{"id":13506815,"url":"https://github.com/konstruktoid/hardening","last_synced_at":"2025-05-14T12:07:28.800Z","repository":{"id":31010415,"uuid":"34568864","full_name":"konstruktoid/hardening","owner":"konstruktoid","description":"Hardening Ubuntu. Systemd edition.","archived":false,"fork":false,"pushed_at":"2024-10-29T09:09:38.000Z","size":7731,"stargazers_count":1378,"open_issues_count":1,"forks_count":266,"subscribers_count":52,"default_branch":"master","last_synced_at":"2024-10-29T11:33:10.384Z","etag":null,"topics":["hacktoberfest","hardening","information-security","security","security-automation","security-compliance","security-hardening","security-tools","shell","systemd","ubuntu","ubuntu-server"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/konstruktoid.png","metadata":{"files":{"readme":"README.adoc","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"konstruktoid"}},"created_at":"2015-04-25T13:09:23.000Z","updated_at":"2024-10-29T09:09:27.000Z","dependencies_parsed_at":"2024-01-23T22:27:27.911Z","dependency_job_id":"ebd11b97-c053-4978-b2ac-4d5493f76f05","html_url":"https://github.com/konstruktoid/hardening","commit_stats":{"total_commits":1229,"total_committers":18,"mean_commits":68.27777777777777,"dds":"0.25711960943856793","last_synced_commit":"d1594b9a3d91882f698be1239b1cdeea38f904b6"},"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/konstruktoid%2Fhardening","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/konstruktoid%2Fhardening/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/konstruktoid%2Fhardening/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/konstruktoid%2Fhardening/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/konstruktoid","download_url":"https://codeload.github.com/konstruktoid/hardening/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247092383,"owners_count":20882218,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest","hardening","information-security","security","security-automation","security-compliance","security-hardening","security-tools","shell","systemd","ubuntu","ubuntu-server"],"created_at":"2024-08-01T01:00:58.270Z","updated_at":"2025-04-03T23:06:48.617Z","avatar_url":"https://github.com/konstruktoid.png","language":"Shell","funding_links":["https://github.com/sponsors/konstruktoid"],"categories":["Shell","Wikis/Guides:","Security","Linux Hardening","⚙️ Backend \u0026 APIs"],"sub_categories":["Sensor and Acuator Interfaces"],"readme":"image::logo/horizontal.png[Ubuntu Hardening]\n= Hardening Ubuntu. Systemd edition.\n\n:icons: font\n\nA quick way to make a Ubuntu server a bit more secure.\n\nUse the newly installed and configured system as a reference,\nor golden, image. Use that image as a baseline installation media and ensure\nthat any future installation comply with benchmarks and policies using a\nconfiguration management tool, e.g https://www.ansible.com/[Ansible] or\nhttps://puppet.com/[Puppet].\n\nTested on `Ubuntu 20.04 Focal Fossa` and `Ubuntu 22.04 Jammy Jellyfish`.\n\nIf you're just interested in the security focused systemd configuration, it's\navailable as a link:systemd.adoc[separate document].\n\nIf you're interested in testing your host settings, you'll find the\nlink:README.adoc#tests[instructions here].\n\nNOTE: Read the code and do not run this script without first testing in a\nnon-operational environment. The code is *not* idempotent, use the https://github.com/konstruktoid/ansible-role-hardening[Ansible role] in production environments instead.\n\nNOTE: There is a https://slsa.dev/[SLSA] artifact present under the\nhttps://github.com/konstruktoid/hardening/actions/workflows/slsa.yml[slsa workflow]\nfor file checksum verification.\n\n== Packer template and Ansible playbook\n\nA https://www.packer.io/[Packer] template is available in the link:packer/[Packer directory].\n\nAn Ansible playbook is available in the https://github.com/konstruktoid/ansible-role-hardening[konstruktoid/ansible-role-hardening]\nrepository.\n\n== Howto\n\n. Start the server installation.\n. Pick language and keyboard layout.\n. Select \"Ubuntu Server (minimized)\".\n. Configure network connections.\n. Partition the system, see below for recommendations.\n. Do not install the OpenSSH server, \"Featured Server Snaps\", or any other packages.\n. Finish the installation and reboot.\n. Log in.\n. If wanted, set a Grub2 password with `grub-mkpasswd-pbkdf2`. See https://help.ubuntu.com/community/Grub2/Passwords[https://help.ubuntu.com/community/Grub2/Passwords]\nfor more information.\n. Install necessary packages: `sudo apt-get -y install git net-tools procps --no-install-recommends`.\n. Download the script: `git clone https://github.com/konstruktoid/hardening.git`.\n. Change the configuration options in the `ubuntu.cfg` file. Make sure to update the CHANGEME variable otherwise the script will fail.\n. Run the script: `sudo bash ubuntu.sh`.\n. Reboot.\n\n=== Recommended partitions and options\n\n[source,shell]\n----\n/boot (rw)\n/home (rw,nosuid,nodev)\n/var/log (rw,nosuid,nodev,noexec)\n/var/log/audit (rw,nosuid,nodev,noexec)\n/var/tmp (rw,nosuid,nodev,noexec)\n----\n\nNote that `/tmp` will be added automatically by the script.\n\n== Configuration options\n\n[source,shell]\n----\nFW_ADMIN='127.0.0.1' // \u003c1\u003e\nSSH_GRPS='sudo' // \u003c2\u003e\nSSH_PORT='22' // \u003c3\u003e\nSYSCTL_CONF='./misc/sysctl.conf' // \u003c4\u003e\nAUDITD_MODE='1' // \u003c5\u003e\nAUDITD_RULES='./misc/audit-base.rules ./misc/audit-aggressive.rules ./misc/audit-docker.rules' // \u003c6\u003e\nLOGROTATE_CONF='./misc/logrotate.conf' // \u003c7\u003e\nNTPSERVERPOOL='0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org pool.ntp.org' // \u003c8\u003e\nTIMEDATECTL='' // \u003c9\u003e\nVERBOSE='N' // \u003c10\u003e\nAUTOFILL='N' // \u003c11\u003e\nADMINEMAIL=\"root@localhost\" // \u003c12\u003e\nKEEP_SNAPD='Y' // \u003c13\u003e\nCHANGEME='' // \u003c14\u003e\n\n# Configuration files // \u003c15\u003e\nADDUSER='/etc/adduser.conf'\nAUDITDCONF='/etc/audit/auditd.conf'\nAUDITRULES='/etc/audit/rules.d/hardening.rules'\nCOMMONPASSWD='/etc/pam.d/common-password'\nCOMMONACCOUNT='/etc/pam.d/common-account'\nCOMMONAUTH='/etc/pam.d/common-auth'\nCOREDUMPCONF='/etc/systemd/coredump.conf'\nDEFAULTGRUB='/etc/default/grub.d'\nDISABLEFS='/etc/modprobe.d/disablefs.conf'\nDISABLEMOD='/etc/modprobe.d/disablemod.conf'\nDISABLENET='/etc/modprobe.d/disablenet.conf'\nFAILLOCKCONF='/etc/security/faillock.conf'\nJOURNALDCONF='/etc/systemd/journald.conf'\nLIMITSCONF='/etc/security/limits.conf'\nLOGINDCONF='/etc/systemd/logind.conf'\nLOGINDEFS='/etc/login.defs'\nLOGROTATE='/etc/logrotate.conf'\nPAMLOGIN='/etc/pam.d/login'\nPSADCONF='/etc/psad/psad.conf'\nPSADDL='/etc/psad/auto_dl'\nRESOLVEDCONF='/etc/systemd/resolved.conf'\nRKHUNTERCONF='/etc/default/rkhunter'\nRSYSLOGCONF='/etc/rsyslog.conf'\nSECURITYACCESS='/etc/security/access.conf'\nSSHFILE='/etc/ssh/ssh_config'\nSSHDFILE='/etc/ssh/sshd_config'\nSYSCTL='/etc/sysctl.conf'\nSYSTEMCONF='/etc/systemd/system.conf'\nTIMESYNCD='/etc/systemd/timesyncd.conf'\nUFWDEFAULT='/etc/default/ufw'\nUSERADD='/etc/default/useradd'\nUSERCONF='/etc/systemd/user.conf'\n\n----\n\u003c1\u003e The IP addresses that will be able to connect with SSH, separated by spaces.\n\u003c2\u003e Which group the users have to be member of in order to acess via SSH, separated by spaces.\n\u003c3\u003e Configure SSH port.\n\u003c4\u003e Stricter sysctl settings.\n\u003c5\u003e Auditd failure mode. 0=silent 1=printk 2=panic.\n\u003c6\u003e Auditd rules.\n\u003c7\u003e Logrotate settings.\n\u003c8\u003e NTP server pool.\n\u003c9\u003e Add a specific time zone or use the system default by leaving it empty.\n\u003c10\u003e If you want all the details or not.\n\u003c11\u003e Let the script guess the `FW_ADMIN` and `SSH_GRPS` settings.\n\u003c12\u003e Add a valid email address, so PSAD can send notifications.\n\u003c13\u003e If `'Y'` then the `snapd` package will be held to prevent removal.\n\u003c14\u003e Add something just to verify that you actually glanced the code.\n\u003c15\u003e Default configuration file locations.\n\n== Functions\n\n=== Function list in execution order\n\nNote that all functions has the `f_` prefix in the code.\n\n==== `pre`\n\nSets `apt` flags and performs basic permission check.\n\nThe `pre` function is located in link:scripts/pre[./scripts/pre].\n\n==== `kernel`\n\nSets https://github.com/jeffmurphy/NetPass/blob/master/doc/netfilter_conntrack_perf.txt#L175[/sys/module/nf_conntrack/parameters/hashsize]\nto 1048576 if `hashsize` exists and is writable.\n\nSets https://man7.org/linux/man-pages/man7/kernel_lockdown.7.html[/sys/kernel/security/lockdown]\nto `confidentiality` if `lockdown` exists and is writable.\n\nThe `kernel` function is located in link:scripts/kernel[./scripts/kernel].\n\n==== `firewall`\n\nConfigures https://help.ubuntu.com/community/UFW[UFW] if installed.\n\nAllows connections from the adresses in `$FW_ADMIN` to the `$SSH_PORT`.\n\nSets logging and `IPT_SYSCTL=/etc/sysctl.conf`.\n\nThe `firewall` function is located in link:scripts/ufw[./scripts/ufw].\n\n==== `disablenet`\n\nDisables the `dccp`, `sctp`, `rds` and `tipc` kernel modules.\n\nThe `disablenet` function is located in link:scripts/disablenet[./scripts/disablenet].\n\n==== `disablefs`\n\nDisables the `cramfs` `freevxfs` `jffs2` `ksmbd` `hfs` `hfsplus` `udf` kernel\nmodules.\n\nThe `disablefs` function is located in link:scripts/disablefs[./scripts/disablefs].\n\n==== `disablemod`\n\nDisables the `bluetooth`, `bnep`, `btusb`, `cpia2`, `firewire-core`, `floppy`,\n`n_hdlc`, `net-pf-31`, `pcspkr`, `soundcore`, `thunderbolt`, `usb-midi`,\n`usb-storage`, `uvcvideo`, `v4l2_common` kernel modules.\n\nNote that disabling the `usb-storage` module will disable any usage of USB\nstorage devices, if such devices are needed `USBGuard` should be configured\naccordingly and `usb-storage` removed from the `disablemod` function.\n\nThe `disablemod` function is located in link:scripts/disablemod[./scripts/disablemod].\n\n==== `systemdconf`\n\nSets `CrashShell=no`, `DefaultLimitCORE=0`, `DefaultLimitNOFILE=1024`,\n`DefaultLimitNPROC=1024`, `DumpCore=no` in `$SYSTEMCONF`\nand `$USERCONF`.\n\nThe `systemdconf` function is located in link:scripts/systemdconf[./scripts/systemdconf].\n\n==== `resolvedconf`\n\nSets `DNS=$dnslist`, `DNSOverTLS=opportunistic`, `DNSSEC=allow-downgrade`, `FallbackDNS=1.0.0.1`\nin `$RESOLVEDCONF`, where `$dnslist` is an array with the nameservers present\nin `/etc/resolv.conf`.\n\nThe `resolvedconf` function is located in link:scripts/resolvedconf[./scripts/resolvedconf].\n\n==== `logindconf`\n\nSets `IdleAction=lock`, `IdleActionSec=15min`, `KillExcludeUsers=root`,\n`KillUserProcesses=1`, `RemoveIPC=yes` in `$LOGINDCONF`.\n\nThe `logindconf` function is located in link:scripts/logindconf[./scripts/logindconf].\n\n==== `journalctl`\n\nCopies link:misc/logrotate.conf[./misc/logrotate.conf] to `$LOGROTATE`.\n\nSets `Compress=yes`, `ForwardToSyslog=yes`, `Storage=persistent` in\n`$JOURNALDCONF`.\n\nSets `$FileCreateMode 0600/` in `$RSYSLOGCONF`.\nif `RSYSLOGCONF` is writable.\n\nThe `journalctl` function is located in link:scripts/journalctl[./scripts/journalctl].\n\n==== `timesyncd`\n\nSets `NTP=${SERVERARRAY}`, `FallbackNTP=${FALLBACKARRAY}`, `RootDistanceMaxSec=1`\nin `$TIMESYNCD` where the arrays are up to four time servers with \u003c 50ms\nlatency.\n\nThe `timesyncd` function is located in link:scripts/timesyncd[./scripts/timesyncd].\n\n==== `fstab`\n\nConfigures the `/boot` and `/home` partitions with `defaults,nosuid,nodev` if\nthey are available in `/etc/fstab`.\n\nConfigures the `/var/log`, `/var/log/audit` and `/var/tmp` partitions with\n`defaults,nosuid,nodev,noexec` if they are available in `/etc/fstab`.\n\nAdds `/run/shm tmpfs rw,noexec,nosuid,nodev`,\n`/dev/shm tmpfs rw,noexec,nosuid,nodev` and\n`/proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2` to `/etc/fstab` if\nthe partition isn't present in `/etc/fstab`.\n\nRemoves any floppy drivers from `/etc/fstab`.\n\nCopies ./config/tmp.mount[./config/tmp.mount] to\n`/etc/systemd/system/tmp.mount`, removes `/tmp` from `/etc/fstab`\nand enables the tmpfs `/tmp` mount instead.\n\nThe `/proc` `hidepid` option is described in https://www.kernel.org/doc/html/latest/filesystems/proc.html#mount-options[https://www.kernel.org/doc/html/latest/filesystems/proc.html#mount-options].\n\nThe `fstab` function is located in link:scripts/fstab[./scripts/fstab].\n\n==== `prelink`\n\nReverts binaries and libraries to their original content before they were\nprelinked and uninstalls `prelink`.\n\nThe `prelink` function is located in link:scripts/prelink[./scripts/prelink].\n\n==== `aptget_configure`\n\nSets `apt` options `Acquire::http::AllowRedirect \"false\";`, `APT::Get::AllowUnauthenticated \"false\";`,\n`APT::Periodic::AutocleanInterval \"7\";`,\n`APT::Install-Recommends \"false\";`, `APT::Get::AutomaticRemove \"true\";`,\n`APT::Install-Suggests \"false\";`, `Acquire::AllowDowngradeToInsecureRepositories \"false\";`,\n`Acquire::AllowInsecureRepositories \"false\";`, `APT::Sandbox::Seccomp \"1\";`\n\nSee https://manpages.ubuntu.com/manpages/jammy/man5/apt.conf.5.html[https://manpages.ubuntu.com/manpages/jammy/man5/apt.conf.5.html].\n\nThe `aptget_configure` function is located in link:scripts/aptget[./scripts/aptget].\n\n==== `aptget`\n\nUpgrades installed packages.\n\nThe `aptget` function is located in link:scripts/aptget[./scripts/aptget].\n\n==== `hosts`\n\nSets `sshd : ALL : ALLOW`, `ALL: LOCAL, 127.0.0.1` in `/etc/hosts.allow` and\n`ALL: ALL` in `/etc/hosts.deny`.\n\nSee https://manpages.ubuntu.com/manpages/jammy/man5/hosts_access.5.html[https://manpages.ubuntu.com/manpages/jammy/man5/hosts_access.5.html]\nfor the format of host access control files.\n\nThe `hosts` function is located in link:scripts/hosts[./scripts/hosts].\n\n==== `issue`\n\nWrites a notice regarding authorized use only to `/etc/issue`, `/etc/issue.net`\nand `/etc/motd`.\n\nRemoves the executable flag from every file in `/etc/update-motd.d/`.\n\nThe `issue` function is located in link:scripts/issue[./scripts/issue].\n\n==== `sudo`\n\nRestricts `su` access to members of the `sudo` group using\nhttps://manpages.ubuntu.com/manpages/jammy/man8/pam_wheel.8.html[pam_wheel].\n\nSets `!pwfeedback`, `!visiblepw`, `logfile=/var/log/sudo.log`, `passwd_timeout=1`,\n`timestamp_timeout=5`, `use_pty` https://manpages.ubuntu.com/manpages/jammy/man5/sudoers.5.html[sudo options].\n\nThe `sudo` function is located in link:scripts/sudo[./scripts/sudo].\n\n==== `logindefs`\n\nWrites `LOG_OK_LOGINS yes`, `UMASK 077`, `PASS_MIN_DAYS 1`, `PASS_MAX_DAYS 60`,\n`DEFAULT_HOME no`, `ENCRYPT_METHOD SHA512`, `USERGROUPS_ENAB no`,\n`SHA_CRYPT_MIN_ROUNDS 10000`, `SHA_CRYPT_MAX_ROUNDS 65536` to\nhttps://manpages.ubuntu.com/manpages/jammy/man5/login.defs.5.html[$LOGINDEFS]\n\nThe `logindefs` function is located in link:scripts/logindefs[./scripts/logindefs].\n\n==== `sysctl`\n\nCopies link:misc/sysctl.conf[./misc/sysctl.conf] to `$SYSCTL`.\n\nFor an explanation of the options set, see\nhttps://www.kernel.org/doc/html/latest/admin-guide/sysctl/[https://www.kernel.org/doc/html/latest/admin-guide/sysctl/].\n\nThe `sysctl` function is located in link:scripts/sysctl[./scripts/sysctl].\n\n==== `limitsconf`\n\nSets `hard maxlogins 10`, `hard core 0`, `soft nproc 512`, `hard nproc 1024` in\nhttps://manpages.ubuntu.com/manpages/jammy/en/man5/limits.conf.5.html[$LIMITSCONF]\n\nThe `limitsconf` function is located in link:scripts/limits[./scripts/limits].\n\n==== `adduser`\n\nSets `DIR_MODE=0750`,`DSHELL=/bin/false`, and `USERGROUPS=yes` in `$ADDUSER`.\n\nSets `INACTIVE=30` and `SHELL=/bin/false` in `$USERADD`.\n\nThe `adduser` function is located in link:scripts/adduser[./scripts/adduser].\n\n==== `rootaccess`\n\nWrites `+:root:127.0.0.1/'` to `$SECURITYACCESS` and `console` to\n`/etc/securetty`.\n\nMasks https://freedesktop.org/wiki/Software/systemd/Debugging/[debug-shell].\n\nThe `rootaccess` function is located in link:scripts/rootaccess[./scripts/rootaccess].\n\n==== `package_install`\n\nInstalls `acct`, `aide-common`, `cracklib-runtime`, `debsums`, `gnupg2`,\n`haveged`, `libpam-pwquality`, `libpam-tmpdir`, `needrestart`, `openssh-server`,\n`postfix`, `psad`, `rkhunter`, `sysstat`, `systemd-coredump`, `tcpd`,\n`update-notifier-common`, `vlock`.\n\nThe `package_install` function is located in link:scripts/packages[./scripts/packages].\n\n==== `psad`\n\nInstalls and configures https://cipherdyne.org/psad/[PSAD]\n\nThe `psad` function is located in link:scripts/psad[./scripts/psad].\n\n==== `coredump`\n\nWrites `Storage=none` and `ProcessSizeMax=0` to `$COREDUMPCONF`.\n\nThe `coredump` function is located in link:scripts/coredump[./scripts/coredump].\n\n==== `usbguard`\n\nInstalls and configures https://usbguard.github.io/[USBGuard].\n\nThe `usbguard` function is located in link:scripts/usbguard[./scripts/usbguard].\n\n==== `postfix`\n\nInstalls `postfix` and sets `disable_vrfy_command=yes`,\n`inet_interfaces=loopback-only`,\n`smtpd_banner=\"\\$myhostname`,\n`smtpd_client_restrictions=permit_mynetworks,reject` using https://manpages.ubuntu.com/manpages/jammy/en/man1/postconf.1.html[postconf].\n\nThe `postfix` function is located in link:scripts/postfix[./scripts/postfix].\n\n==== `apport`\n\nDisables\nhttps://manpages.ubuntu.com/manpages/jammy/man1/apport-cli.1.html[apport],\nhttps://github.com/Ubuntu/ubuntu-report[ubuntu-report] and\nhttps://manpages.ubuntu.com/manpages/jammy/en/man8/popularity-contest.8.html[popularity-contest].\n\nThe `apport` function is located in link:scripts/apport[./scripts/apport].\n\n==== `motdnews`\n\nDisables `apt_news` and https://ubuntu.com/legal/motd[motd-news].\n\nThe `motdnews` function is located in link:scripts/motdnews[./scripts/motdnews].\n\n==== `rkhunter`\n\nSets `CRON_DAILY_RUN=\"yes\"`, `APT_AUTOGEN=\"yes\"` in `$RKHUNTERCONF`.\n\nThe `rkhunter` function is located in link:scripts/rkhunter[./scripts/rkhunter].\n\n==== `sshconfig`\n\nSets `HashKnownHosts yes`, `Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr`\nand `MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256`\nin `$SSHFILE`.\n\nThe `sshconfig` function is located in link:scripts/sshdconfig[./scripts/sshdconfig].\n\n==== `sshdconfig`\n\nConfigures the `OpenSSH` daemon. The configuration changes will be placed in\nthe directory defined by the `Include` option if present, otherwise\nhttps://manpages.ubuntu.com/manpages/jammy/en/man5/sshd_config.5.html[$SSHDFILE]\nwill be modified.\n\nBy default `/etc/ssh/sshd_config.d/hardening.conf` will contain the following:\n\n[source,shell]\n----\nAcceptEnv LANG LC_*\nAllowAgentForwarding no\nAllowGroups sudo\nAllowTcpForwarding no\nBanner /etc/issue.net\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr\nClientAliveCountMax 3\nClientAliveInterval 200\nCompression no\nGSSAPIAuthentication no\nHostbasedAuthentication no\nIgnoreUserKnownHosts yes\nKbdInteractiveAuthentication no\nKerberosAuthentication no\nKexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256\nLogLevel VERBOSE\nLoginGraceTime 20\nMacs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256\nMaxAuthTries 3\nMaxSessions 3\nMaxStartups 10:30:60\nPasswordAuthentication no\nPermitEmptyPasswords no\nPermitRootLogin no\nPermitUserEnvironment no\nPort 22\nPrintLastLog yes\nPrintMotd no\nRekeyLimit 512M 1h\nStrictModes yes\nTCPKeepAlive no\nUseDNS no\nUsePAM yes\nX11Forwarding no\n----\n\nThe `sshdconfig` function is located in link:scripts/sshdconfig[./scripts/sshdconfig].\n\n==== `password`\n\nCopies ./config/pwquality.conf[./config/pwquality.conf] to `/etc/security/pwquality.conf`,\n\nRemoves `nullok` from https://manpages.ubuntu.com/manpages/jammy/man5/pam.conf.5.html[PAM]\n`$COMMONAUTH`.\n\nConfigures https://manpages.ubuntu.com/manpages/jammy/en/man8/faillock.8.html[faillock]\nor https://manpages.ubuntu.com/manpages/jammy/man8/pam_tally2.8.html[pam_tally2]\ndepending on which is installed.\n\nAdds a link:misc/passwords.list[password list] to https://manpages.ubuntu.com/manpages/jammy/man8/update-cracklib.8.html[cracklib].\n\nThe `password` function is located in link:scripts/password[./scripts/password].\n\n==== `cron`\n\nDisables https://manpages.ubuntu.com/manpages/jammy/en/man8/atd.8.html[atd]\nand only allow root to use https://manpages.ubuntu.com/manpages/jammy/en/man1/at.1.html[at]\nor https://manpages.ubuntu.com/manpages/jammy/en/man8/cron.8.html[cron].\n\nThe `cron` function is located in link:scripts/cron[./scripts/cron].\n\n==== `ctrlaltdel`\n\nMasks https://manpages.ubuntu.com/manpages/jammy/man1/systemd.1.html#signals[ctrl-alt-del.target].\n\nThe `ctrlaltdel` function is located in link:scripts/ctraltdel[./scripts/ctraltdel].\n\n==== `auditd`\n\nConfigures https://manpages.ubuntu.com/manpages/jammy/en/man8/auditd.8.html[auditd].\n\nSee link:misc/audit-base.rules[./misc/audit-base.rules],\nlink:misc/audit-aggressive.rules[./misc/audit-aggressive.rules] and link:misc/audit-docker.rules[./misc/audit-docker.rules]\nfor the rules used.\n\nThe `auditd` function is located in link:scripts/auditd[./scripts/auditd].\n\n==== `aide`\n\nExcludes `/var/lib/lxcfs/cgroup` and `/var/lib/docker` from https://manpages.ubuntu.com/manpages/jammy/en/man1/aide.1.html[AIDE].\n\nThe `aide` function is located in link:scripts/aide[./scripts/aide].\n\n==== `rhosts`\n\nRemoves any existing `hosts.equiv` or `.rhosts` files.\n\nThe `rhosts` function is located in link:scripts/rhosts[./scripts/rhosts].\n\n==== `users`\n\nRemoves the `games`, `gnats`, `irc`, `list`, `news`, `sync`, `uucp` users.\n\nThe `users` function is located in link:scripts/users[./scripts/users].\n\n==== `lockroot`\n\nLocks root account\n\nThe `lockroot` function is located in link:scripts/lockroot[./scripts/lockroot].\n\n==== `package_remove`\n\nRemoves the `apport*`, `autofs`, `avahi*`, `beep`, `git`, `pastebinit`,\n`popularity-contest`, `rsh*`, `rsync`, `talk*`, `telnet*`, `tftp*`, `whoopsie`,\n`xinetd`, `yp-tools`, `ypbind` packages.\n\nThe `package_remove` function is located in link:scripts/packages[./scripts/packages].\n\n==== `suid`\n\nEnsures the executables in link:misc/suid.list[./misc/suid.list] don't have suid\nbits set.\n\nThe `suid` function is located in link:scripts/suid[./scripts/suid].\n\n==== `restrictcompilers`\n\nChanges mode to `0750` on any installed compilers.\n\nThe `restrictcompilers` function is located in link:scripts/compilers[./scripts/compilers].\n\n==== `umask`\n\nSets the default https://manpages.ubuntu.com/manpages/jammy/man2/umask.2.html[umask] to `077`\n\nThe `umask` function is located in link:scripts/umask[./scripts/umask].\n\n==== `path`\n\nCopies ./config/initpath.sh[./config/initpath.sh] to `/etc/profile.d/initpath.sh`\nand sets `PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin`\nfor the `root` user and `PATH=/usr/local/bin:/usr/sbin:/usr/bin:/bin:/snap/bin`\nfor everyone else.\n\nThe `path` function is located in link:scripts/path[./scripts/path].\n\n==== `aa_enforce`\n\nEnforces available https://manpages.ubuntu.com/manpages/jammy/en/man7/apparmor.7.html[apparmor]\nprofiles.\n\nThe `aa_enforce` function is located in link:scripts/apparmor[./scripts/apparmor].\n\n==== `aide_post`\n\nCreates a new AIDE database.\n\nThe `aide_post` function is located in link:scripts/aide[./scripts/aide].\n\n==== `aide_timer`\n\nCopies a systemd AIDE check service and timer to /etc/systemd/system/.\n\nThe `aide_timer` function is located in link:scripts/aide[./scripts/aide].\n\n==== `aptget_noexec`\n\nAdds a `DPkg::Pre-Invoke` and `DPkg::Post-Invoke` to ensure package updates\ndon't fail on a `noexec` `/tmp` partition.\n\nThe `aptget_noexec` function is located in link:scripts/aptget[./scripts/aptget].\n\n==== `aptget_clean`\n\nRuns https://manpages.ubuntu.com/manpages/jammy/en/man8/apt-get.8.html[apt-get] `clean` and `autoremove`.\n\nThe `aptget_clean` function is located in link:scripts/aptget[./scripts/aptget].\n\n==== `systemddelta`\n\nRuns https://manpages.ubuntu.com/manpages/jammy/man1/systemd-delta.1.html[systemd-delta] if running in verbose mode.\n\nThe `systemddelta` function is located in link:scripts/systemddelta[./scripts/systemddelta].\n\n==== `post`\n\nEnsures https://manpages.ubuntu.com/manpages/jammy/man1/fwupdmgr.1.html[fwupdmgr]\nand https://packages.ubuntu.com/jammy/secureboot-db[secureboot-db] is installed\nand GRUB is updated.\n\nThe `post` function is located in link:scripts/post[./scripts/post].\n\n==== `checkreboot`\n\nChecks if a reboot is required.\n\nThe `checkreboot` function is located in link:scripts/reboot[./scripts/reboot].\n\n== Tests\nThere are approximately 760 https://github.com/bats-core/bats-core[Bats tests]\nfor most of the above settings available in the link:tests/[tests directory].\n\n[source,shell]\n----\nsudo apt-get -y install bats\ngit clone https://github.com/konstruktoid/hardening.git\ncd hardening/tests/\nsudo bats .\n----\n\n=== Test automation using Vagrant\nRunning `bash ./runTests.sh` will use https://www.vagrantup.com/[Vagrant] to run\nall above tests, https://github.com/CISOfy/Lynis[Lynis] and\nhttps://www.open-scap.org/[OpenSCAP] with a\nhttps://www.cisecurity.org/benchmark/ubuntu_linux[CIS Ubuntu benchmark] on all\nsupported Ubuntu versions.\n\nThe script will generate a file named `TESTRESULTS.adoc` and CIS report in\nHTML-format.\n\n=== Testing a host\nRunning `bash ./runHostTests.sh`, located in the link:tests/[tests directory],\nwill generate a `TESTRESULTS-\u003cHOSTNAME\u003e.adoc` report.\n\nRunning `bash ./runHostTestsCsv.sh`, located in the link:tests/[tests directory],\nwill generate a `TESTRESULTS-\u003cHOSTNAME\u003e.csv` report.\n\n\n== Recommended reading\nhttps://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux[Canonical Ubuntu 20.04 LTS STIG - Ver 1, Rel 3] +\nhttps://www.cisecurity.org/benchmark/distribution_independent_linux/[CIS Distribution Independent Linux Benchmark] +\nhttps://www.cisecurity.org/benchmark/ubuntu_linux/[CIS Ubuntu Linux Benchmark] +\nhttps://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/ubuntu-18-04-lts[EUD Security Guidance: Ubuntu 18.04 LTS] +\nhttps://wiki.ubuntu.com/Security/Features +\nhttps://help.ubuntu.com/community/StricterDefaults +\n\n== Contributing\nDo you want to contribute? That's great! Contributions are always welcome,\nno matter how large or small. If you found something odd, feel free to\nhttps://github.com/konstruktoid/hardening/issues/[submit a new issue],\nimprove the code by https://github.com/konstruktoid/hardening/pulls[creating a pull request],\nor by https://github.com/sponsors/konstruktoid[sponsoring this project].\n\nLogo by https://github.com/reallinfo[reallinfo].\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkonstruktoid%2Fhardening","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkonstruktoid%2Fhardening","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkonstruktoid%2Fhardening/lists"}