blob: 34a289484be498dd2640b2ef576a0d10f9c00d57 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
#!/bin/bash
sudo cp -rv ./etc/keyd/* /etc/keyd/
sudo cp -v ./etc/pacman.conf /etc/
sudo cp -v ./etc/kernel/cmdline /etc/kernel/
sudo cp -v ./etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/
sudo cp -v ./etc/pam.d/system-local-login /etc/pam.d/
sudo cp -v ./etc/pam.d/system-login /etc/pam.d/
sudo cp -v ./etc/login.defs /etc/
sudo cp -v ./etc/updatedb.conf /etc/
sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/
sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/
sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/
sudo sysctl --system
grep tmpfs /etc/fstab || sudo cat ./etc/fstab >> /etc/fstab
# firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed
sudo ufw limit ssh
sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp
sudo ufw logging low
sudo ufw enable
sudo systemctl enable --now ufw
# fail2ban
sudo cp ./etc/fail2ban/sshd.local /etc/fail2ban
sudo systemctl enable --now fail2ban
# fs trim
sudo systemctl enable --now fstrim.timer
# linux-hardened
sudo cp -v ./etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d
sudo mkinitcpio -P
# harden systemd services
echo "==> Creating drop-in override directories..."
sudo mkdir -p /etc/systemd/system/sshd.service.d
sudo mkdir -p /etc/systemd/system/fail2ban.service.d
sudo mkdir -p /etc/systemd/system/cups.service.d
echo "==> Applying sshd.service hardening..."
sudo bash -c "cat << 'EOF' > /etc/systemd/system/sshd.service.d/override.conf
[Service]
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/var/empty /run/sshd
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=yes
LockPersonality=yes
EOF
"
echo "==> Applying fail2ban.service hardening..."
sudo bash -c "cat << 'EOF' > /etc/systemd/system/fail2ban.service.d/override.conf
[Service]
NoNewPrivileges=yes
ProtectSystem=full
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
PrivateDevices=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=yes
EOF
"
echo "==> Applying cups.service hardening..."
sudo bash -c "cat << 'EOF' > /etc/systemd/system/cups.service.d/override.conf
[Service]
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
MemoryDenyWriteExecute=yes
EOF
"
sudo systemctl daemon-reload
echo "==> Restarting services..."
for svc in sshd fail2ban cups; do
if systemctl is-active --quiet "$svc"; then
echo " Restarting active service: $svc"
sudo systemctl restart "$svc"
else
echo " Skipping restart for inactive service: $svc"
fi
done
|
