Sshbastion

This article i based on a debian 9 vm

sshd basic

• make sure ssh root is cert only
  • PermitRootLogin prohibit-password
• AllowTcpForwarding no
• X11Forwarding no
• Only allow certain group to ssh
  • AllowGroups sshusers

harden SSH access

install fail2ban to make lock out brute force attacks

firewall to restrict traffic to and from bastion

#!/bin/bash
iptables --flush

iptables --policy INPUT DROP
iptables --policy OUTPUT DROP


iptables --append OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables --append INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables --append INPUT -p tcp --dport 22 -j ACCEPT

iptables --append OUTPUT -d 192.168.12.1 -p tcp --dport 22 -j DROP
iptables --append OUTPUT -p tcp --dport 22 -j ACCEPT
iptables --append OUTPUT -d 192.168.12.1 -p udp --dport 53 -j ACCEPT
iptables --append OUTPUT -d 192.168.12.1 -p tcp --dport 53 -j ACCEPT
iptables --append OUTPUT -d 192.168.12.1 -p udp --dport 67:68 -j ACCEPT
iptables --append OUTPUT -p icmp -j ACCEPT

# depends on DNS so these must be after DNS rule
iptables --append OUTPUT -d security.debian.org -m comment --comment "security.debian.org" -j ACCEPT
iptables --append OUTPUT -d ftp.dk.debian.org -m comment --comment "ftp.dk.debian.org" -j ACCEPT

remember to persist with eg iptables-persistent

Harden OS

proc

Make sure users can't see other users processes:

• proc /proc proc defaults,hidepid=2 0 0

home dirs

make sure all homedirs are chmod 750

set DIR_MODE=0750 in /etc/adduser.conf

PAM

• harden passwords
  • apt install libpam-pwquality
  • add password requisite pam_pwquality.so try_first_pass minlen=12 retry=3 to /etc/pam.d/common-passwd
• geoip - restrict ssh access based on geoip
  • apt install geoip-database-extra libpam-geoip
  • see https://github.com/vetinari/pam_geoip/blob/master/geoip.conf and modify /etc/security/geoip.conf
  • add account required pam_geoip.so geoip_db=/usr/share/GeoIP/GeoIPCity.dat to /etc/pam.d/sshd
• limit su access
  • groupadd --system wheel
  • edit /etc/pam.d/su and uncomment the following line
  • #auth required pam_wheel.so

Consider adding pam_tally2 to auto-lock a user for a given period. Read more

selinux

• https://wiki.debian.org/SELinux/Setup
• test that the setup is ok and monitor with /var/log/audit
• when everything is ok, set selinux to enforce mode and check with sestatus

Session Recording

• https://aws.amazon.com/blogs/security/how-to-record-ssh-sessions-established-through-a-bastion-host/
  • if using this script use
  • chattr +a /var/log/bastion/
  • add umask 0027 to /usr/bin/bastion/shell

Consider using http://scribery.github.io/tlog/