From a3628fc49db4d88ff3e4067268650710d1da3f6f Mon Sep 17 00:00:00 2001 From: Silvino Silva Date: Fri, 12 Feb 2021 03:59:34 +0000 Subject: initial openbsd support --- core/hardening.html | 188 ---------------------------------------------------- 1 file changed, 188 deletions(-) delete mode 100644 core/hardening.html (limited to 'core/hardening.html') diff --git a/core/hardening.html b/core/hardening.html deleted file mode 100644 index 041f999..0000000 --- a/core/hardening.html +++ /dev/null @@ -1,188 +0,0 @@ - - - - - 2.6. Hardening - - - - Core OS Index - -

2.6. Hardening

- -

2.6.0.2 System security

- -

File systems: Check fstab and current mount options. Mount filesystems in read only, only strict necessary in rw.
Sys: Check kernel settings with sysctl.; kernel.yama.ptrace_scope breaks gdb, strace, perf trace and reptyr.
Iptables: Check if iptables rules are loaded and are correctly logging.(firewald works as API to iptables).
Apparmor: Check if apparmor is active and enforcing policies.
Samhain: Check if samhain is running.
Toolchain: Build ports using hardened toolchain settings.

- - -

-        $ sudo prt-get depinst checksec
-

- -

2.6.0.1 System configuration

- -

1.1 - Users groups, passwords and sudo.

- -

Check "normal" users groups, make sure they are not admin or wheel group; ps -U root -u root u, ps axl | awk '$7 != 0 && $10 !~ "Z"', process permission; ps -o gid,rdig,supgid -p "$pid"

- -

Maintain, secure with hash, and enforce secure passwords with pam-cracklib.

- - -

1.2 - Linux PAM

- -

Cat /etc/pam.d/system-auth. Check pam modules, test on virtual machine, user can lockout during tests. Check files (processes); getfacl filename.

- -

Check files (processes) set uid and set gid;

- -

-        # find / -perm 4000 >> /root/setuid_files
-        # find / -perm 2000 >> /root/setguid_files
-

- -

To setuid (4744);

- -

-        # chmod u+s filename
-

- -

To remove (0664) from su and Xorg (user must be part of input and video for xorg to run);

- -

-        # chmod u-s /usr/bin/su
-        # chmod u-s /usr/bin/X
-

- -

To set gid (2744)

-        # chmod g+s filename
-

To remove (0774);

-        # chmod g-s filename
-

- -

Find world writable files;

- -

-        # find /dir -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print
-

- -

No owner files;

- -

-        # find /dir -xdev \( -nouser -o -nogroup \) -print
-

- -

1.3. Capabilities

- -

Check capabilities;

-        # getcap filename
-

- -

1.9 - Limit number of processes.

1.10 - Lock user after 3 failed loggins.

1.8 - Block host ip based on iptable and services - abuse.

- - -

1.4 Sudo

- -

Check sudo, sudoers and sudo replay.

- -

Don't run editor as root, instead run sudoedit filename or sudo --edit filename. Editor can be set as a environment variable;

- -

-        $ export SUDO_EDITOR=vim
-

- -

Set rvim as default on sudo config;

- -

-        # visudo
-
-        Defaults editor=/usr/bin/rvim
-

- -

Once sudo is correctly configured, disable root login;

- -

-        # passwd --lock root
-

- -

1.5 Auditd

- -

-        $ prt-get depinst audit
-

- -

Example audit when file /etc/passwd get modified;

- -

-        $ auditctl -w /etc/passwd -p wa -k passwd_changes
-

- -

Audit when a module get's loaded;

- -

-        # auditctl -w /sbin/insmod -p x -k module_insertion
-

- -

1.6 Network

- -

Find listening services with command;

- -

-        # ss -tulpn
-        # nmap -sT -O localhost
-        # nmap -sT -O machine.example.org
-

- -

2.6.0.2 Lynis

- -

-        $ sudo prt-get depinst lynis
-

- -

Lynis gives a view of system overall configuration, - without changing default profile it runs irrelevant tests. - Create a lynis profile by coping default one and run lynis;

- -

-        $ sudo cp /etc/lynis/default.prf /etc/lynis/custom.prf
-        $ sudo lynis configure settings color=yes
-        $ sudo lynis show settings
-        $ sudo lynis show profile
-

- -

-        $ lynis audit system > lynis_report
-        $ mv /tmp/lynis.log .
-        $ mv /tmp/lynis-report.dat .
-

- -

Add unnecessary tests to profile to have less noise.

- - Core OS Index -

- - - -- cgit 1.4.1-2-gfad0