Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,15 @@
+---
+auditd_apply_audit_rules: true
+auditd_action_mail_acct: root
+auditd_admin_space_left_action: suspend
+auditd_disk_error_action: suspend
+auditd_disk_full_action: suspend
+auditd_max_log_file: 8
+auditd_max_log_file_action: keep_logs
+auditd_mode: 1
+auditd_num_logs: 5
+auditd_space_left: 75
+auditd_space_left_action: email
+grub_audit_backlog_cmdline: audit_backlog_limit=8192
+grub_audit_cmdline: audit=1
+...
@@ -0,0 +1,13 @@
+---
+compilers:
+  - as
+  - cargo
+  - cc
+  - cc-[0-9]*
+  - clang-[0-9]*
+  - gcc
+  - gcc-[0-9]*
+  - go
+  - make
+  - rustc
+...
@@ -0,0 +1,3 @@
+---
+disable_wireless: false
+...
@@ -0,0 +1,6 @@
+---
+dns: 127.0.0.1 1.1.1.1
+fallback_dns: 9.9.9.9 1.0.0.1
+dnssec: allow-downgrade
+dns_over_tls: opportunistic
+...
@@ -0,0 +1,6 @@
+---
+disable_ipv6: false
+ipv6_disable_sysctl_settings:
+  net.ipv6.conf.all.disable_ipv6: 1
+  net.ipv6.conf.default.disable_ipv6: 1
+...
@@ -0,0 +1,6 @@
+---
+limit_nofile_hard: 1024
+limit_nofile_soft: 512
+limit_nproc_hard: 1024
+limit_nproc_soft: 512
+...
@@ -0,0 +1,13 @@
+---
+install_aide: true
+reboot_ubuntu: false
+redhat_signing_keys:
+  - 567E347AD0044ADE55BA8A5F199E2F91FD431D51
+  - 47DB287789B21722B6D95DDE5326810137017186
+epel7_signing_keys:
+  - 91E97D7C4A5E96F17F3E888F6A2FAEA2352C64E5
+epel8_signing_keys:
+  - 94E279EB8D8F25B21810ADF121EA45AB2F86D6A1
+epel9_signing_keys:
+  - FF8AD1344597106ECE813B918A3872BF3228467C
+...
@@ -0,0 +1,35 @@
+---
+block_blacklisted: false
+fs_modules_blocklist:
+  - cramfs
+  - freevxfs
+  - hfs
+  - hfsplus
+  - jffs2
+  - squashfs
+  - udf
+misc_modules_blocklist:
+  - bluetooth
+  - bnep
+  - btusb
+  - can
+  - cpia2
+  - firewire-core
+  - floppy
+  - ksmbd
+  - n_hdlc
+  - net-pf-31
+  - pcspkr
+  - soundcore
+  - thunderbolt
+  - usb-midi
+  - usb-storage
+  - uvcvideo
+  - v4l2_common
+net_modules_blocklist:
+  - atm
+  - dccp
+  - sctp
+  - rds
+  - tipc
+...
@@ -0,0 +1,4 @@
+---
+hide_pid: 2
+process_group: root
+...
@@ -0,0 +1,4 @@
+---
+fallback_ntp: 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org
+ntp: 0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org
+...
@@ -0,0 +1,71 @@
+---
+system_upgrade: true
+packages_blocklist:
+  - apport*
+  - autofs
+  - avahi*
+  - avahi-*
+  - beep
+  - git
+  - pastebinit
+  - popularity-contest
+  - prelink
+  - rpcbind
+  - rsh*
+  - rsync
+  - talk*
+  - telnet*
+  - tftp*
+  - tuned
+  - whoopsie
+  - xinetd
+  - yp-tools
+  - ypbind
+packages_debian:
+  - acct
+  - apparmor-profiles
+  - apparmor-utils
+  - apt-show-versions
+  - audispd-plugins
+  - auditd
+  - cracklib-runtime
+  - debsums
+  - gnupg2
+  - haveged
+  - libpam-apparmor
+  - libpam-cap
+  - libpam-modules
+  - libpam-pwquality
+  - libpam-tmpdir
+  - lsb-release
+  - needrestart
+  - openssh-server
+  - postfix
+  - rkhunter
+  - rsyslog
+  - sysstat
+  - tcpd
+  - vlock
+  - wamerican
+packages_redhat:
+  - audispd-plugins
+  - audit
+  - cracklib
+  - gnupg2
+  - haveged
+  - libpwquality
+  - openssh-server
+  - needrestart
+  - postfix
+  - psacct
+  - rkhunter
+  - rsyslog
+  - rsyslog-gnutls
+  - vlock
+  - words
+packages_ubuntu:
+  - fwupd
+  - secureboot-db
+unattended_reboot: true
+unattended_reboot_time: "04:00"
+...
@@ -0,0 +1,15 @@
+---
+crypto_policy: "DEFAULT:NO-SHA1"
+pwquality_config:
+  dcredit: -1
+  dictcheck: 1
+  difok: 8
+  enforcing: 1
+  lcredit: -1
+  maxclassrepeat: 4
+  maxrepeat: 3
+  minclass: 4
+  minlen: 15
+  ocredit: -1
+  ucredit: -1
+...
@@ -0,0 +1,43 @@
+---
+sshd_accept_env: LANG LC_*
+ssh_allowed_networks:
+  - 192.168.0.0/24
+  - 192.168.1.0/24
+sshd_allow_agent_forwarding: "no"
+sshd_allow_groups: sudo
+sshd_allow_tcp_forwarding: "no"
+sshd_authentication_methods: any
+sshd_banner: /etc/issue.net
+sshd_challenge_response_authentication: "no"
+sshd_ciphers: chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+sshd_client_alive_count_max: 1
+sshd_client_alive_interval: 200
+sshd_compression: "no"
+sshd_gssapi_authentication: "no"
+sshd_hostbased_authentication: "no"
+sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com
+sshd_ignore_user_known_hosts: "yes"
+sshd_kerberos_authentication: "no"
+sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+sshd_login_grace_time: 20
+sshd_log_level: VERBOSE
+sshd_macs: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
+sshd_max_auth_tries: 3
+sshd_max_sessions: 3
+sshd_max_startups: 10:30:60
+sshd_password_authentication: "no"
+sshd_permit_empty_passwords: "no"
+sshd_permit_root_login: "no"
+sshd_permit_user_environment: "no"
+sshd_port: 22
+sshd_print_last_log: "yes"
+sshd_print_motd: "no"
+sshd_rekey_limit: 512M 1h
+sshd_required_rsa_size: 2048
+sshd_strict_modes: "yes"
+sshd_subsystem: sftp internal-sftp
+sshd_tcp_keep_alive: "no"
+sshd_use_dns: "no"
+sshd_use_pam: "yes"
+sshd_x11_forwarding: "no"
+custom_hosts_acls: false
@@ -0,0 +1,390 @@
+---
+suid_sgid_permissions: true
+suid_sgid_blocklist:
+  - 7z
+  - ab
+  - agetty
+  - alpine
+  - ansible-playbook
+  - aoss
+  - apt
+  - apt-get
+  - ar
+  - aria2c
+  - arj
+  - arp
+  - as
+  - ascii-xfr
+  - ascii85
+  - ash
+  - aspell
+  - at
+  - atobm
+  - awk
+  - aws
+  - base32
+  - base58
+  - base64
+  - basenc
+  - basez
+  - bash
+  - batcat
+  - bc
+  - bconsole
+  - bpftrace
+  - bridge
+  - bsd-write
+  - bundle
+  - bundler
+  - busctl
+  - busybox
+  - byebug
+  - bzip2
+  - c89
+  - c99
+  - cabal
+  - cancel
+  - capsh
+  - cat
+  - cdist
+  - certbot
+  - chage
+  - check_by_ssh
+  - check_cups
+  - check_log
+  - check_memory
+  - check_raid
+  - check_ssl_cert
+  - check_statusfile
+  - chfn
+  - chmod
+  - choom
+  - chown
+  - chroot
+  - chsh
+  - cmp
+  - cobc
+  - column
+  - comm
+  - composer
+  - cowsay
+  - cowthink
+  - cp
+  - cpan
+  - cpio
+  - cpulimit
+  - crash
+  - crontab
+  - csh
+  - csplit
+  - csvtool
+  - cupsfilter
+  - curl
+  - cut
+  - dash
+  - date
+  - dd
+  - debugfs
+  - dialog
+  - diff
+  - dig
+  - distcc
+  - dmesg
+  - dmidecode
+  - dmsetup
+  - dnf
+  - docker
+  - dosbox
+  - dpkg
+  - dstat
+  - dvips
+  - easy_install
+  - eb
+  - ed
+  - efax
+  - emacs
+  - env
+  - eqn
+  - espeak
+  - ex
+  - exiftool
+  - expand
+  - expect
+  - facter
+  - file
+  - find
+  - finger
+  - fish
+  - flock
+  - fmt
+  - fold
+  - fping
+  - ftp
+  - fusermount
+  - gawk
+  - gcc
+  - gcloud
+  - gcore
+  - gdb
+  - gem
+  - genie
+  - genisoimage
+  - ghc
+  - ghci
+  - gimp
+  - ginsh
+  - git
+  - grc
+  - grep
+  - gtester
+  - gzip
+  - hd
+  - head
+  - hexdump
+  - highlight
+  - hping3
+  - iconv
+  - iftop
+  - install
+  - ionice
+  - ip
+  - irb
+  - ispell
+  - jjs
+  - joe
+  - join
+  - journalctl
+  - jq
+  - jrunscript
+  - jtag
+  - knife
+  - ksh
+  - ksshell
+  - ksu
+  - kubectl
+  - latex
+  - latexmk
+  - ld.so
+  - ldconfig
+  - less
+  - lftp
+  - ln
+  - loginctl
+  - logsave
+  - look
+  - lp
+  - ltrace
+  - lua
+  - lualatex
+  - luatex
+  - lwp-download
+  - lwp-request
+  - mail
+  - make
+  - man
+  - mawk
+  - mksh
+  - mksh-static
+  - mlocate
+  - more
+  - mosquitto
+  - mount
+  - mount.nfs
+  - msfconsole
+  - msgattrib
+  - msgcat
+  - msgconv
+  - msgfilter
+  - msgmerge
+  - msguniq
+  - mtr
+  - multitime
+  - mv
+  - mysql
+  - nano
+  - nasm
+  - nawk
+  - nc
+  - neofetch
+  - netfilter-persistent
+  - newgrp
+  - nft
+  - nice
+  - nl
+  - nm
+  - nmap
+  - node
+  - nohup
+  - npm
+  - nroff
+  - nsenter
+  - ntfs-3g
+  - octave
+  - od
+  - openssl
+  - openvpn
+  - openvt
+  - opkg
+  - pandoc
+  - paste
+  - pax
+  - pdb
+  - pdflatex
+  - pdftex
+  - perf
+  - perl
+  - perlbug
+  - pexec
+  - pg
+  - php
+  - pic
+  - pico
+  - pidstat
+  - ping
+  - ping6
+  - pip
+  - pkexec
+  - pkg
+  - posh
+  - pppd
+  - pr
+  - pry
+  - psad
+  - psftp
+  - psql
+  - ptx
+  - puppet
+  - python
+  - rake
+  - rbash
+  - readelf
+  - red
+  - redcarpet
+  - redis
+  - restic
+  - rev
+  - rlogin
+  - rlwrap
+  - rpm
+  - rpmdb
+  - rpmquery
+  - rpmverify
+  - rsync
+  - rtorrent
+  - ruby
+  - run-mailcap
+  - run-parts
+  - rview
+  - rvim
+  - sash
+  - scanmem
+  - scp
+  - screen
+  - script
+  - scrot
+  - sed
+  - service
+  - setarch
+  - setfacl
+  - setlock
+  - sftp
+  - sg
+  - sh
+  - shuf
+  - slsh
+  - smbclient
+  - snap
+  - socat
+  - socket
+  - soelim
+  - softlimit
+  - sort
+  - split
+  - sqlite3
+  - sqlmap
+  - ss
+  - ssh
+  - ssh-keygen
+  - ssh-keyscan
+  - sshpass
+  - start-stop-daemon
+  - stdbuf
+  - strace
+  - strings
+  - su
+  - sysctl
+  - systemctl
+  - systemd-resolve
+  - tac
+  - tail
+  - tar
+  - task
+  - taskset
+  - tasksh
+  - tbl
+  - tclsh
+  - tcpdump
+  - tcsh
+  - tee
+  - telnet
+  - tex
+  - tftp
+  - tic
+  - time
+  - timedatectl
+  - timeout
+  - tmate
+  - tmux
+  - top
+  - torify
+  - torsocks
+  - traceroute6.iputils
+  - troff
+  - tshark
+  - ul
+  - umount
+  - unexpand
+  - uniq
+  - unshare
+  - unzip
+  - update-alternatives
+  - uudecode
+  - uuencode
+  - valgrind
+  - vi
+  - view
+  - vigr
+  - vim
+  - vimdiff
+  - vipw
+  - virsh
+  - volatility
+  - w3m
+  - wall
+  - watch
+  - wc
+  - wget
+  - whiptail
+  - whois
+  - wireshark
+  - wish
+  - write
+  - xargs
+  - xdotool
+  - xelatex
+  - xetex
+  - xmodmap
+  - xmore
+  - xpad
+  - xxd
+  - xz
+  - yarn
+  - yash
+  - yelp
+  - yum
+  - zathura
+  - zip
+  - zsh
+  - zsoelim
+  - zypper
+...
@@ -0,0 +1,69 @@
+---
+sysctl_dev_tty_ldisc_autoload: 0
+sysctl_net_ipv6_conf_accept_ra_rtr_pref: 0
+
+ipv4_sysctl_settings:
+  net.ipv4.conf.all.accept_redirects: 0
+  net.ipv4.conf.all.accept_source_route: 0
+  net.ipv4.conf.all.log_martians: 1
+  net.ipv4.conf.all.rp_filter: 1
+  net.ipv4.conf.all.secure_redirects: 0
+  net.ipv4.conf.all.send_redirects: 0
+  net.ipv4.conf.all.shared_media: 0
+  net.ipv4.conf.default.accept_redirects: 0
+  net.ipv4.conf.default.accept_source_route: 0
+  net.ipv4.conf.default.log_martians: 1
+  net.ipv4.conf.default.rp_filter: 1
+  net.ipv4.conf.default.secure_redirects: 0
+  net.ipv4.conf.default.send_redirects: 0
+  net.ipv4.conf.default.shared_media: 0
+  net.ipv4.icmp_echo_ignore_broadcasts: 1
+  net.ipv4.icmp_ignore_bogus_error_responses: 1
+  net.ipv4.ip_forward: 0
+  net.ipv4.tcp_challenge_ack_limit: 2147483647
+  net.ipv4.tcp_invalid_ratelimit: 500
+  net.ipv4.tcp_max_syn_backlog: 20480
+  net.ipv4.tcp_rfc1337: 1
+  net.ipv4.tcp_syn_retries: 5
+  net.ipv4.tcp_synack_retries: 2
+  net.ipv4.tcp_syncookies: 1
+
+ipv6_sysctl_settings:
+  net.ipv6.conf.all.accept_ra: 0
+  net.ipv6.conf.all.accept_redirects: 0
+  net.ipv6.conf.all.accept_source_route: 0
+  net.ipv6.conf.all.forwarding: 0
+  net.ipv6.conf.all.use_tempaddr: 2
+  net.ipv6.conf.default.accept_ra: 0
+  net.ipv6.conf.default.accept_ra_defrtr: 0
+  net.ipv6.conf.default.accept_ra_pinfo: 0
+  net.ipv6.conf.default.accept_ra_rtr_pref: 0
+  net.ipv6.conf.default.accept_redirects: 0
+  net.ipv6.conf.default.accept_source_route: 0
+  net.ipv6.conf.default.autoconf: 0
+  net.ipv6.conf.default.dad_transmits: 0
+  net.ipv6.conf.default.max_addresses: 1
+  net.ipv6.conf.default.router_solicitations: 0
+  net.ipv6.conf.default.use_tempaddr: 2
+
+generic_sysctl_settings:
+  fs.protected_fifos: 2
+  fs.protected_hardlinks: 1
+  fs.protected_symlinks: 1
+  fs.suid_dumpable: 0
+  kernel.core_uses_pid: 1
+  kernel.dmesg_restrict: 1
+  kernel.kptr_restrict: 2
+  kernel.panic: 60
+  kernel.panic_on_oops: 60
+  kernel.perf_event_paranoid: 3
+  kernel.randomize_va_space: 2
+  kernel.sysrq: 0
+  kernel.unprivileged_bpf_disabled: 1
+  kernel.yama.ptrace_scope: 2
+  net.core.bpf_jit_harden: 2
+
+conntrack_sysctl_settings:
+  net.netfilter.nf_conntrack_max: 2000000
+  net.netfilter.nf_conntrack_tcp_loose: 0
+...
@@ -0,0 +1,16 @@
+---
+ufw_enable: true
+ufw_outgoing_traffic:
+  - 22
+  - 53
+  - 80
+  - 123
+  - 443
+  - 853
+
+fw_allowed_ports: []
+ufw_default_forward_policy: DROP
+ufw_incoming_devices: []
+ufw_outgoing_devices: []
+fw_loopback_traffic_deny: true
+ufw_delete_unmanaged: true
@@ -0,0 +1,2 @@
+---
+umask_value: "077"
@@ -0,0 +1,10 @@
+---
+delete_users:
+  - games
+  - gnats
+  - irc
+  - list
+  - news
+  - sync
+  - uucp
+...