Skip to content

Commit 0ac5bc1

Browse files
hyderhyder
committed
use the CIS image available from OCI Marketplace if a using a hardened image for the bastion host is desired
1 parent 60b4bb7 commit 0ac5bc1

File tree

1 file changed

+1
-165
lines changed

1 file changed

+1
-165
lines changed

‎modules/bastion/scripts/oracle.template.sh‎

Lines changed: 1 addition & 165 deletions
Original file line numberDiff line numberDiff line change
@@ -3,172 +3,8 @@
33
# Copyright 2017, 2019, Oracle Corporation and/or affiliates. All rights reserved.
44
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl
55

6-
# Hardening of the host based on https://www.cisecurity.org/benchmark/oracle_linux/
7-
# This script is used only if the Oracle Linux platform image is used to create the bastion
8-
96
yum update --security
107

118
sed -i -e "s/autoinstall\s=\sno/# autoinstall = yes/g" /etc/uptrack/uptrack.conf
129

13-
uptrack-upgrade
14-
15-
touch /etc/modprobe.d/blacklist-filesystems.conf
16-
echo "blacklist cramfs" >> /etc/modprobe.d/blacklist-filesystems.conf
17-
echo "blacklist freevxfs" >> /etc/modprobe.d/blacklist-filesystems.conf
18-
echo "blacklist jffs2" >> /etc/modprobe.d/blacklist-filesystems.conf
19-
echo "blacklist hfs" >> /etc/modprobe.d/blacklist-filesystems.conf
20-
echo "blacklist hfsplus" >> /etc/modprobe.d/blacklist-filesystems.conf
21-
echo "blacklist squashfs" >> /etc/modprobe.d/blacklist-filesystems.conf
22-
echo "blacklist udf" >> /etc/modprobe.d/blacklist-filesystems.conf
23-
24-
rmmod cramfs freevxfs jffs2 hfs hfsplus squashfs udf
25-
26-
sed -i -e "s/Options=mode=1777,strictatime/Options=mode=1777,strictatime,noexec,nodev,nosuid/g" /etc/systemd/system/local-fs.target.wants/tmp.mount
27-
mount -o remount,nodev /tmp
28-
mount -o remount,nosuid /tmp
29-
mount -o remount,noexec /tmp
30-
31-
yum install -y aide
32-
aide --init
33-
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
34-
35-
echo "0 5 * * 5 root /usr/sbin/aide --update" >> /etc/crontab
36-
37-
echo "0 6 * * 5 root mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz" >> /etc/crontab
38-
39-
echo "0 2 * * * root /usr/sbin/aide --check" >> /etc/crontab
40-
41-
echo "* hard core 0" >> /etc/security/limits.conf
42-
echo "fs.suid_dumpable = 0" >> /etc/sysctl.conf
43-
sysctl -w fs.suid_dumpable=0
44-
45-
ntpdate 169.254.169.254
46-
sed -i -e "s/server\s0.rhel.pool.ntp.org\siburst/# server 0.rhel.pool.ntp.org iburst/g" /etc/ntp.conf
47-
sed -i -e "s/server\s1.rhel.pool.ntp.org\siburst/# server 1.rhel.pool.ntp.org iburst/g" /etc/ntp.conf
48-
sed -i -e "s/server\s2.rhel.pool.ntp.org\siburst/# server 2.rhel.pool.ntp.org iburst/g" /etc/ntp.conf
49-
sed -i -e "s/server\s3.rhel.pool.ntp.org\siburst/# server 3.rhel.pool.ntp.org iburst\nserver 169.254.169.254 iburst/g" /etc/ntp.conf
50-
51-
systemctl enable ntpd
52-
systemctl start ntpd
53-
54-
systemctl stop chronyd
55-
systemctl disable chronyd
56-
57-
systemctl disable rpcbind
58-
59-
sed -i -e "s/inet_interfaces\s=\slocalhost/inet_interfaces = loopback-only/g" /etc/postfix/main.cf
60-
systemctl stop postfix.service
61-
systemctl disable postfix.service
62-
63-
echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.conf
64-
sysctl -w net.ipv4.ip_forward=0
65-
66-
echo "net.ipv4.conf.all.send_redirects = 0" >> /etc/sysctl.conf
67-
echo "net.ipv4.conf.default.send_redirects = 0" >> /etc/sysctl.conf
68-
sysctl -w net.ipv4.conf.all.send_redirects=0
69-
sysctl -w net.ipv4.conf.default.send_redirects=0
70-
71-
echo "net.ipv4.conf.all.accept_source_route = 0" >> /etc/sysctl.conf
72-
echo "net.ipv4.conf.default.accept_source_route = 0" >> /etc/sysctl.conf
73-
sysctl -w net.ipv4.conf.all.accept_source_route=0
74-
sysctl -w net.ipv4.conf.default.accept_source_route=0
75-
76-
77-
echo "net.ipv4.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
78-
echo "net.ipv4.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
79-
sysctl -w net.ipv4.conf.all.accept_redirects=0
80-
sysctl -w net.ipv4.conf.default.accept_redirects=0
81-
82-
echo "net.ipv4.conf.all.secure_redirects = 0" >> /etc/sysctl.conf
83-
echo "net.ipv4.conf.default.secure_redirects = 0" >> /etc/sysctl.conf
84-
sysctl -w net.ipv4.conf.all.secure_redirects=0
85-
sysctl -w net.ipv4.conf.default.secure_redirects=0
86-
87-
echo "net.ipv4.conf.all.log_martians = 1" >> /etc/sysctl.conf
88-
echo "net.ipv4.conf.default.log_martians = 1" >> /etc/sysctl.conf
89-
sysctl -w net.ipv4.conf.all.log_martians=1
90-
sysctl -w net.ipv4.conf.default.log_martians=1
91-
92-
echo "net.ipv4.icmp_echo_ignore_broadcasts = 1" >> /etc/sysctl.conf
93-
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
94-
95-
echo "net.ipv4.icmp_ignore_bogus_error_responses = 1" >> /etc/sysctl.conf
96-
sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1
97-
98-
echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.conf
99-
echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.conf
100-
101-
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.conf
102-
sysctl -w net.ipv4.tcp_syncookies=1
103-
104-
sysctl -w net.ipv4.route.flush=1
105-
106-
echo "net.ipv6.conf.all.accept_ra = 0" >> /etc/sysctl.conf
107-
echo "net.ipv6.conf.default.accept_ra = 0" >> /etc/sysctl.conf
108-
sysctl -w net.ipv6.conf.all.accept_ra=0
109-
sysctl -w net.ipv6.conf.default.accept_ra=0
110-
111-
echo "net.ipv6.conf.all.accept_redirects = 0" >> /etc/sysctl.conf
112-
echo "net.ipv6.conf.default.accept_redirects = 0" >> /etc/sysctl.conf
113-
sysctl -w net.ipv6.conf.all.accept_redirects=0
114-
sysctl -w net.ipv6.conf.default.accept_redirects=0
115-
116-
sysctl -w net.ipv6.route.flush=1
117-
118-
touch /etc/modprobe.d/blacklist-protocols.conf
119-
echo "blacklist sctp" >> /etc/modprobe.d/blacklist-protocols.conf
120-
echo "blacklist rds" >> /etc/modprobe.d/blacklist-protocols.conf
121-
echo "blacklist tipc" >> /etc/modprobe.d/blacklist-protocols.conf
122-
123-
echo "max_log_file = 20MB" >> /etc/audit/auditd.conf
124-
125-
echo "$FileCreateMode 0640" >> /etc/rsyslog.conf
126-
127-
chown root:root /etc/cron.hourly
128-
chmod og-rwx /etc/cron.hourly
129-
130-
chown root:root /etc/cron.daily
131-
chmod og-rwx /etc/cron.daily
132-
133-
chown root:root /etc/cron.weekly
134-
chmod og-rwx /etc/cron.weekly
135-
136-
chown root:root /etc/cron.monthly
137-
chmod og-rwx /etc/cron.monthly
138-
139-
chown root:root /etc/cron.d
140-
chmod og-rwx /etc/cron.d
141-
142-
rm -f /etc/cron.deny
143-
rm -f /etc/at.deny
144-
touch /etc/cron.allow
145-
touch /etc/at.allow
146-
chmod og-rwx /etc/cron.allow
147-
chmod og-rwx /etc/at.allow
148-
chown root:root /etc/cron.allow
149-
chown root:root /etc/at.allow
150-
151-
echo "Protocol 2" >> /etc/ssh/sshd_config
152-
sed -i -e "s/#LogLevel\sINFO/LogLevel INFO/g" /etc/ssh/sshd_config
153-
sed -i -e "s/X11Forwarding\syes/X11Forwarding no/g" /etc/ssh/sshd_config
154-
sed -i -e "s/#MaxAuthTries\s6/MaxAuthTries 3/g" /etc/ssh/sshd_config
155-
sed -i -e "s/#IgnoreRhosts\syes/IgnoreRhosts yes/g" /etc/ssh/sshd_config
156-
sed -i -e "s/#HostbasedAuthentication\sno/HostbasedAuthentication no/g" /etc/ssh/sshd_config
157-
sed -i -e "s/#PermitEmptyPasswords\sno/PermitEmptyPasswords no/g" /etc/ssh/sshd_config
158-
sed -i -e "s/#PermitUserEnvironment\sno/PermitUserEnvironment no/g" /etc/ssh/sshd_config
159-
echo "ClientAliveInterval 300" >> /etc/ssh/sshd_config
160-
echo "ClientAliveCountMax 100" >> /etc/ssh/sshd_config
161-
echo "LoginGraceTime 60" >> /etc/ssh/sshd_config
162-
systemctl reload sshd
163-
164-
sed -i -e "s/minlen\s=\s8/minlen = 14/g" /etc/security/pwquality.conf
165-
sed -i -e "s/password\s\s\s\ssufficient\s\s\s\spam_unix.so\ssha512\sshadow\snullok\stry_first_pass\suse_authtok/password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=4/g" /etc/pam.d/password-auth
166-
167-
echo "TMOUT=900" >> /etc/bashrc
168-
echo "TMOUT=900" >> /etc/profile
169-
170-
chown root:root /etc/passwd-
171-
chmod u-x,go-wx /etc/passwd-
172-
173-
chown root:root /etc/group-
174-
chmod u-x,go-wx /etc/group-
10+
uptrack-upgrade

0 commit comments

Comments
 (0)