Hardening à l'arrache

Paquets utiles


    sudo apt install -y apt-listbugs apt-listchanges needrestart debsecan debsums libpam-tmpdir chkrootkit


CronAPT


    APTCOMMAND=/usr/bin/apt-get

    OPTIONS=“-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list”

    MAILTO=“mail@mail.com”

    LINK=“always”


Politique de sécurité pour les mots de passe


Installation de libpam-cracklib


    apt-get install libpam-cracklib


/etc/pam.d/common-password


    # here are the per-package modules (the “Primary” block)

    password requirement pam_cracklib.so retry=1 minlen=32 difok=5

    password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512

    # here’s the fallback if no module succeeds

    password requirement

                  pam_deny.so

    # prime the stack with a positive return value if there isn’t one already;

    # this avoids us returning an error just because nothing sets a success code

    # since the modules above will each just jump around

    password required pam_permit.so

    # and here are more per-package modules (the “Additional” block)

    password optional pam_gnome_keyring.so

    # end of pam-auth-update config


Loop Nmap


    for i in {1..254}; do nmap -sp –max-retries=1 –host-timeout=1500ms 192.168..1-254 | grep -Ev “Starting Nmap 7.70|Nmap done: 254 IP addresses”; done


Nginx


Rickroll des bots


/etc/nginx/snippets/rickroll.conf


    error_page 404 =301 https://youtu.be/dQw4w9WgXcQ?t=44;

    error_page 500 =301 https://youtu.be/dQw4w9WgXcQ?t=44;

    error_page 501 =301 https://youtu.be/dQw4w9WgXcQ?t=44;

    error_page 502 =301 https://youtu.be/dQw4w9WgXcQ?t=44;

    error_page 503 =301 https://youtu.be/dQw4w9WgXcQ?t=44;

    error_page 504 =301 https://youtu.be/dQw4w9WgXcQ?t=44;


/etc/nginx/snippets/monsite.conf


    include ../snippets/rickroll.conf;


Redémarrage de nginx


 sudo systemctl restart nginx



Fail2ban


Jails


nginx


    [nginx-conn-limit]

    enabled = true

    filter=nginx-conn-limit

    action = iptables-multiport[name=ConnLimit, port=“http,https”,

    protocol=tcp]

    logpath = /var/log/nginx/*error.log

    findtime=300 <br>

    bantime = 7200

    maxretry = 100

    

    [nginx-notilde]

    enabled = true

    filter=nginx-notilde

    action = iptables-multiport[name=ConnLimit, port=“http,https”,

    protocol=tcp]

    logpath = /var/log/nginx/*error.log

    findtime = 300

    bantime = 7200

    maxretry = 100

        

    [nginx-nohome]

    enabled = false

    port=http,https

    filter=nginx-nohome

    logpath = /var/log/nginx/*access.log

    maxretry = 2

    

    [nginx-noproxy]

    enabled = false

    port=http,https

    filter=nginx-noproxy

    logpath = /var/log/nginx/*access.log

    maxretry = 25

    

    [nginx-noscript]

    enabled = true

    port=http,https

    filter=nginx-noscript

    logpath = /var/log/nginx/*access.log

    maxretry = 6

    

    [nginx-badbots]

    enabled = true

    port=http,https

    filter=nginx-badbots

    logpath = /var/log/nginx/*access.log

    maxretry = 2

    

    [nginx-botsearch]

    enabled = true

    port=http,https

    filter=nginx-botsearch

    logpath = /var/log/nginx/*access.log

    maxretry = 2


    [nginx-http]

    enabled = true

    port=http,https

    filter=dos-http

    logpath = /var/log/nginx/*access.log

    maxretry = 300

    findtime = 300


Filters


/etc/fail2ban/filter.d/nginx-nohome.conf


    [Definition]

    failregex = ^<HOST> -.GET ./~.*

    ignoreregex=



/etc/fail2ban/filter.d/nginx-noproxy.conf


    [Definition]

    failregex = ^<HOST> -.GET http.

    ignoreregex=

    

/etc/fail2ban/filter.d/nginx-noscript.conf


    [Definition]

    failregex = ^<HOST>-.GET.(.php|.asp|.exe|.pl|.cgi|.scgi)

    ignoreregex =


/etc/fail2ban/filter.d/nginx-notilde.conf


    [Definition]

        failregex = ^ [error] \d+#\d+: *\d+ .* client: <HOST>, server:\S+, request: “GET /.*~ HTTP

        ignoreregex =


Anti-virus :


Lancement d’un scan


    sudo fresh clam


Planification


    sudo crontab -e :


    # m h dom my dow command

    39 0 * * * clamscan -r /storage | grep FOUND >> /home/user/reports/report.txt


Hardening ysctl


    net.ipv6.conf.default.accept_redirects=0

    net.ipv6.conf.all.accept_redirects=0

    net.ipv4.conf.default.log_martians=1

    net.ipv4.conf.default.accept_source_route = 0

    net.ipv4.conf.default.accept_redirects=0

    net.ipv4.conf.all.send_redirects=0

    net.ipv4.conf.all.rp_filter=1

    net.ipv4.conf.all.log_martians=1

    net.ipv4.conf.all.forwarding=0

    kernel.sysrq = 0

    kernel.kptr_restrict = 2

    kernel.dmesg_restrict = 1

    fs.suid_dumpable = 0

    kernel.core_uses_pid = 1

    net.ipv4.conf.all.accept_redirects=0


Port Scan


     nc -vnz -w 1 172.16.28.21 1-65535


chkrootkit


    0 3 * * * /usr/sbin/chkrootkit 2>&1 | mail -s “chkrootkit Reports of My Server” mail@mail.com


SSH


Server


/etc/ssh/sshd_config


    Port 2417

    Listening address 0.0.0.0

    Host key “/etc/ssh/ssh_host_ed25519_key”.

    KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

    Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

    Macs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com

    VERBOSE log level

    Authentication methods Publickey

    LoginGraceTime 5m

    PermitRootLogin no

    MaxAuthTries 2

    MaxSessions 6

    PubkeyAuthentication yes

    PermitEmptyPasswords no

    ChallengeResponseAuthentication yes

    UsePAM yes

    X11Forwarding no

    X11UseLocalhost no

    PrintMotd no

    Compression no

    AllowTcpForwarding yes

    GatewayPorts yes

    ClientAliveCountMax 2

    TCPKeepAlive no

    AllowAgentForwarding no

    AcceptEnv LANG LC_*

    sftp subsystem /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO

    UseDNS no


Client


Génération d’une clé publique et d’une clé privée en utilisant ed25519


        ssh-keygen -t ed25519 -b 4096


Generation of the public/private key pair ed25519.

Enter the file where you want to save the key (/Users/pc/.ssh/id_ed25519):

Enter the passphrase (empty for no passphrase):

Enter the same passphrase again:

Your identification has been saved in /Users/pc/.ssh/id_ed25519.

Your public key has been saved in /Users/pc/.ssh/id_ed25519.pub.

The key fingerprint is:

SHA256: thingbidule pc@mypc.local

The random image of the key is:

+–[ED25519 256]-+

+––[SHA256]—–+


Transfert de la clé publique


        ssh-copy-id -i .ssh/id_ed25519.pub user@monip -p 6666



/usr/bin/ssh-copy-id: INFO: Source of the key(s) to install: “.ssh/id_ed25519.pub”

/usr/bin/ssh-copy-id: INFO: attempt to connect with the new key(s), to filter out those already installed

/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed – if you are prompted now, it is to install the new keys

the user password@monip:


Number of key(s) added: 1


Connexion avec une passphrase


        ssh -p ‘6666’ ‘user@myp’ -i .ssh/id_ed25519

Enter the passphrase for the key ‘/Users/pc/.ssh/id_ed25519’: