harbian-audit Hardening

Introduction

Hardened Debian GNU/Linux and CentOS 8 distro auditing.

The main test environment is in debian GNU/Linux 9/10/11/12/13 and CentOS 8 and ubuntu 22, and other versions are not fully tested. There are no implementations of desktop related items in this release.

The code framework is based on the OVH-debian-cis project, Modified some of the original implementations according to the features of Debian 9/10/11/12/13 and CentOS 8, added and implemented check items for STIG Red_Hat_Enterprise_Linux_7_V2R5 STIG Ubuntu V1R2 and cisecurity.org recommendations, and also added and implemented some check items by the HardenedLinux community. The audit and apply functions of the infrastructure are implemented, and the automatic fix function is implemented for the items that can be automatically fixed.

# bash bin/hardening.sh --audit-all
[...]
hardening                 [INFO] Treating /home/test/harbian-audit/bin/hardening/13.15_check_duplicate_gid.sh
13.15_check_duplicate_gid [INFO] Working on 13.15_check_duplicate_gid
13.15_check_duplicate_gid [INFO] Checking Configuration
13.15_check_duplicate_gid [INFO] Performing audit
13.15_check_duplicate_gid [ OK ] No duplicate GIDs
13.15_check_duplicate_gid [ OK ] Check Passed

[...]
################### SUMMARY ###################
      Total Available Checks : 271
         Total Checks Run : 271
         Total Passed Checks : [ 226/271 ]
         Total Failed Checks : [  44/271 ]
   Enabled Checks Percentage : 100.00 %
       Conformity Percentage : 83.39 %

Quickstart

$ git clone https://github.com/hardenedlinux/harbian-audit.git && cd harbian-audit
# cp etc/default.cfg /etc/default/cis-hardening
# sed -i "s#CIS_ROOT_DIR=.*#CIS_ROOT_DIR='$(pwd)'#" /etc/default/cis-hardening
# bin/hardening.sh --init
# bin/hardening.sh --audit-all
hardening                 [INFO] Treating /home/test/harbian-audit/bin/hardening/1.1_install_updates.sh
1.1_install_updates       [INFO] Working on 1.1_install_updates
1.1_install_updates       [INFO] Checking Configuration
1.1_install_updates       [INFO] Performing audit
1.1_install_updates       [INFO] Checking if apt needs an update
1.1_install_updates       [INFO] Fetching upgrades ...
1.1_install_updates       [ OK ] No upgrades available
1.1_install_updates       [ OK ] Check Passed
[...]
################### SUMMARY ###################
      Total Available Checks : 284
         Total Checks Run : 284
         Total Passed Checks : [ 260/284 ]
         Total Failed Checks : [  24/284 ]
   Enabled Checks Percentage : 100.00 %
       Conformity Percentage : 91.55 %
# bin/hardening.sh --set-hardening-level 5
# bin/hardening.sh --apply 
hardening                 [INFO] Treating /home/test/harbian-audit/bin/hardening/1.1_install_updates.sh
1.1_install_updates       [INFO] Working on 1.1_install_updates
1.1_install_updates       [INFO] Checking Configuration
1.1_install_updates       [INFO] Performing audit
1.1_install_updates       [INFO] Checking if apt needs an update
1.1_install_updates       [INFO] Fetching upgrades ...
1.1_install_updates       [ OK ] No upgrades available
1.1_install_updates       [INFO] Applying Hardening
1.1_install_updates       [ OK ] No Upgrades to apply
1.1_install_updates       [ OK ] Check Passed
[...]

Usage

Pre-Install

If use Network install from a minimal CD to installed Debian GNU/Linux, need install packages before use the hardening tool.

# apt-get install -y bc net-tools pciutils network-manager

Redhat/CentOS need install packages before use the hardening tool:

# yum install -y bc net-tools pciutils NetworkManager epel-release

Pre-Set

You must set a password for all users before hardening. Otherwise, you will not be able to log in after the hardening is completed. Example(OS user: root and test):

 
# passwd 
# passwd test

Configuration

Hardening scripts are in bin/hardening. Each script has a corresponding configuration file in etc/conf.d/[script_name].cfg.

Each hardening script can be individually enabled from its configuration file. For example, this is the default configuration file for disable_system_accounts:

# Configuration for script of same name
status=disabled
# Put here your exceptions concerning admin accounts shells separated by spaces
EXCEPTIONS=""

status parameter may take 3 values:

disabled (do nothing): The script will not run.
audit (RO): The script will check if any change should be applied.
enabled (RW): The script will check if any change should be done and automatically apply what it can.

You can also set the configuration item to enable by modifying the level, following command:

Generate etc/conf.d/[script_name].cfg by audit-all when first use

# bash bin/hardening.sh --audit-all

Enable [script_name].cfg by set-hardening-level Use the command to set the hardening level to make the corresponding level audit entry take effect.

# bash bin/hardening.sh --set-hardening-level <level>

Global configuration is in etc/hardening.cfg. This file controls the log level as well as the backup directory. Whenever a script is instructed to edit a file, it will create a timestamped backup in this directory.

Run aka "Harden your distro (After the hardened, you must perform the "After remediation" section)

To run the checks and apply the fixes, run bin/hardening.sh.

This command has 2 main operation modes:

--audit: Audit your system with all enabled and audit mode scripts
--apply: Audit your system with all enabled and audit mode scripts and apply changes for enabled scripts

Additionally, --audit-all can be used to force running all auditing scripts, including disabled ones. this will not change the system.

--audit-all-enable-passed can be used as a quick way to kickstart your configuration. It will run all scripts in audit mode. If a script passes, it will automatically be enabled for future runs. Do NOT use this option if you have already started to customize your configuration.

Use the command to harden your OS:

# bash bin/hardening.sh --apply

rsyslog config

If rsyslog is used, and you want to print the harbian-audit log to a separate log file, the configuration is as follows:

user.info			/var/log/harbian-audit.log
user.*				-/var/log/user.log

The log will be output to the file /var/log/harbian-audit.log.

If you apply docs/configurations/etc.iptables.rules.v4.sh to your firewall rules, and want to print the iptables log to a separate log file, insert the following lines to rsyslog.conf:

:msg,contains,"FW-"                     -/var/log/firewalllog.log
&                                       stop

After remediation (Very important)

When exec --apply and set-hardening-level are set to 5 (the highest level), you need to do the following:

When applying 9.4(Restrict Access to the su Command), you must use the root account to log in to the OS because ordinary users cannot perform subsequent operations. If you can only use ssh for remote login, you must use the su command when the normal user logs in. Then do the following:

# sed -i '/^[^#].*pam_wheel.so.*/s/^/# &/' /etc/pam.d/su

Temporarily comment out the line containing pam_wheel.so. After you have finished using the su command, please uncomment the line.

harbian-audit

Most Popular