Change directory layout. fix #48
This change gets rid of the separate role dir and puts everything into the root-directory, making it possible to install the role via ansible galaxy.
This commit is contained in:
Sebastian Gumprich committed
1 parent
d47e64f70d
commit
7eb8b4f3d3
30 files changed
+3
-2
No files matched your search
@@ -1,30 +0,0 @@
|
||||
os_desktop_enable: false
|
||||
os_env_extra_user_paths: []
|
||||
os_env_umask: '027'
|
||||
os_auth_pw_max_age: 60
|
||||
os_auth_pw_min_age: 7 # discourage password cycling
|
||||
os_auth_retries: 5
|
||||
os_auth_lockout_time: 600 # 10min
|
||||
os_auth_timeout: 60
|
||||
os_auth_allow_homeless: false
|
||||
os_auth_pam_passwdqc_enable: true
|
||||
os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8'
|
||||
os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
|
||||
os_auth_uid_min: 1000
|
||||
os_auth_gid_min: 1000
|
||||
os_chfn_restrict: ''
|
||||
# may contain: change_user
|
||||
os_security_users_allow: []
|
||||
# specify system accounts those login should not be disabled and password not changed
|
||||
os_ignore_users: ['vagrant']
|
||||
os_security_kernel_enable_module_loading: true
|
||||
os_security_kernel_enable_core_dump: false
|
||||
os_security_suid_sgid_enforce: true
|
||||
# user-defined blacklist and whitelist
|
||||
os_security_suid_sgid_blacklist: []
|
||||
os_security_suid_sgid_whitelist: []
|
||||
# if this is true, remove any suid/sgid bits from files that were not in the whitelist
|
||||
os_security_suid_sgid_remove_from_unknown: false
|
||||
|
||||
# remove packages with known issues
|
||||
os_security_packages_clean: true
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
|
||||
- name: create limits.d-directory if it does not exist
|
||||
file: path='/etc/security/limits.d' owner=root group=root mode=0755 state=directory
|
||||
when: os_security_kernel_enable_core_dump
|
||||
|
||||
- name: create sane limits.conf
|
||||
template: src='limits.conf.j2' dest='/etc/security/limits.d/10.hardcore.conf' owner=root group=root mode=0440
|
||||
when: os_security_kernel_enable_core_dump
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
- name: create login.defs
|
||||
template: src='login.defs.j2' dest='/etc/login.defs' owner=root group=root mode=0444
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
---
|
||||
- name: add the OS specific variables
|
||||
include_vars: "{{ ansible_os_family }}.yml"
|
||||
tags: always
|
||||
|
||||
- include: limits.yml tags=limits
|
||||
- include: login_defs.yml tags=login_defs
|
||||
- include: minimize_access.yml tags=minimize_acces
|
||||
- include: pam.yml tags=pam
|
||||
- include: profile.yml tags=profile
|
||||
- include: securetty.yml tags=securetty
|
||||
- include: suid_sgid.yml tags=suid_sgid
|
||||
when: os_security_suid_sgid_enforce
|
||||
|
||||
- include: sysctl.yml tags=sysctl
|
||||
- include: user_accounts.yml tags=user_accounts
|
||||
- include: rhosts.yml tags=rhosts
|
||||
|
||||
- include: yum.yml tags=yum
|
||||
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
- name: minimize access
|
||||
file: path='{{item}}' mode='go-w' recurse=yes
|
||||
with_items:
|
||||
- '/usr/local/sbin'
|
||||
- '/usr/local/bin'
|
||||
- '/usr/sbin'
|
||||
- '/usr/bin'
|
||||
- '/sbin'
|
||||
- '/bin'
|
||||
- '{{os_env_extra_user_paths}}'
|
||||
|
||||
- name: change shadow ownership to root and mode to 0600 | DTAG SEC Req 3.21-7
|
||||
file: dest='/etc/shadow' owner=root group=root mode=0600
|
||||
|
||||
- name: change su-binary to only be accessible to user and group root
|
||||
file: dest='/bin/su' owner=root group=root mode=0750
|
||||
when: os_security_users_allow != None
|
||||
@@ -1,61 +0,0 @@
|
||||
---
|
||||
- name: update pam on Debian systems
|
||||
command: 'pam-auth-update --package'
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
changed_when: False
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
|
||||
- name: remove pam ccreds on Debian systems
|
||||
apt: name='{{os_packages_pam_ccreds}}' state=absent
|
||||
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
|
||||
|
||||
- name: remove pam ccreds on Redhat systems
|
||||
yum: name='{{os_packages_pam_ccreds}}' state=absent
|
||||
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
|
||||
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
apt: name='{{os_packages_pam_cracklib}}' state=absent
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
apt: name='{{os_packages_pam_passwdqc}}' state='installed'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc
|
||||
template: src='pam_passwdqd.j2' mode=0640 owner=root group=root dest='{{passwdqc_path}}'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
apt: name='{{os_packages_pam_passwdqc}}' state='absent'
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install tally2
|
||||
apt: name='libpam-modules' state=installed
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
|
||||
|
||||
- name: configure tally2
|
||||
template: src='pam_tally2.j2' dest='{{tally2_path}}' mode=0640 owner=root group=root
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries > 0
|
||||
|
||||
- name: delete tally2 when retries is 0
|
||||
file: path='{{tally2_path}}' state=absent
|
||||
when: (ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu') and not os_auth_pam_passwdqc_enable and os_auth_retries == 0
|
||||
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
yum: name='{{os_packages_pam_cracklib}}' state=absent
|
||||
when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux') and os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
yum: name='{{os_packages_pam_passwdqc}}' state='installed'
|
||||
when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux') and os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
yum: name='{{os_packages_pam_passwdqc}}' state='absent'
|
||||
when: (ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux') and not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc and tally via central system-auth confic
|
||||
template: src='rhel_system_auth.j2' dest='/etc/pam.d/system-auth-ac' mode=0640 owner=root group=root
|
||||
|
||||
- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
||||
template: src='rhel_libuser.conf.j2' dest='/etc/libuser.conf' mode=0640 owner=root group=root
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
- name: create profile.conf
|
||||
template: src='profile.conf.j2' dest='/etc/profile.d/pinerolo_profile.sh' owner=root group=root mode=0750
|
||||
when: not os_security_kernel_enable_core_dump
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Get user accounts | DTAG SEC Req 3.21-4
|
||||
command: "awk -F: '{print $1}' /etc/passwd"
|
||||
changed_when: False
|
||||
register: users
|
||||
|
||||
- name: delete rhosts-files from system | DTAG SEC Req 3.21-4
|
||||
file: dest='~{{ item }}/.rhosts' state=absent
|
||||
with_items: users.stdout_lines
|
||||
|
||||
- name: delete hosts.equiv from system | DTAG SEC Req 3.21-4
|
||||
file: dest='/etc/hosts.equiv' state=absent
|
||||
@@ -1,3 +0,0 @@
|
||||
---
|
||||
- name: create securetty
|
||||
template: src='securetty.j2' dest='/etc/securetty' owner=root group=root mode=0400
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
- name: remove suid/sgid bit from binaries in blacklist
|
||||
file: path='{{item}}' mode='a-s' state=file follow=yes
|
||||
ignore_errors: true
|
||||
with_items:
|
||||
- '{{ os_security_suid_sgid_system_blacklist }}'
|
||||
- '{{ os_security_suid_sgid_blacklist }}'
|
||||
|
||||
- name: find binaries with suid/sgid set
|
||||
shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
|
||||
register: sbit_binaries
|
||||
when: os_security_suid_sgid_remove_from_unknown
|
||||
changed_when: False
|
||||
|
||||
- name: gather files from which to remove suids/sgids and remove system white-listed files
|
||||
set_fact:
|
||||
suid: '{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}'
|
||||
when: os_security_suid_sgid_remove_from_unknown
|
||||
|
||||
- name: remove suid/sgid bit from all binaries except in system and user whitelist
|
||||
file: path='{{item}}' mode='a-s' state=file follow=yes
|
||||
with_items:
|
||||
- '{{ suid | difference(os_security_suid_sgid_whitelist) }}'
|
||||
when: os_security_suid_sgid_remove_from_unknown
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
|
||||
- name: include sysctl variables
|
||||
include_vars: sysctl.yml
|
||||
|
||||
- name: protect sysctl.conf
|
||||
file: path='/etc/sysctl.conf' owner=root group=root mode=0440
|
||||
|
||||
- name: NSA 2.2.4.1 Set Daemon umask, do config for rhel-family
|
||||
template: src='rhel_sysconfig_init.j2' dest='/etc/sysconfig/init' owner=root group=root mode=0544
|
||||
when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
|
||||
|
||||
- name: rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
|
||||
template: src='modules.j2' dest='/etc/initramfs-tools/modules' owner=root group=root mode=0440
|
||||
when: ansible_os_family == 'Debian' and os_security_kernel_enable_module_loading
|
||||
register: initramfs
|
||||
|
||||
- name: update-initramfs
|
||||
command: 'update-initramfs -u'
|
||||
when: initramfs.changed
|
||||
|
||||
- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
|
||||
sysctl:
|
||||
name: '{{ item.key }}'
|
||||
value: '{{ item.value }}'
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
ignoreerrors: yes
|
||||
with_dict: sysctl_config
|
||||
|
||||
- name: Change various sysctl-settings on rhel-hosts, look at the sysctl-vars file for documentation
|
||||
sysctl:
|
||||
name: '{{ item.key }}'
|
||||
value: '{{ item.value }}'
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
ignoreerrors: yes
|
||||
with_dict: sysctl_rhel_config
|
||||
when: ansible_distribution == 'RedHat' or ansible_distribution == 'Fedora' or ansible_distribution == 'CentOS'
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
|
||||
- name: get UID_MIN from login.defs
|
||||
shell: awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs removes=/etc/login.defs
|
||||
register: uid_min
|
||||
changed_when: False
|
||||
|
||||
- name: calculate UID_MAX from UID_MIN by substracting 1
|
||||
set_fact: uid_max='{{ uid_min.stdout | int - 1 }}'
|
||||
when: uid_min is defined
|
||||
|
||||
- name: set UID_MAX on Debian-systems if no login.defs exist
|
||||
set_fact: uid_max='999'
|
||||
when: ansible_os_family == 'Debian' and not uid_min
|
||||
|
||||
- name: set UID_MAX on other systems if no login.defs exist
|
||||
set_fact: uid_max='499'
|
||||
when: not uid_min
|
||||
|
||||
- name: get all system accounts
|
||||
command: awk -F'':'' '{ if ( $3 <= {{uid_max|quote}} ) print $1}' /etc/passwd removes=/etc/passwd
|
||||
changed_when: False
|
||||
register: sys_accs
|
||||
|
||||
- name: remove always ignored system accounts from list
|
||||
set_fact:
|
||||
sys_accs_cond: '{{sys_accs.stdout_lines | difference(os_always_ignore_users) }}'
|
||||
|
||||
- name: change system accounts not on the user provided ignore-list
|
||||
user: name='{{ item }}' shell='{{os_nologin_shell_path}}' password='*'
|
||||
with_items:
|
||||
- '{{sys_accs_cond | difference(os_ignore_users) }}'
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
- name: remove unused repositories
|
||||
file: name='/etc/yum.repos.d/{{item}}.repo' state=absent
|
||||
with_items:
|
||||
- 'CentOS-Debuginfo'
|
||||
- 'CentOS-Media'
|
||||
- 'CentOS-Vault'
|
||||
when: os_security_packages_clean
|
||||
|
||||
- name: get yum-repository-files
|
||||
shell: 'find /etc/yum.repos.d/ -type f -name *.repo'
|
||||
changed_when: False
|
||||
register: yum_repos
|
||||
|
||||
- name: check if rhnplugin.conf exists
|
||||
stat: path='/etc/yum/pluginconf.d/rhnplugin.conf'
|
||||
register: rhnplugin_file
|
||||
|
||||
- name: activate gpg-check for yum-repos
|
||||
replace: dest='{{item}}' regexp='^\s*gpgcheck=0' replace='gpgcheck=1'
|
||||
with_items:
|
||||
- '{{ yum_repos.stdout_lines }}'
|
||||
- '/etc/yum.conf'
|
||||
|
||||
- name: activate gpg-check for yum rhn if it exists
|
||||
replace: dest='/etc/yum/pluginconf.d/rhnplugin.conf' regexp='^\s*gpgcheck=0' replace='gpgcheck=1'
|
||||
when: rhnplugin_file.stat.exists
|
||||
|
||||
- name: remove packages
|
||||
yum: name='{{item}}' state=removed
|
||||
with_items:
|
||||
- xinetd
|
||||
- inetd
|
||||
- ypserv
|
||||
- telnet-server
|
||||
- rsh-server
|
||||
when: os_security_packages_clean
|
||||
@@ -1,3 +0,0 @@
|
||||
# {{ansible_managed}}
|
||||
# Prevent core dumps for all users. These are usually only needed by developers and may contain sensitive information.
|
||||
* hard core 0
|
||||
@@ -1,210 +0,0 @@
|
||||
# Configuration control definitions for the login package.
|
||||
#
|
||||
# Three items must be defined: `MAIL_DIR`, `ENV_SUPATH`, and `ENV_PATH`. If unspecified, some arbitrary (and possibly incorrect) value will be assumed. All other items are optional - if not specified then the described action or option will be inhibited.
|
||||
#
|
||||
# Comment lines (lines beginning with `#`) and blank lines are ignored.
|
||||
#
|
||||
#-- Modified for Linux. --marekm
|
||||
|
||||
# *REQUIRED for useradd/userdel/usermod*
|
||||
#
|
||||
# Directory where mailboxes reside, _or_ name of file, relative to the home directory. If you _do_ define `MAIL_DIR` and `MAIL_FILE`, `MAIL_DIR` takes precedence.
|
||||
# Essentially:
|
||||
#
|
||||
# * `MAIL_DIR` defines the location of users mail spool files (for mbox use) by appending the username to `MAIL_DIR` as defined below.
|
||||
# * `MAIL_FILE` defines the location of the users mail spool files as the fully-qualified filename obtained by prepending the user home directory before `$MAIL_FILE`
|
||||
#
|
||||
# *NOTE*: This is no more used for setting up users MAIL environment variable which is, starting from shadow 4.0.12-1 in Debian, entirely the job of the pam_mail PAM modules.
|
||||
#
|
||||
# See default PAM configuration files provided for login, su, etc.
|
||||
# This is a temporary situation: setting these variables will soon move to `/etc/default/useradd` and the variables will then be no more supported
|
||||
MAIL_DIR /var/mail
|
||||
#MAIL_FILE .mail
|
||||
|
||||
# Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
|
||||
FAILLOG_ENAB yes
|
||||
|
||||
# Enable display of unknown usernames when login failures are recorded.
|
||||
#
|
||||
# *WARNING*: Unknown usernames may become world readable. See #290803 and #298773 for details about how this could become a security concern
|
||||
LOG_UNKFAIL_ENAB no
|
||||
|
||||
# Enable logging of successful logins
|
||||
LOG_OK_LOGINS yes
|
||||
|
||||
# Enable "syslog" logging of su activity - in addition to sulog file logging.
|
||||
SYSLOG_SU_ENAB yes
|
||||
|
||||
# Enable "syslog" logging of newgrp and sg.
|
||||
SYSLOG_SG_ENAB yes
|
||||
|
||||
# If defined, all su activity is logged to this file.
|
||||
#SULOG_FILE /var/log/sulog
|
||||
|
||||
# If defined, file which maps tty line to `TERM` environment parameter. Each line of the file is in a format something like "vt100 tty01".
|
||||
#TTYTYPE_FILE /etc/ttytype
|
||||
|
||||
# If defined, login failures will be logged here in a utmp format last, when invoked as lastb, will read `/var/log/btmp`, so...
|
||||
FTMP_FILE /var/log/btmp
|
||||
|
||||
# If defined, the command name to display when running "su -". For # example, if this is defined as "su" then a "ps" will display the command is "-su". If not defined, then "ps" would display the name of the shell actually being run, e.g. something like "-sh".
|
||||
SU_NAME su
|
||||
|
||||
# If defined, file which inhibits all the usual chatter during the login sequence. If a full pathname, then hushed mode will be enabled if the user's name or shell are found in the file. If not a full pathname, then hushed mode will be enabled if the file exists in the user's home directory.
|
||||
#HUSHLOGIN_FILE /etc/hushlogins
|
||||
HUSHLOGIN_FILE .hushlogin
|
||||
|
||||
# *REQUIRED*: The default PATH settings, for superuser and normal users. (they are minimal, add the rest in the shell startup files)
|
||||
ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin{{ os_env_extra_user_paths| join (':') }}
|
||||
|
||||
# Terminal permissions
|
||||
# --------------------
|
||||
|
||||
# Login tty will be assigned this group ownership.
|
||||
# If you have a "write" program which is "setgid" to a special group which owns the terminals, define `TTYGROUP` to the group number and `TTYPERM` to `0620`. Otherwise leave `TTYGROUP` commented out and assign `TTYPERM` to either `622` or `600`.
|
||||
TTYGROUP tty
|
||||
|
||||
# Login tty will be set to this permission.
|
||||
# In Debian `/usr/bin/bsd-write` or similar programs are setgid tty. However, the default and recommended value for `TTYPERM` is still `0600` to not allow anyone to write to anyone else console or terminal
|
||||
# Users can still allow other people to write them by issuing the `mesg y` command.
|
||||
TTYPERM 0600
|
||||
|
||||
# Login conf initializations
|
||||
# --------------------------
|
||||
|
||||
# Terminal ERASE character ('\010' = backspace). Only used on System V.
|
||||
ERASECHAR 0177
|
||||
|
||||
# Terminal KILL character ('\025' = CTRL/U). Only used on System V.
|
||||
KILLCHAR 025
|
||||
|
||||
# The default umask value for `pam_umask` and is used by useradd and newusers to set the mode of the new home directories.
|
||||
# If `USERGROUPS_ENAB` is set to `yes`, that will modify this `UMASK` default value for private user groups, i. e. the uid is the same as gid, and username is the same as the primary group name: for these, the user permissions will be used as group permissions, e. g. `022` will become `002`.
|
||||
# Prefix these values with `0` to get octal, `0x` to get hexadecimal.
|
||||
# `022` is the "historical" value in Debian for UMASK
|
||||
# `027`, or even `077`, could be considered better for privacy.
|
||||
UMASK {{os_env_umask}}
|
||||
|
||||
# Enable setting of the umask group bits to be the same as owner bits (examples: `022` -> `002`, `077` -> `007`) for non-root users, if the uid is the same as gid, and username is the same as the primary group name.
|
||||
# If set to yes, userdel will remove the user´s group if it contains no more members, and useradd will create by default a group with the name of the user.
|
||||
USERGROUPS_ENAB yes
|
||||
|
||||
|
||||
# Password aging controls
|
||||
# -----------------------
|
||||
|
||||
# Maximum number of days a password may be used.
|
||||
PASS_MAX_DAYS {{os_auth_pw_max_age}}
|
||||
|
||||
# Minimum number of days allowed between password changes.
|
||||
PASS_MIN_DAYS {{os_auth_pw_min_age}}
|
||||
|
||||
# Number of days warning given before a password expires.
|
||||
PASS_WARN_AGE 7
|
||||
|
||||
# Min/max values for automatic uid selection in useradd
|
||||
UID_MIN {{os_auth_uid_min}}
|
||||
UID_MAX 60000
|
||||
# System accounts
|
||||
#SYS_UID_MIN 100
|
||||
#SYS_UID_MAX 999
|
||||
|
||||
# Min/max values for automatic gid selection in groupadd
|
||||
GID_MIN {{os_auth_gid_min}}
|
||||
GID_MAX 60000
|
||||
# System accounts
|
||||
#SYS_GID_MIN 100
|
||||
#SYS_GID_MAX 999
|
||||
|
||||
# Max number of login retries if password is bad. This will most likely be overriden by PAM, since the default pam_unix module has it's own built in of 3 retries. However, this is a safe fallback in case you are using an authentication module that does not enforce PAM_MAXTRIES.
|
||||
LOGIN_RETRIES {{os_auth_retries}}
|
||||
|
||||
# Max time in seconds for login
|
||||
LOGIN_TIMEOUT {{os_auth_timeout}}
|
||||
|
||||
# Which fields may be changed by regular users using chfn - use any combination of letters "frwh" (full name, room number, work phone, home phone). If not defined, no changes are allowed.
|
||||
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
|
||||
{% if os_chfn_restrict %}
|
||||
CHFN_RESTRICT {{ os_chfn_restrict }}
|
||||
{% endif %}
|
||||
# Should login be allowed if we can't cd to the home directory?
|
||||
DEFAULT_HOME {{ 'yes' if os_auth_allow_homeless else 'no' }}
|
||||
|
||||
# If defined, this command is run when removing a user.
|
||||
# It should remove any at/cron/print jobs etc. owned by
|
||||
# the user to be removed (passed as the first argument).
|
||||
#USERDEL_CMD /usr/sbin/userdel_local
|
||||
|
||||
# Instead of the real user shell, the program specified by this parameter will be launched, although its visible name (`argv[0]`) will be the shell's. The program may do whatever it wants (logging, additional authentification, banner, ...) before running the actual shell.
|
||||
#FAKE_SHELL /bin/fakeshell
|
||||
|
||||
# If defined, either full pathname of a file containing device names or a ":" delimited list of device names. Root logins will be allowed only upon these devices.
|
||||
# This variable is used by login and su.
|
||||
#CONSOLE /etc/consoles
|
||||
#CONSOLE console:tty01:tty02:tty03:tty04
|
||||
|
||||
# List of groups to add to the user's supplementary group set when logging in on the console (as determined by the `CONSOLE` setting). Default is none.
|
||||
# Use with caution - it is possible for users to gain permanent access to these groups, even when not logged in on the console. How to do it is left as an exercise for the reader...
|
||||
# This variable is used by login and su.
|
||||
#CONSOLE_GROUPS floppy:audio:cdrom
|
||||
|
||||
# If set to `MD5`, MD5-based algorithm will be used for encrypting password
|
||||
# If set to `SHA256`, SHA256-based algorithm will be used for encrypting password
|
||||
# If set to `SHA512`, SHA512-based algorithm will be used for encrypting password
|
||||
# If set to `DES`, DES-based algorithm will be used for encrypting password (default)
|
||||
# Overrides the MD5_CRYPT_ENAB option
|
||||
#
|
||||
# Note: It is recommended to use a value consistent with
|
||||
# the PAM modules configuration.
|
||||
MD5_CRYPT_ENAB no
|
||||
ENCRYPT_METHOD SHA512
|
||||
|
||||
# Only used if `ENCRYPT_METHOD` is set to `SHA256` or `SHA512`: Define the number of SHA rounds.
|
||||
# With a lot of rounds, it is more difficult to brute forcing the password. But note also that it more CPU resources will be needed to authenticate users.
|
||||
# If not specified, the libc will choose the default number of rounds (5000). The values must be inside the 1000-999999999 range. If only one of the MIN or MAX values is set, then this value will be used.
|
||||
# If MIN > MAX, the highest value will be used.
|
||||
#SHA_CRYPT_MIN_ROUNDS 5000
|
||||
#SHA_CRYPT_MAX_ROUNDS 5000
|
||||
|
||||
|
||||
# Obsoleted by PAM
|
||||
# ================
|
||||
# These options are now handled by PAM. Please edit the appropriate file in `/etc/pam.d/` to enable the equivelants of them.
|
||||
#MOTD_FILE
|
||||
#DIALUPS_CHECK_ENAB
|
||||
#LASTLOG_ENAB
|
||||
#MAIL_CHECK_ENAB
|
||||
#OBSCURE_CHECKS_ENAB
|
||||
#PORTTIME_CHECKS_ENAB
|
||||
#SU_WHEEL_ONLY
|
||||
#CRACKLIB_DICTPATH
|
||||
#PASS_CHANGE_TRIES
|
||||
#PASS_ALWAYS_WARN
|
||||
#ENVIRON_FILE
|
||||
#NOLOGINS_FILE
|
||||
#ISSUE_FILE
|
||||
#PASS_MIN_LEN
|
||||
#PASS_MAX_LEN
|
||||
#ULIMIT
|
||||
#ENV_HZ
|
||||
#CHFN_AUTH
|
||||
#CHSH_AUTH
|
||||
#FAIL_DELAY
|
||||
|
||||
# Obsoleted
|
||||
# =========
|
||||
# These options are no more handled by shadow.
|
||||
# Shadow utilities will display a warning if they still appear.
|
||||
#CLOSE_SESSIONS
|
||||
#LOGIN_STRING
|
||||
#NO_PASSWORD_CONSOLE
|
||||
#QMAIL_DIR
|
||||
|
||||
# If set to `yes`, new passwords will be encrypted using the MD5-based algorithm compatible with the one used by recent releases of FreeBSD. It supports passwords of unlimited length and longer salt strings.
|
||||
# Set to `no` if you need to copy encrypted passwords to other systems which don't understand the new algorithm. Default is `no`.
|
||||
# This variable is deprecated. You should use ENCRYPT_METHOD.
|
||||
#
|
||||
#MD5_CRYPT_ENAB no
|
||||
|
||||
|
||||
@@ -1,111 +0,0 @@
|
||||
# {{ ansible_managed }}
|
||||
# This file contains the names of kernel modules that should be loaded at boot time, one per line. Lines beginning with "#" are ignored.
|
||||
#
|
||||
# A list of all available kernel modules kann be found with `find /lib/modules/$(uname -r)/kernel/`
|
||||
# We will sort by folder.
|
||||
|
||||
|
||||
# Arch
|
||||
# ----
|
||||
#
|
||||
# Modules for certains builds, contains support modules and some CPU-specific optimizations.
|
||||
|
||||
{% if ansible_architecture == 'x86_64' %}
|
||||
# Optimize for x86_64 cryptographic features
|
||||
twofish-x86_64-3way
|
||||
twofish-x86_64
|
||||
aes-x86_64
|
||||
salsa20-x86_64
|
||||
blowfish-x86_64
|
||||
{% endif %}
|
||||
|
||||
{% if 'amd' in ansible_processor %}
|
||||
# AMD-specific optimizations
|
||||
kvm-amd
|
||||
{% else %}
|
||||
# Intel-specific optimizations
|
||||
ghash-clmulni-intel
|
||||
aesni-intel
|
||||
kvm-intel
|
||||
{% endif %}
|
||||
|
||||
kvm
|
||||
|
||||
# Crypto
|
||||
# ------
|
||||
|
||||
# Some core modules which comprise strong cryptography.
|
||||
blowfish_common
|
||||
blowfish_generic
|
||||
ctr
|
||||
cts
|
||||
lrw
|
||||
lzo
|
||||
rmd160
|
||||
rmd256
|
||||
rmd320
|
||||
serpent
|
||||
sha512_generic
|
||||
twofish_common
|
||||
twofish_generic
|
||||
xts
|
||||
zlib
|
||||
|
||||
|
||||
# Drivers
|
||||
# -------
|
||||
|
||||
# Basics
|
||||
lp
|
||||
rtc
|
||||
loop
|
||||
|
||||
# Filesystems
|
||||
ext2
|
||||
btrfs
|
||||
|
||||
{% if os_desktop_enable %}
|
||||
# Desktop
|
||||
psmouse
|
||||
snd
|
||||
snd_ac97_codec
|
||||
snd_intel8x0
|
||||
snd_page_alloc
|
||||
snd_pcm
|
||||
snd_timer
|
||||
soundcore
|
||||
usbhid
|
||||
{% endif %}
|
||||
|
||||
# Lib
|
||||
# ---
|
||||
xz
|
||||
|
||||
|
||||
# Net
|
||||
# ---
|
||||
|
||||
# All packets needed for netfilter rules (ie iptables, ebtables).
|
||||
ip_tables
|
||||
x_tables
|
||||
iptable_filter
|
||||
iptable_nat
|
||||
|
||||
# Targets
|
||||
ipt_LOG
|
||||
ipt_REJECT
|
||||
|
||||
# Modules
|
||||
xt_connlimit
|
||||
xt_tcpudp
|
||||
xt_recent
|
||||
xt_limit
|
||||
xt_conntrack
|
||||
nf_conntrack
|
||||
nf_conntrack_ipv4
|
||||
nf_defrag_ipv4
|
||||
xt_state
|
||||
nf_nat
|
||||
|
||||
# Addons
|
||||
xt_pknock
|
||||
@@ -1,7 +0,0 @@
|
||||
passwdqc.erbName: passwdqc password strength enforcement
|
||||
Default: yes
|
||||
Priority: 1024
|
||||
Conflicts: cracklib
|
||||
Password-Type: Primary
|
||||
Password:
|
||||
requisite pam_passwdqc.so {{os_auth_pam_passwdqc_options}}
|
||||
@@ -1,10 +0,0 @@
|
||||
Name: tally2 lockout after failed attempts enforcement
|
||||
Default: yes
|
||||
Priority: 1024
|
||||
Conflicts: cracklib
|
||||
Auth-Type: Primary
|
||||
Auth-Initial:
|
||||
required pam_tally2.so deny={{os_auth_retries}} onerr=fail unlock_time={{os_auth_lockout_time}}
|
||||
Account-Type: Primary
|
||||
Account-Initial:
|
||||
required pam_tally2.so
|
||||
@@ -1,4 +0,0 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# Disable core dumps via soft limits for all users. Compliance to this setting is voluntary and can be modified by users up to a hard limit. This setting is a sane default.
|
||||
ulimit -S -c 0 > /dev/null 2>&1
|
||||
@@ -1,90 +0,0 @@
|
||||
# See libuser.conf(5) for more information.
|
||||
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# Do not modify the default module list if you care about unattended calls
|
||||
# to programs (i.e., scripts) working!
|
||||
|
||||
[import]
|
||||
# Data from these files is used when libuser.conf does not define a value.
|
||||
# The mapping is documented in the man page.
|
||||
login_defs = /etc/login.defs
|
||||
default_useradd = /etc/default/useradd
|
||||
|
||||
[defaults]
|
||||
# The default (/usr/lib*/libuser) is usually correct
|
||||
# moduledir = /your/custom/directory
|
||||
|
||||
# The following variables are usually imported:
|
||||
# skeleton = /etc/skel
|
||||
# mailspooldir = /var/mail
|
||||
|
||||
# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
||||
crypt_style = sha512
|
||||
|
||||
modules = files shadow
|
||||
create_modules = files shadow
|
||||
# modules = files shadow ldap
|
||||
# create_modules = ldap
|
||||
|
||||
[userdefaults]
|
||||
LU_USERNAME = %n
|
||||
# LU_UIDNUMBER = 500
|
||||
LU_GIDNUMBER = %u
|
||||
# LU_USERPASSWORD = !!
|
||||
# LU_GECOS = %n
|
||||
# LU_HOMEDIRECTORY = /home/%n
|
||||
# LU_LOGINSHELL = /bin/bash
|
||||
|
||||
# LU_SHADOWNAME = %n
|
||||
# LU_SHADOWPASSWORD = !!
|
||||
# LU_SHADOWLASTCHANGE = %d
|
||||
# LU_SHADOWMIN = 0
|
||||
# LU_SHADOWMAX = 99999
|
||||
# LU_SHADOWWARNING = 7
|
||||
# LU_SHADOWINACTIVE = -1
|
||||
# LU_SHADOWEXPIRE = -1
|
||||
# LU_SHADOWFLAG = -1
|
||||
|
||||
[groupdefaults]
|
||||
LU_GROUPNAME = %n
|
||||
# LU_GIDNUMBER = 500
|
||||
# LU_GROUPPASSWORD = !!
|
||||
# LU_MEMBERUID =
|
||||
# LU_ADMINISTRATORUID =
|
||||
|
||||
[files]
|
||||
# This is useful for the case where some master files are used to
|
||||
# populate a different NSS mechanism which this workstation uses.
|
||||
# directory = /etc
|
||||
|
||||
[shadow]
|
||||
# This is useful for the case where some master files are used to
|
||||
# populate a different NSS mechanism which this workstation uses.
|
||||
# directory = /etc
|
||||
|
||||
[ldap]
|
||||
# Setting these is always necessary.
|
||||
# server = ldap
|
||||
# basedn = dc=example,dc=com
|
||||
|
||||
# Setting these is rarely necessary, since it's usually correct.
|
||||
# userBranch = ou=People
|
||||
# groupBranch = ou=Group
|
||||
|
||||
# Set only if your administrative user uses simple bind operations to
|
||||
# connect to the server.
|
||||
# binddn = cn=Manager,dc=example,dc=com
|
||||
|
||||
# Set this only if the default user (as determined by SASL) is incorrect
|
||||
# for SASL bind operations. Usually, it's correct, so you'll rarely need
|
||||
# to set these.
|
||||
# user = Manager
|
||||
# authuser = Manager
|
||||
|
||||
[sasl]
|
||||
# Set these only if your sasldb is only used by a particular application, and
|
||||
# in a particular domain. The default (all applications, all domains) is
|
||||
# probably correct for most installations.
|
||||
# appname = imap
|
||||
# domain = EXAMPLE.COM
|
||||
@@ -1,31 +0,0 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
# color => new RH6.0 bootup
|
||||
# verbose => old-style bootup
|
||||
# anything else => new style bootup without ANSI colors or positioning
|
||||
BOOTUP=color
|
||||
# column to start "[ OK ]" label in
|
||||
RES_COL=60
|
||||
# terminal sequence to move to that column. You could change this
|
||||
# to something like "tput hpa ${RES_COL}" if your terminal supports it
|
||||
MOVE_TO_COL="echo -en \\033[${RES_COL}G"
|
||||
# terminal sequence to set color to a 'success' color (currently: green)
|
||||
SETCOLOR_SUCCESS="echo -en \\033[0;32m"
|
||||
# terminal sequence to set color to a 'failure' color (currently: red)
|
||||
SETCOLOR_FAILURE="echo -en \\033[0;31m"
|
||||
# terminal sequence to set color to a 'warning' color (currently: yellow)
|
||||
SETCOLOR_WARNING="echo -en \\033[0;33m"
|
||||
# terminal sequence to reset to the default color.
|
||||
SETCOLOR_NORMAL="echo -en \\033[0;39m"
|
||||
# Set to anything other than 'no' to allow hotkey interactive startup...
|
||||
PROMPT=yes
|
||||
# Set to 'yes' to allow probing for devices with swap signatures
|
||||
AUTOSWAP=no
|
||||
# What ttys should gettys be started on?
|
||||
ACTIVE_CONSOLES=/dev/tty[1-6]
|
||||
# Set to '/sbin/sulogin' to prompt for password on single-user mode
|
||||
# Set to '/sbin/sushell' otherwise
|
||||
SINGLE=/sbin/sushell
|
||||
|
||||
# NSA 2.2.4.1 Set Daemon umask
|
||||
umask 027
|
||||
@@ -1,35 +0,0 @@
|
||||
# {{ ansible_managed }}
|
||||
#---
|
||||
|
||||
#%PAM-1.0
|
||||
{% if os_auth_retries > 0 %}
|
||||
auth required pam_tally2.so deny={{os_auth_retries}} onerr=fail unlock_time={{os_auth_lockout_time}}
|
||||
{% endif %}
|
||||
auth required pam_env.so
|
||||
auth sufficient pam_unix.so nullok try_first_pass
|
||||
auth requisite pam_succeed_if.so uid >= 500 quiet
|
||||
auth required pam_deny.so
|
||||
|
||||
{% if os_auth_retries > 0 %}
|
||||
account required pam_tally2.so
|
||||
{% endif %}
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_succeed_if.so uid < 500 quiet
|
||||
account required pam_permit.so
|
||||
|
||||
{% if os_auth_pam_passwdqc_enable %}
|
||||
password requisite pam_passwdqc.so {{os_auth_pam_passwdqc_options}}
|
||||
{% else %}
|
||||
password requisite pam_cracklib.so try_first_pass retry=3 type=
|
||||
{% endif %}
|
||||
|
||||
# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
||||
# NSA 2.3.3.6 Limit Password Reuse
|
||||
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session required pam_unix.so
|
||||
@@ -1,6 +0,0 @@
|
||||
# {{ ansible_managed }}
|
||||
|
||||
|
||||
# A list of TTYs, from which root can log in
|
||||
# see `man securetty` for reference
|
||||
{{ "\n".join(os_auth_root_ttys) }}
|
||||
@@ -1,6 +0,0 @@
|
||||
os_packages_pam_ccreds: 'libpam-ccreds'
|
||||
os_packages_pam_passwdqc: 'libpam-passwdqc'
|
||||
os_packages_pam_cracklib: 'libpam-cracklib'
|
||||
passwdqc_path: '/usr/share/pam-configs/passwdqc'
|
||||
tally2_path: '/usr/share/pam-configs/tally2'
|
||||
os_nologin_shell_path: '/usr/sbin/nologin'
|
||||
@@ -1,4 +0,0 @@
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'pam_cracklib'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
@@ -1,4 +0,0 @@
|
||||
os_packages_pam_ccreds: 'pam_ccreds'
|
||||
os_packages_pam_passwdqc: 'pam_passwdqc'
|
||||
os_packages_pam_cracklib: 'pam_cracklib'
|
||||
os_nologin_shell_path: '/sbin/nologin'
|
||||
@@ -1,111 +0,0 @@
|
||||
# SYSTEM CONFIGURATION
|
||||
# ====================
|
||||
# These are not meant to be modified by the user
|
||||
|
||||
# suid and sgid blacklists and whitelists
|
||||
# ---------------------------------------
|
||||
# don't change values in the system_blacklist/whitelist
|
||||
# adjust values for blacklist/whitelist instead, they can override system_blacklist/whitelist
|
||||
|
||||
# list of suid/sgid entries that must be removed
|
||||
os_security_suid_sgid_system_blacklist:
|
||||
# blacklist as provided by NSA
|
||||
- '/usr/bin/rcp'
|
||||
- '/usr/bin/rlogin'
|
||||
- '/usr/bin/rsh'
|
||||
# sshd must not use host-based authentication (see ssh cookbook)
|
||||
- '/usr/libexec/openssh/ssh-keysign'
|
||||
- '/usr/lib/openssh/ssh-keysign'
|
||||
# misc others
|
||||
- '/sbin/netreport' # not normally required for user
|
||||
- '/usr/sbin/usernetctl' # modify interfaces via functional accounts
|
||||
# connecting to ...
|
||||
- '/usr/sbin/userisdnctl' # no isdn...
|
||||
- '/usr/sbin/pppd' # no ppp / dsl ...
|
||||
# lockfile
|
||||
- '/usr/bin/lockfile'
|
||||
- '/usr/bin/mail-lock'
|
||||
- '/usr/bin/mail-unlock'
|
||||
- '/usr/bin/mail-touchlock'
|
||||
- '/usr/bin/dotlockfile'
|
||||
# need more investigation blacklist for now
|
||||
- '/usr/bin/arping'
|
||||
- '/usr/sbin/uuidd'
|
||||
- '/usr/bin/mtr' # investigate current state...
|
||||
- '/usr/lib/evolution/camel-lock-helper-1.2' # investigate current state...
|
||||
- '/usr/lib/pt_chown' # pseudo-tty needed?
|
||||
- '/usr/lib/eject/dmcrypt-get-device'
|
||||
- '/usr/lib/mc/cons.saver' # midnight commander screensaver
|
||||
|
||||
# list of suid/sgid entries that can remain untouched
|
||||
os_security_suid_sgid_system_whitelist:
|
||||
# whitelist as provided by NSA
|
||||
- '/bin/mount'
|
||||
- '/bin/ping'
|
||||
- '/bin/su'
|
||||
- '/bin/umount'
|
||||
- '/sbin/pam_timestamp_check'
|
||||
- '/sbin/unix_chkpwd'
|
||||
- '/usr/bin/at'
|
||||
- '/usr/bin/gpasswd'
|
||||
- '/usr/bin/locate'
|
||||
- '/usr/bin/newgrp'
|
||||
- '/usr/bin/passwd'
|
||||
- '/usr/bin/ssh-agent'
|
||||
- '/usr/libexec/utempter/utempter'
|
||||
- '/usr/sbin/lockdev'
|
||||
- '/usr/sbin/sendmail.sendmail'
|
||||
- '/usr/bin/expiry'
|
||||
# whitelist ipv6
|
||||
- '/bin/ping6'
|
||||
- '/usr/bin/traceroute6.iputils'
|
||||
# whitelist nfs
|
||||
- '/sbin/mount.nfs'
|
||||
- '/sbin/umount.nfs'
|
||||
# whitelist nfs4
|
||||
- '/sbin/mount.nfs4'
|
||||
- '/sbin/umount.nfs4'
|
||||
# whitelist cron
|
||||
- '/usr/bin/crontab'
|
||||
# whitelist consolemssaging
|
||||
- '/usr/bin/wall'
|
||||
- '/usr/bin/write'
|
||||
# whitelist: only SGID with utmp group for multi-session access
|
||||
# impact is limited; installation/usage has some remaining risk
|
||||
- '/usr/bin/screen'
|
||||
# whitelist locate
|
||||
- '/usr/bin/mlocate'
|
||||
# whitelist usermanagement
|
||||
- '/usr/bin/chage'
|
||||
- '/usr/bin/chfn'
|
||||
- '/usr/bin/chsh'
|
||||
# whitelist fuse
|
||||
- '/bin/fusermount'
|
||||
# whitelist pkexec
|
||||
- '/usr/bin/pkexec'
|
||||
# whitelist sudo
|
||||
- '/usr/bin/sudo'
|
||||
- '/usr/bin/sudoedit'
|
||||
# whitelist postfix
|
||||
- '/usr/sbin/postdrop'
|
||||
- '/usr/sbin/postqueue'
|
||||
# whitelist apache
|
||||
- '/usr/sbin/suexec'
|
||||
# whitelist squid
|
||||
- '/usr/lib/squid/ncsa_auth'
|
||||
- '/usr/lib/squid/pam_auth'
|
||||
# whitelist kerberos
|
||||
- '/usr/kerberos/bin/ksu'
|
||||
# whitelist pam_caching
|
||||
- '/usr/sbin/ccreds_validate'
|
||||
# whitelist Xorg
|
||||
- '/usr/bin/Xorg' # xorg
|
||||
- '/usr/bin/X' # xorg
|
||||
- '/usr/lib/dbus-1.0/dbus-daemon-launch-helper' # freedesktop ipc
|
||||
- '/usr/lib/vte/gnome-pty-helper' # gnome
|
||||
- '/usr/lib/libvte9/gnome-pty-helper' # gnome
|
||||
- '/usr/lib/libvte-2.90-9/gnome-pty-helper' # gnome
|
||||
|
||||
# system accounts that do not get their login disabled and pasword changed
|
||||
os_always_ignore_users: ['root','sync','shutdown','halt']
|
||||
|
||||
@@ -1,117 +0,0 @@
|
||||
sysctl_config:
|
||||
# Disable IPv4 traffic forwarding.
|
||||
net.ipv4.ip_forward: 0
|
||||
|
||||
# Disable IPv6 traffic forwarding.
|
||||
net.ipv6.conf.all.forwarding: 0
|
||||
|
||||
# ignore RAs on Ipv6.
|
||||
net.ipv6.conf.all.accept_ra: 0
|
||||
net.ipv6.conf.default.accept_ra: 0
|
||||
|
||||
# Enable RFC-recommended source validation feature.
|
||||
net.ipv4.conf.all.rp_filter: 1
|
||||
net.ipv4.conf.default.rp_filter: 1
|
||||
|
||||
# Reduce the surface on SMURF attacks.
|
||||
# Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
|
||||
net.ipv4.icmp_echo_ignore_broadcasts: 1
|
||||
|
||||
# There is no reason to accept bogus error responses from ICMP, so ignore them instead.
|
||||
net.ipv4.icmp_ignore_bogus_error_responses: 1
|
||||
|
||||
# Limit the amount of traffic the system uses for ICMP.
|
||||
net.ipv4.icmp_ratelimit: 100
|
||||
|
||||
# Adjust the ICMP ratelimit to include ping, dst unreachable,
|
||||
# source quench, ime exceed, param problem, timestamp reply, information reply
|
||||
net.ipv4.icmp_ratemask: 88089
|
||||
|
||||
# Disable IPv6
|
||||
net.ipv6.conf.all.disable_ipv6: 1
|
||||
|
||||
# Protect against wrapping sequence numbers at gigabit speeds
|
||||
net.ipv4.tcp_timestamps: 0
|
||||
|
||||
# Define restriction level for announcing the local source IP
|
||||
net.ipv4.conf.all.arp_ignore: 1
|
||||
|
||||
# Define mode for sending replies in response to
|
||||
# received ARP requests that resolve local target IP addresses
|
||||
net.ipv4.conf.all.arp_announce: 2
|
||||
|
||||
# RFC 1337 fix F1
|
||||
net.ipv4.tcp_rfc1337: 1
|
||||
|
||||
# Syncookies is used to prevent SYN-flooding attacks.
|
||||
net.ipv4.tcp_syncookies: 1
|
||||
|
||||
# Send(router) or accept(host) RFC1620 shared media redirects
|
||||
net.ipv4.conf.all.shared_media: 1
|
||||
net.ipv4.conf.default.shared_media: 1
|
||||
|
||||
# Accepting source route can lead to malicious networking behavior,
|
||||
# so disable it if not needed.
|
||||
net.ipv4.conf.all.accept_source_route: 0
|
||||
net.ipv4.conf.default.accept_source_route: 0
|
||||
|
||||
# Accepting redirects can lead to malicious networking behavior, so disable
|
||||
# it if not needed.
|
||||
net.ipv4.conf.default.accept_redirects: 0
|
||||
net.ipv4.conf.all.accept_redirects: 0
|
||||
net.ipv4.conf.all.secure_redirects: 0
|
||||
net.ipv4.conf.default.secure_redirects: 0
|
||||
net.ipv6.conf.default.accept_redirects: 0
|
||||
net.ipv6.conf.all.accept_redirects: 0
|
||||
|
||||
# For non-routers: don't send redirects, these settings are 0
|
||||
net.ipv4.conf.all.send_redirects: 0
|
||||
net.ipv4.conf.default.send_redirects: 0
|
||||
|
||||
# log martian packets
|
||||
net.ipv4.conf.all.log_martians: 0
|
||||
|
||||
# ipv6 config
|
||||
# NSA 2.5.3.2.5 Limit Network-Transmitted Configuration
|
||||
net.ipv6.conf.default.router_solicitations: 0
|
||||
net.ipv6.conf.default.accept_ra_rtr_pref: 0
|
||||
net.ipv6.conf.default.accept_ra_pinfo: 0
|
||||
net.ipv6.conf.default.accept_ra_defrtr: 0
|
||||
net.ipv6.conf.default.autoconf: 0
|
||||
net.ipv6.conf.default.dad_transmits: 0
|
||||
net.ipv6.conf.default.max_addresses: 1
|
||||
|
||||
# This settings controls how the kernel behaves towards module changes at
|
||||
# runtime. Setting to 1 will disable module loading at runtime.
|
||||
# Setting it to 0 is actually never supported.
|
||||
# kernel.modules_disabled: 1
|
||||
|
||||
# Magic Sysrq should be disabled, but can also be set to a safe value if so
|
||||
# desired for physical machines. It can allow a safe reboot if the system hangs
|
||||
# and is a 'cleaner' alternative to hitting the reset button.
|
||||
# The following values are permitted:
|
||||
# * **0** - disable sysrq
|
||||
# * **1** - enable sysrq completely
|
||||
# * **>1** - bitmask of enabled sysrq functions:
|
||||
# * **2** - control of console logging level
|
||||
# * **4** - control of keyboard (SAK, unraw)
|
||||
# * **8** - debugging dumps of processes etc.
|
||||
# * **16** - sync command
|
||||
# * **32** - remount read-only
|
||||
# * **64** - signalling of processes (term, kill, oom-kill)
|
||||
# * **128** - reboot/poweroff
|
||||
# * **256** - nicing of all RT tasks
|
||||
kernel.sysrq: 0
|
||||
|
||||
# Prevent core dumps with SUID. These are usually only
|
||||
# needed by developers and may contain sensitive information.
|
||||
fs.suid_dumpable: 0
|
||||
|
||||
# Virtual memory regions protection
|
||||
kernel.randomize_va_space: 2
|
||||
|
||||
sysctl_rhel_config:
|
||||
# ExecShield protection against buffer overflows
|
||||
kernel.exec-shield: 1
|
||||
|
||||
|
||||
Reference in new issue
Block a user