second commit

templates/hardened/firewall.table

@@ -0,0 +1,23 @@
+table inet firewall {
+
+    chain input {
+        type filter hook input priority 0; policy drop;
+
+        # established/related connections
+        ct state established,related accept
+
+        # loopback + lxdbr0 interface
+        iifname lo accept
+        iifname lxdbr0 accept
+
+        # icmp
+        icmp type echo-request accept
+
+        # allow mDNS
+        udp dport mdns accept
+
+        # allow SSH + GITEA + NGINX
+        tcp dport {22, 2222, 80, 443} accept
+    }
+
+}

templates/hardened/hardened.yaml.sample

@@ -0,0 +1,14 @@
+---
+
+authorized:
+  pubkey: TO_BE_DEFINED
+
+alert:
+  to: TO_BE_DEFINED # example: mine@domain.tld
+  from: TO_BE_DEFINED # example: no-reply@domain.tld
+  smtp:
+    server: TO_BE_DEFINED # example: mail.domain.tld
+    username: TO_BE_DEFINED # example: postmaster@domain.tld
+    password: TO_BE_DEFINED
+
+timezone: # optional, example: UTC, Indian/Reunion, ...

templates/hardened/mailer/aliases.j2

@@ -0,0 +1,2 @@
+{{ env.current_user }}: root
+root: {{ alert.to }}

templates/hardened/mailer/mail.rc.j2

@@ -0,0 +1,6 @@
+set ask askcc append dot save crt
+#ignore Received Message-Id Resent-Message-Id Status Mail-From Return-Path Via Delivered-To
+set mta=/usr/bin/msmtp
+
+alias {{ env.current_user }} root
+alias root {{ alert.to }}

templates/hardened/mailer/msmtprc.j2

@@ -0,0 +1,26 @@
+# Set default values for all following accounts.
+defaults
+
+# Use the mail submission port 587 instead of the SMTP port 25.
+port 587
+
+# Always use TLS.
+tls on
+
+# Set a list of trusted CAs for TLS. The default is to use system settings, but
+# you can select your own file.
+tls_trust_file /etc/ssl/certs/ca-certificates.crt
+
+# The SMTP server of your ISP
+account alert
+host {{ alert.smtp.server }}
+from {{ env.fqdn }} <{{ alert.from }}>
+auth on
+user {{ alert.smtp.username }}
+password {{ alert.smtp.password }}
+
+# Set default account to isp
+account default: alert
+
+# Map local users to mail addresses
+aliases /etc/aliases

templates/hardened/motd/10-header

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+hostname=$(hostname -s)
+number=$(echo $hostname | grep -oP '[0-9]*$')
+hostname=${hostname%"$number"}
+rows=9
+
+case $hostname in
+'prod')
+    #print in RED
+    echo -ne "\033[31;1m"
+    ;;
+'beta')
+    rows=7
+    #print in ORANGE
+    echo -ne "\033[33;1m"
+    ;;
+'dev')
+    rows=7
+    #print in GREEN
+    echo -ne "\033[33;1m"
+    ;;
+*)
+    #print in GREEN
+    echo -ne "\033[32;1m"
+    ;;
+esac
+
+fullname="$hostname $number"
+figlet -f big "$fullname" | head -n$rows
+echo -ne "\033[0m"

templates/hardened/motd/40-machineinfo

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+FQDN=$(hostname --fqdn)
+IP_ADDRESS=$(hostname -I | cut -d ' ' -f1)
+DISTRO=$(lsb_release -d | cut -f2)
+KERNEL=$(uname -srm)
+UPTIME=$(uptime | awk -F'( |,|:)+' '{if ($7=="min") m=$6; else {if ($7~/^day/) {d=$6;h=$8;m=$9} else {h=$6;m=$7}}} {print d+0,"days"}')
+LOAD=$(cat /proc/loadavg)
+
+echo "FQDN  :   $FQDN"
+echo "UPTIME:   $UPTIME"
+echo "IPADDR:   $IP_ADDRESS"
+echo "DISTRO:   $DISTRO"
+echo "KERNEL:   $KERNEL"
+echo "LOAD  :   $LOAD"

templates/hardened/motd/80-users

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+RED='\033[0;31m'
+NC='\033[0m' # No Color
+
+USERS=$(
+    w -uh
+)
+
+if [ -n "$USERS" ]; then
+    echo '-----------------------------------------------'
+    echo -e "${RED}Beware,${NC} there is another connected user${RED}"
+    echo "$USERS"
+    echo -e "${NC}-----------------------------------------------"
+fi

templates/hardened/nftables.conf

@@ -0,0 +1,5 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+include "/etc/nftables.rules.d/*"

templates/hardened/pam/alert_ssh_password.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+[[ "$PAM_TYPE" != "open_session" ]] && exit 0
+
+if journalctl --since "1 minute ago" -u ssh | tac | grep Accepted -m1 | grep password; then
+    {
+        echo "User: $PAM_USER"
+        echo "Remote Host: $PAM_RHOST"
+        echo "Service: $PAM_SERVICE"
+        echo "TTY: $PAM_TTY"
+        echo "Date: $(date)"
+        echo "Server: $(uname -a)"
+        echo
+        echo "Somebody has successfully logged in your machine, please be aware and acknowledge this event."
+    } | mail -s "$PAM_SERVICE login on $(hostname -f) for account $PAM_USER" root
+fi
+exit 0

templates/hardened/sshd_config.j2

@@ -0,0 +1,16 @@
+Port 2222
+AllowUsers {{env.current_user}}
+
+AcceptEnv LANG LC_*
+Subsystem sftp /usr/lib/openssh/sftp-server
+ClientAliveInterval 120
+UsePAM yes
+MaxAuthTries 3
+
+PasswordAuthentication no
+PermitRootLogin no
+PermitEmptyPasswords no
+PrintLastLog no
+PrintMotd no
+ChallengeResponseAuthentication no
+X11Forwarding no

templates/hardened/sudoers.j2

@@ -0,0 +1,6 @@
+Defaults env_reset
+Defaults mail_badpass
+Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/TOOLBOX"
+
+User_Alias ROOT = root, {{env.current_user}}
+ROOT ALL=(ALL:ALL) NOPASSWD: ALL

templates/hardened/systemd/on_startup.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Startup Script
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStartPre=/bin/sleep 10
+ExecStart=/bin/bash -c "last -wad | mail -s 'server has been rebooted' root"
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target