From 5130b82639df92e1fb18e74fd05b33b223c0220f Mon Sep 17 00:00:00 2001 From: claude-bot Date: Wed, 19 Aug 2026 11:02:15 +0200 Subject: [PATCH] security: version the CIS Tier-A hardening pass The script that sets the SSH, PAM, pwquality and auditd baseline on twelve containers existed only as a root-owned copy on the machines it hardens. Bring it into the repo so a change reaches one place instead of twelve. Two substantive changes over the copy that shipped on 2026-07-24: - Deny forwarding per option instead of via DisableForwarding. Same effect, but DisableForwarding overrides every other forwarding option and is invisible in sshd -T, which makes a rejected port-forward read as a configuration that should work. - Quote the command substitution in MODDIR (SC2046). The header and README now record the rollout command, the containers left unhardened as break-glass foundation, and why host-specific exceptions must live in a drop-in that sorts after 99-cis-hardening.conf. --- README.md | 21 +++++- install/cis-tierA.sh | 163 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 183 insertions(+), 1 deletion(-) create mode 100755 install/cis-tierA.sh diff --git a/README.md b/README.md index 13aaf9a..fa41afc 100644 --- a/README.md +++ b/README.md @@ -52,6 +52,24 @@ Shared libs: [`lib/build.func`](lib/build.func) (host-side: prompts, LXC create, - Secrets are generated on the target host and live in `0600` files — never in the repo, the wiki or chat logs. - **Runner separation:** the nexus runner is repo-scoped and lives on the production LXC *because* it holds deploy rights; the general `runner` LXC is instance-wide *because* it holds none. Don't mix these scopes. +### CIS Tier-A hardening + +[`install/cis-tierA.sh`](install/cis-tierA.sh) applies the Tier-A baseline to an existing Debian 12 LXC: SSH drop-in, `login.defs` aging + YESCRYPT, pwquality/faillock, PAM (pwquality, pwhistory, faillock, `nullok` removed) and auditd rules. It is idempotent, backs everything up to `/root/cis-hardening-backup-/`, gates the SSH restart on `sshd -t` and rolls PAM back if a referenced module is missing. + +```bash +pct push install/cis-tierA.sh /root/cis-tierA.sh +pct exec -- bash /root/cis-tierA.sh +``` + +Applied to authentik first (2026-07-24), then to 11 further containers. The PVE hosts and the Wazuh manager VM stay unhardened on purpose — they are the break-glass foundation. + +Two things worth knowing before touching it: + +- **Section 1 rewrites `99-cis-hardening.conf` wholesale on every run.** Host-specific exceptions belong in a separate drop-in that sorts *after* it (e.g. `99-zz-local-forward.conf`), never in that file. A `Match` block extends until the next `Match` — across `Include` file boundaries — so such a drop-in has to stay alphabetically last. +- **Forwarding is denied per option, not via `DisableForwarding`.** Both are equivalent in effect, but `DisableForwarding` overrides every other forwarding option *and* does not appear in `sshd -T` output. A denied port-forward then reports `administratively prohibited` while `sshd -T` cheerfully claims `allowtcpforwarding yes`, which costs hours to diagnose. + +Caveat: auditd is a no-op in unprivileged LXCs (the host owns the audit subsystem); the script probes for it and removes the package again if it cannot load rules. Together with the Section-1 partition/kernel checks that are equally N/A in a container, the achievable SCA score stays well below 100 %. + ## Contributing **All changes go through a pull request with cross-review** (Claude Code ↔ Codex, or a human) — no direct pushes to `main`. This rule exists because of two real incidents: a pasted VLAN tag carrying an invisible non-UTF-8 byte broke `pct create` mid-run, and the "missing `source build.func`" bug shipped twice — caught in review on the nexus-db PR, but reaching production via an un-reviewed authentik commit (see wiki → Lessons). @@ -65,7 +83,8 @@ Build new app prompts on `prompt_validated`/`require_valid` from `lib/build.func ``` . ├── ct/ # Host-side scripts, one per app -├── install/ # In-container installers (+ nexus-runtime.sh re-provisioner) +├── install/ # In-container installers (+ nexus-runtime.sh re-provisioner, +│ # cis-tierA.sh hardening pass) ├── lib/ │ ├── build.func # Shared host-side helpers (prompts, LXC create, bootstrap) │ └── install.func # Shared in-container helpers (apt, systemd, users, http-wait) diff --git a/install/cis-tierA.sh b/install/cis-tierA.sh new file mode 100755 index 0000000..f3393b5 --- /dev/null +++ b/install/cis-tierA.sh @@ -0,0 +1,163 @@ +#!/bin/bash +# CIS Tier-A hardening for a Debian 12 LXC. Idempotent, backs up everything, +# gates the SSH restart on `sshd -t`, auto-rolls-back PAM on sanity failure. +# Recovery path if anything breaks: `pct exec -- bash` from the PVE host. +# +# Rollout: copy into the target LXC and run as root, e.g. +# pct push install/cis-tierA.sh /root/cis-tierA.sh +# pct exec -- bash /root/cis-tierA.sh +# First applied to authentik on 2026-07-24, then to 11 further containers. +# +# NOT hardened on purpose (break-glass foundation): the PVE hosts pve-gamer / +# pve-i5 and the Wazuh manager VM. See the wiki for the break-glass chain. +# +# SSH: section 1 rewrites /etc/ssh/sshd_config.d/99-cis-hardening.conf WHOLESALE +# on every run. Host-specific exceptions therefore do NOT belong in that file — +# put them in a separate drop-in that sorts AFTER it, e.g. +# 99-zz-local-forward.conf. Mind that a Match block extends until the next +# Match, across Include file boundaries, so such a drop-in must stay last. +# +# Forwarding is denied per option (AllowTcpForwarding / AllowAgentForwarding / +# AllowStreamLocalForwarding / X11Forwarding), not via DisableForwarding. Both +# are equivalent in effect, but DisableForwarding overrides every other +# forwarding option AND is invisible in `sshd -T` output — which makes a denied +# port-forward practically undiagnosable. See the wiki entry on that. +set -u +TS=$(date +%Y%m%d-%H%M%S) +BK=/root/cis-hardening-backup-$TS +mkdir -p "$BK" +export DEBIAN_FRONTEND=noninteractive +say(){ echo "[cis] $*"; } + +########## 1. SSH hardening (drop-in, validated) ########## +SSHD=/etc/ssh/sshd_config.d/99-cis-hardening.conf +grep -q "Include /etc/ssh/sshd_config.d" /etc/ssh/sshd_config || echo "Include /etc/ssh/sshd_config.d/*.conf" > /tmp/_noinc +[ -f "$SSHD" ] && cp "$SSHD" "$BK/" 2>/dev/null +printf '%s\n' "Warning: Authorized access only. All activity is monitored." > /etc/issue.net +cat > "$SSHD" <<'EOF' +PermitRootLogin prohibit-password +MaxAuthTries 4 +LoginGraceTime 60 +ClientAliveInterval 15 +ClientAliveCountMax 3 +Banner /etc/issue.net +MaxStartups 10:30:60 +AllowTcpForwarding no +AllowAgentForwarding no +AllowStreamLocalForwarding no +X11Forwarding no +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com +KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 +EOF +if sshd -t 2>/tmp/sshderr; then + systemctl restart ssh 2>/dev/null || systemctl restart sshd 2>/dev/null + say "SSH: drop-in applied + restarted (sshd -t OK, active=$(systemctl is-active ssh 2>/dev/null || systemctl is-active sshd 2>/dev/null))" +else + rm -f "$SSHD"; say "SSH: sshd -t FAILED -> reverted ($(cat /tmp/sshderr))" +fi + +########## 2. login.defs (password aging + hashing) ########## +cp /etc/login.defs "$BK/" +setdef(){ if grep -qE "^\s*$1\b" /etc/login.defs; then sed -i -E "s|^\s*$1\b.*|$1 $2|" /etc/login.defs; else echo "$1 $2" >> /etc/login.defs; fi; } +setdef PASS_MAX_DAYS 365 +setdef PASS_MIN_DAYS 1 +setdef PASS_WARN_AGE 7 +setdef ENCRYPT_METHOD YESCRYPT +useradd -D -f 30 2>/dev/null +say "login.defs: aging + YESCRYPT set" + +########## 3. pwquality ########## +apt-get install -y libpam-pwquality >/dev/null 2>&1 +[ -f /etc/security/pwquality.conf ] && cp /etc/security/pwquality.conf "$BK/" +cat > /etc/security/pwquality.conf <<'EOF' +minlen = 14 +minclass = 4 +maxrepeat = 3 +dictcheck = 1 +enforcing = 1 +EOF +[ -f /etc/security/faillock.conf ] && cp /etc/security/faillock.conf "$BK/" +cat > /etc/security/faillock.conf <<'EOF' +deny = 5 +unlock_time = 900 +fail_interval = 900 +EOF +say "pwquality.conf + faillock.conf written" + +########## 4. PAM module enablement (backup + sanity + rollback) ########## +CA=/etc/pam.d/common-auth +CP=/etc/pam.d/common-password +cp "$CA" "$BK/"; cp "$CP" "$BK/" + +# 5.3.3.4.1 remove nullok +sed -i 's/[[:space:]]*nullok//g' "$CA" "$CP" + +# common-password: full, correctly-formed pwquality + pwhistory lines before pam_unix +grep -q pam_pwquality.so "$CP" || sed -i '0,/^password[[:space:]].*pam_unix.so/s//password requisite pam_pwquality.so retry=3\n&/' "$CP" +grep -q pam_pwhistory.so "$CP" || sed -i '0,/^password[[:space:]].*pam_unix.so/s//password required pam_pwhistory.so remember=5 use_authtok\n&/' "$CP" +grep -qE 'pam_unix.so.*use_authtok' "$CP" || sed -i -E 's/(^password[[:space:]].*pam_unix.so.*)/\1 use_authtok/' "$CP" + +# common-auth: faillock preauth/authfail/authsucc (full lines, idempotent) +if ! grep -q pam_faillock.so "$CA"; then + sed -i '1i auth required pam_faillock.so preauth' "$CA" + awk 'BEGIN{d=0}{print} (/pam_unix.so/ && d==0){print "auth [default=die] pam_faillock.so authfail"; print "auth sufficient pam_faillock.so authsucc"; d=1}' "$CA" > "$CA.tmp" && mv "$CA.tmp" "$CA" +fi + +# sanity: every referenced module must exist; pam_unix + pam_deny must remain +MODDIR=$(dirname "$(find /lib /usr/lib -name pam_unix.so 2>/dev/null | head -1)") +ok=1 +for m in $(grep -hoE 'pam_[a-z_]+\.so' "$CA" "$CP" | sort -u); do + [ -f "$MODDIR/$m" ] || { say "PAM sanity: missing $m"; ok=0; } +done +grep -q pam_unix.so "$CA" && grep -q pam_unix.so "$CP" || ok=0 +if [ "$ok" != "1" ]; then + cp "$BK/common-auth" "$CA"; cp "$BK/common-password" "$CP" + say "PAM: sanity FAILED -> rolled back common-auth/common-password" +else + say "PAM: pwquality/pwhistory/faillock enabled, nullok removed (sanity OK)" +fi + +########## 5. auditd (probe LXC support) ########## +apt-get install -y auditd audispd-plugins >/dev/null 2>&1 +AUOK=0 +if auditctl -l >/dev/null 2>&1 && auditctl -a always,exit -F arch=b64 -S adjtimex -k _probe 2>/dev/null; then + auditctl -d always,exit -F arch=b64 -S adjtimex -k _probe 2>/dev/null; AUOK=1 +fi +if [ "$AUOK" = "1" ]; then + cp -n /etc/audit/rules.d/audit.rules "$BK/" 2>/dev/null + cat > /etc/audit/rules.d/cis.rules <<'EOF' +-w /etc/group -p wa -k identity +-w /etc/passwd -p wa -k identity +-w /etc/shadow -p wa -k identity +-w /etc/gshadow -p wa -k identity +-w /etc/security/opasswd -p wa -k identity +-w /etc/sudoers -p wa -k scope +-w /etc/sudoers.d/ -p wa -k scope +-w /var/log/sudo.log -p wa -k sudo_log +-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change +-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale +-w /etc/hosts -p wa -k system-locale +-w /etc/network/ -p wa -k system-locale +-w /var/log/wtmp -p wa -k session +-w /var/log/btmp -p wa -k session +-w /var/run/utmp -p wa -k session +-w /var/log/lastlog -p wa -k logins +-w /var/run/faillock/ -p wa -k logins +-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts +-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=4294967295 -k delete +-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b64 -S init_module,delete_module,finit_module -k modules +-w /usr/sbin/usermod -p x -k usermod +EOF + systemctl enable auditd >/dev/null 2>&1 + augenrules --load >/dev/null 2>&1 + systemctl restart auditd 2>/dev/null || service auditd restart 2>/dev/null + say "auditd: FUNCTIONAL in this LXC -> CIS rules loaded ($(auditctl -l 2>/dev/null | wc -l) rules)" +else + systemctl disable --now auditd >/dev/null 2>&1 + apt-get purge -y auditd audispd-plugins >/dev/null 2>&1 + say "auditd: NOT supported in this LXC (host owns audit subsystem) -> N/A, removed" +fi + +say "DONE. Backup: $BK" -- 2.54.0