Skip to content

Commit 5cc477b

Browse files
chris-rockchris-rock
committed
Merge pull request #67 from hardening-io/mv_sysctl_to_defaults_2
Move sysctl vars to defaults
2 parents c7308bc + e9eac79 commit 5cc477b

File tree

4 files changed

+118
-129
lines changed

4 files changed

+118
-129
lines changed

‎README.md‎

Lines changed: 59 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@ It will not:
3131

3232
## Variables
3333

34-
### in main.yml
35-
3634
* `os_desktop_enable: false` - true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc
3735
* `os_env_extra_user_paths: []` - add additional paths to the user's `PATH` variable (default is empty).
3836
* `os_env_umask: "027"`
@@ -54,12 +52,6 @@ It will not:
5452
* `os_security_suid_sgid_remove_from_unknown: false` - true if you want to remove SUID/SGID bits from any file, that is not explicitly configured in a `blacklist`. This will make every Ansible-run search through the mounted filesystems looking for SUID/SGID bits that are not configured in the default and user blacklist. If it finds an SUID/SGID bit, it will be removed, unless this file is in your `whitelist`.
5553
* `os_security_packages_clean': true` - removes packages with known issues. See section packages.
5654

57-
### in sysctl.yml
58-
59-
* `os_network_forwarding: false` - true if this system requires packet forwarding (eg Router), false otherwise
60-
* `os_network_ipv6_enable: false`
61-
* `os_network_arp_restricted: true` - true if you want the behavior of announcing and replying to ARP to be restricted, false otherwise
62-
6355
## Packages
6456

6557
We remove the following packages:
@@ -77,6 +69,65 @@ We remove the following packages:
7769
roles:
7870
- hardening.os-hardening
7971

72+
73+
## Changing sysctl variables
74+
75+
If you want to overwrite sysctl-variables, you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
76+
So for example if you want to change the IPv4 traffic forwarding variable to `1`, you must pass the whole dict like this:
77+
78+
```
79+
- hosts: localhost
80+
roles:
81+
- hardening.os-hardening
82+
vars:
83+
sysctl_config:
84+
# Disable IPv4 traffic forwarding.
85+
net.ipv4.ip_forward: 1
86+
87+
# Disable IPv6 traffic forwarding.
88+
net.ipv6.conf.all.forwarding: 0
89+
90+
# ignore RAs on Ipv6.
91+
net.ipv6.conf.all.accept_ra: 0
92+
net.ipv6.conf.default.accept_ra: 0
93+
94+
# Enable RFC-recommended source validation feature.
95+
net.ipv4.conf.all.rp_filter: 1
96+
net.ipv4.conf.default.rp_filter: 1
97+
98+
# Reduce the surface on SMURF attacks.
99+
# Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
100+
net.ipv4.icmp_echo_ignore_broadcasts: 1
101+
102+
# There is no reason to accept bogus error responses from ICMP, so ignore them instead.
103+
net.ipv4.icmp_ignore_bogus_error_responses: 1
104+
105+
# Limit the amount of traffic the system uses for ICMP.
106+
net.ipv4.icmp_ratelimit: 100
107+
108+
# Adjust the ICMP ratelimit to include ping, dst unreachable,
109+
# source quench, ime exceed, param problem, timestamp reply, information reply
110+
net.ipv4.icmp_ratemask: 88089
111+
112+
# Disable IPv6
113+
net.ipv6.conf.all.disable_ipv6: 1
114+
115+
# Protect against wrapping sequence numbers at gigabit speeds
116+
net.ipv4.tcp_timestamps: 0
117+
118+
# Define restriction level for announcing the local source IP
119+
net.ipv4.conf.all.arp_ignore: 1
120+
121+
# Define mode for sending replies in response to
122+
# received ARP requests that resolve local target IP addresses
123+
net.ipv4.conf.all.arp_announce: 2
124+
125+
# RFC 1337 fix F1
126+
net.ipv4.tcp_rfc1337: 1
127+
```
128+
129+
Alternatively you can change Ansible's [hash-behaviour](https://docs.ansible.com/ansible/intro_configuration.html#hash-behaviour) to `merge`, then you only have to overwrite the single hash you need to. But please be aware that changing the hash-behaviour changes it for all your playbooks and is not recommended by Ansible.
130+
80131
## Local Testing
81132

82133
For local testing you can use vagrant and Virtualbox of VMWare to run tests locally. You will have to install Virtualbox and Vagrant on your system. See [Vagrant Downloads](http://downloads.vagrantup.com/) for a vagrant package suitable for your system. For all our tests we use `test-kitchen`. If you are not familiar with `test-kitchen` please have a look at [their guide](http://kitchen.ci/docs/getting-started).

‎defaults/main.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,62 @@ os_security_packages_list: ['xinetd','inetd','ypserv','telnet-server','rsh-serve
3939
os_security_init_prompt: true
4040
# Require root password for single user mode. (rhel, centos)
4141
os_security_init_single: false
42+
43+
# CAUTION
44+
# If you want to overwrite sysctl-variables,
45+
# you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
46+
47+
sysctl_config:
48+
# Disable IPv4 traffic forwarding.
49+
net.ipv4.ip_forward: 0
50+
51+
# Disable IPv6 traffic forwarding.
52+
net.ipv6.conf.all.forwarding: 0
53+
54+
# ignore RAs on Ipv6.
55+
net.ipv6.conf.all.accept_ra: 0
56+
net.ipv6.conf.default.accept_ra: 0
57+
58+
# Enable RFC-recommended source validation feature.
59+
net.ipv4.conf.all.rp_filter: 1
60+
net.ipv4.conf.default.rp_filter: 1
61+
62+
# Reduce the surface on SMURF attacks.
63+
# Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
64+
net.ipv4.icmp_echo_ignore_broadcasts: 1
65+
66+
# There is no reason to accept bogus error responses from ICMP, so ignore them instead.
67+
net.ipv4.icmp_ignore_bogus_error_responses: 1
68+
69+
# Limit the amount of traffic the system uses for ICMP.
70+
net.ipv4.icmp_ratelimit: 100
71+
72+
# Adjust the ICMP ratelimit to include ping, dst unreachable,
73+
# source quench, ime exceed, param problem, timestamp reply, information reply
74+
net.ipv4.icmp_ratemask: 88089
75+
76+
# Disable IPv6
77+
net.ipv6.conf.all.disable_ipv6: 1
78+
79+
# Protect against wrapping sequence numbers at gigabit speeds
80+
net.ipv4.tcp_timestamps: 0
81+
82+
# Define restriction level for announcing the local source IP
83+
net.ipv4.conf.all.arp_ignore: 1
84+
85+
# Define mode for sending replies in response to
86+
# received ARP requests that resolve local target IP addresses
87+
net.ipv4.conf.all.arp_announce: 2
88+
89+
# RFC 1337 fix F1
90+
net.ipv4.tcp_rfc1337: 1
91+
92+
# CAUTION
93+
# If you want to overwrite sysctl-variables,
94+
# you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
95+
96+
sysctl_rhel_config:
97+
# ExecShield protection against buffer overflows
98+
kernel.exec-shield: 1
99+
# Syncookies is used to prevent SYN-flooding attacks.
100+
net.ipv4.tcp_syncookies: 1

‎tasks/sysctl.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
11
---
2-
3-
- name: include sysctl variables
4-
include_vars: sysctl.yml
5-
62
- name: protect sysctl.conf
73
file: path='/etc/sysctl.conf' owner=root group=root mode=0440
84

‎vars/sysctl.yml‎

Lines changed: 0 additions & 117 deletions
This file was deleted.

0 commit comments

Comments
 (0)