Sshbastion - Revision history

Torben: /* PAM */

2018-01-15T11:55:24Z

PAM

← Older revision		Revision as of 11:55, 15 January 2018
Line 67:		Line 67:
	** edit /etc/pam.d/su and uncomment the following line		** edit /etc/pam.d/su and uncomment the following line
	** <code>#auth required pam_wheel.so</code>		** <code>#auth required pam_wheel.so</code>

			Consider adding pam_tally2 to auto-lock a user for a given period. [http://www.deer-run.com/~hal/linux_passwords_pam.html Read more]

	=selinux=		=selinux=

2018-01-15T11:51:43Z

PAM

← Older revision		Revision as of 11:51, 15 January 2018
Line 58:		Line 58:
	* harden passwords		* harden passwords
	** apt install libpam-pwquality		** apt install libpam-pwquality
	** add <code>password requisite pam_pwquality.so minlen=12 retry=3</code> to /etc/pam.d/common-passwd		** add <code>password requisite pam_pwquality.so try_first_pass minlen=12 retry=3</code> to /etc/pam.d/common-passwd
	* geoip - restrict ssh access based on geoip		* geoip - restrict ssh access based on geoip
	** apt install geoip-database-extra libpam-geoip		** apt install geoip-database-extra libpam-geoip
Line 67:		Line 67:
	** edit /etc/pam.d/su and uncomment the following line		** edit /etc/pam.d/su and uncomment the following line
	** <code>#auth required pam_wheel.so</code>		** <code>#auth required pam_wheel.so</code>


	=selinux=		=selinux=

2018-01-15T11:02:12Z

firewall to restrict outgoing traffic from bastion

← Older revision		Revision as of 11:02, 15 January 2018
Line 14:		Line 14:


	=firewall to restrict ~~outgoing~~ traffic from bastion=		=firewall to restrict traffic to and from bastion=

2018-01-15T11:01:22Z

firewall to restrict outgoing traffic from bastion

@@ Line 16: / Line 16: @@
 =firewall to restrict outgoing traffic from bastion=
-iptables --flush
+ #!/bin/bash
 remember to persist with eg iptables-persistent

2018-01-15T11:00:42Z

firewall to restrict outgoing traffic from bastion

← Older revision		Revision as of 11:00, 15 January 2018
Line 15:		Line 15:

	=firewall to restrict outgoing traffic from bastion=		=firewall to restrict outgoing traffic from bastion=

	<code>		<code>
	#!/bin/bash		#!/bin/bash

2018-01-15T11:00:32Z

firewall to restrict outgoing traffic from bastion

@@ Line 15: / Line 15: @@
 =firewall to restrict outgoing traffic from bastion=
- #!/bin/bash
+iptables --flush
 remember to persist with eg iptables-persistent

2018-01-15T07:32:12Z

← Older revision		Revision as of 07:32, 15 January 2018
Line 36:		Line 36:
	Make sure users can't see other users processes:		Make sure users can't see other users processes:
	* proc /proc proc defaults,hidepid=2 0 0		* proc /proc proc defaults,hidepid=2 0 0

			==home dirs==
			make sure all homedirs are chmod 750

			set DIR_MODE=0750 in /etc/adduser.conf


Line 51:		Line 56:
	** <code>#auth required pam_wheel.so</code>		** <code>#auth required pam_wheel.so</code>

	~~==home dirs==~~
	~~make sure all homedirs are chmod 750~~

	~~set DIR_MODE=0750 in /etc/adduser.conf~~

	=selinux=		=selinux=

2018-01-15T07:28:03Z

← Older revision		Revision as of 07:28, 15 January 2018
Line 3:		Line 3:

	=sshd basic=		=sshd basic=
	* make sure ssh root is cert only ~~or disabled~~		* make sure ssh root is cert only
	* PermitRootLogin prohibit-password		** PermitRootLogin prohibit-password
	* AllowTcpForwarding no		* AllowTcpForwarding no
	* X11Forwarding no		* X11Forwarding no
	* Only allow certain group to ssh		* Only allow certain group to ssh
	* AllowGroups sshusers		** AllowGroups sshusers

	== harden SSH access==		== harden SSH access==

2018-01-15T07:26:53Z

PAM

← Older revision		Revision as of 07:26, 15 January 2018
Line 48:		Line 48:
	* [https://major.io/2013/04/25/limit-access-to-the-su-command/ limit <code>su</code> access]		* [https://major.io/2013/04/25/limit-access-to-the-su-command/ limit <code>su</code> access]
	** groupadd --system wheel		** groupadd --system wheel
			** edit /etc/pam.d/su and uncomment the following line
			** <code>#auth required pam_wheel.so</code>

	==home dirs==		==home dirs==

2018-01-15T07:25:04Z

← Older revision		Revision as of 07:25, 15 January 2018
Line 39:		Line 39:

	=PAM=		=PAM=
	~~Secure bastionhost~~
	* harden passwords		* harden passwords
	** apt install libpam-pwquality		** apt install libpam-pwquality
	** add <code>password requisite pam_pwquality.so minlen=12 retry=3</code> to /etc/pam.d/common-passwd		** add <code>password requisite pam_pwquality.so minlen=12 retry=3</code> to /etc/pam.d/common-passwd
	* geoip		* geoip - restrict ssh access based on geoip
	** apt install geoip-database-extra libpam-geoip		** apt install geoip-database-extra libpam-geoip
	** see https://github.com/vetinari/pam_geoip/blob/master/geoip.conf and modify /etc/security/geoip.conf		** see https://github.com/vetinari/pam_geoip/blob/master/geoip.conf and modify /etc/security/geoip.conf
	** add <code>account required pam_geoip.so geoip_db=/usr/share/GeoIP/GeoIPCity.dat</code> to /etc/pam.d/sshd		** add <code>account required pam_geoip.so geoip_db=/usr/share/GeoIP/GeoIPCity.dat</code> to /etc/pam.d/sshd
			* [https://major.io/2013/04/25/limit-access-to-the-su-command/ limit <code>su</code> access]
			** groupadd --system wheel

	==home dirs==		==home dirs==