name=net.ipv4.conf.all.send_redirects value=0 sysctl: name=net.ipv4.conf.all.send_redirects value=0
- name: Iptables configured - name: Iptables configured
template: src="{{ item.src }}" dest="{{ item.dest }}" owner=root group=root mode=0640 template: src="{{ item.src }}" dest="{{ item.dest }}" owner=root group=root mode=0640