mirror/ infrastructure
1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-06-09 22:26:10 +02:00
Code Issues
infrastructure/roles/hardening/tasks/main.yml

42 lines
1.6 KiB
YAML
Raw Normal View History

Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Set restricted access to kernel logs
fix E208 'File permissions not mentioned'
2020-08-18 20:25:24 +02:00
copy: src=50-dmesg-restrict.conf dest=/etc/sysctl.d/50-dmesg-restrict.conf owner=root group=root mode=0644
roles: add a hardening role for sysctl hardening options Add sysctl hardening options which disallow perf/viewing kernel symbols and dmesg for non-admin users as they contain valuable information for attackers.
2019-05-06 19:28:29 +02:00
notify:
- apply sysctl settings
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Set ptrace scope, restrict ptrace to CAP_SYS_PTRACE
fix E208 'File permissions not mentioned'
2020-08-18 20:25:24 +02:00
copy: src=50-ptrace-restrict.conf dest=/etc/sysctl.d/50-ptrace-restrict.conf owner=root group=root mode=0644
hardening: use default ptrace scope on buildservers Making 'kernel.yama.ptrace_scope' more strict by setting it to '2' causes failures in elfutils' test suite. While tentatively helpful on other servers, it seems kind of unnecessary for a build server. Fixes: #424 (to be reopened though, if more restrictions are found)
2022-02-13 15:54:50 +01:00
when: "'buildservers' not in group_names"
roles: add a hardening role for sysctl hardening options Add sysctl hardening options which disallow perf/viewing kernel symbols and dmesg for non-admin users as they contain valuable information for attackers.
2019-05-06 19:28:29 +02:00
notify:
- apply sysctl settings
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Set restricted access to kernel pointers in proc fs
fix E208 'File permissions not mentioned'
2020-08-18 20:25:24 +02:00
copy: src=50-kptr-restrict.conf dest=/etc/sysctl.d/50-kptr-restrict.conf owner=root group=root mode=0644
roles: add a hardening role for sysctl hardening options Add sysctl hardening options which disallow perf/viewing kernel symbols and dmesg for non-admin users as they contain valuable information for attackers.
2019-05-06 19:28:29 +02:00
notify:
- apply sysctl settings
hardening: set lockdown to integrity
2019-12-22 14:12:23 +01:00
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Enable JIT hardening for all users
kernel: further default sysctl hardening - unprivileged bpf: we do not need this on our infra, we can assume bpf() calls will happen with CAP_SYS_ADMIN if required. - unprivileged userns: we do not need this on our infra for none of our services or similar. Reduce attack surface by a huge margin including most recent CVE-2020-14386. - kptr restrict: we already check for CAP_SYSLOG and real ids but we really do not require any specific kernel pointers to be logged. Settings this to 2 instead to blank out all kernel pointers to protect against info leak. - kexec: disable kexec as we do never want to kexec our running servers into something else. Settings this sysctl disables kexec even if its compiled into the kernel. - bpf jit harden: harden BPF JIT compiler to mitigate JIT spraying for the sacrifices off a bit performance for all users including privileged.
2020-09-07 18:13:03 +02:00
copy: src=50-bpf_jit_harden.conf dest=/etc/sysctl.d/50-bpf_jit_harden.conf owner=root group=root mode=0644
notify:
- apply sysctl settings
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Disable unprivileged bpf
kernel: further default sysctl hardening - unprivileged bpf: we do not need this on our infra, we can assume bpf() calls will happen with CAP_SYS_ADMIN if required. - unprivileged userns: we do not need this on our infra for none of our services or similar. Reduce attack surface by a huge margin including most recent CVE-2020-14386. - kptr restrict: we already check for CAP_SYSLOG and real ids but we really do not require any specific kernel pointers to be logged. Settings this to 2 instead to blank out all kernel pointers to protect against info leak. - kexec: disable kexec as we do never want to kexec our running servers into something else. Settings this sysctl disables kexec even if its compiled into the kernel. - bpf jit harden: harden BPF JIT compiler to mitigate JIT spraying for the sacrifices off a bit performance for all users including privileged.
2020-09-07 18:13:03 +02:00
copy: src=50-unprivileged_bpf_disabled.conf dest=/etc/sysctl.d/50-unprivileged_bpf_disabled.conf owner=root group=root mode=0644
notify:
- apply sysctl settings
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Disable unprivileged userns
kernel: further default sysctl hardening - unprivileged bpf: we do not need this on our infra, we can assume bpf() calls will happen with CAP_SYS_ADMIN if required. - unprivileged userns: we do not need this on our infra for none of our services or similar. Reduce attack surface by a huge margin including most recent CVE-2020-14386. - kptr restrict: we already check for CAP_SYSLOG and real ids but we really do not require any specific kernel pointers to be logged. Settings this to 2 instead to blank out all kernel pointers to protect against info leak. - kexec: disable kexec as we do never want to kexec our running servers into something else. Settings this sysctl disables kexec even if its compiled into the kernel. - bpf jit harden: harden BPF JIT compiler to mitigate JIT spraying for the sacrifices off a bit performance for all users including privileged.
2020-09-07 18:13:03 +02:00
copy: src=50-unprivileged_userns_clone.conf dest=/etc/sysctl.d/50-unprivileged_userns_clone.conf owner=root group=root mode=0644
notify:
- apply sysctl settings
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Disable kexec load
kernel: further default sysctl hardening - unprivileged bpf: we do not need this on our infra, we can assume bpf() calls will happen with CAP_SYS_ADMIN if required. - unprivileged userns: we do not need this on our infra for none of our services or similar. Reduce attack surface by a huge margin including most recent CVE-2020-14386. - kptr restrict: we already check for CAP_SYSLOG and real ids but we really do not require any specific kernel pointers to be logged. Settings this to 2 instead to blank out all kernel pointers to protect against info leak. - kexec: disable kexec as we do never want to kexec our running servers into something else. Settings this sysctl disables kexec even if its compiled into the kernel. - bpf jit harden: harden BPF JIT compiler to mitigate JIT spraying for the sacrifices off a bit performance for all users including privileged.
2020-09-07 18:13:03 +02:00
copy: src=50-kexec_load_disabled.conf dest=/etc/sysctl.d/50-kexec_load_disabled.conf owner=root group=root mode=0644
notify:
- apply sysctl settings
Capitalize the first letter of all task names ansible-lint 6.5.0 complains about: name: All names should start with an uppercase letter. (name[casing])
2022-08-23 04:49:23 +02:00
- name: Set kernel lockdown to restricted
fix E208 'File permissions not mentioned'
2020-08-18 20:25:24 +02:00
copy: src=50-lockdown.conf dest=/etc/tmpfiles.d/50-kernel-lockdown.conf owner=root group=root mode=0644
hardening: set lockdown to integrity
2019-12-22 14:12:23 +01:00
when: "'hcloud' in group_names"
notify:
- apply sysctl settings