V8.00.000.2025.06.17
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -96,7 +96,303 @@ image: "linux-image-amd64" # Could be a meta-package or a specific image lik
|
|||||||
# "linux-image-6.12.30+bpo-amd64"
|
# "linux-image-6.12.30+bpo-amd64"
|
||||||
|
|
||||||
################################################################################################################################
|
################################################################################################################################
|
||||||
# GRUB2 settings
|
# Dropbear settings
|
||||||
|
################################################################################################################################
|
||||||
|
dropbear:
|
||||||
|
boot: true # Dropbear initramfs integration.
|
||||||
|
dhcp: true # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
|
||||||
|
firewall: false # Yet not implemented. MUST be "false".
|
||||||
|
# Additional ultra hardening of the dropbear initramfs environment via firewall.
|
||||||
|
# The "bastion_ipv4" MUST be provided.
|
||||||
|
port: 42137 # SSH Port dropbear initramfs should listen.
|
||||||
|
|
||||||
|
################################################################################################################################
|
||||||
|
# Grub Bootparameter
|
||||||
|
################################################################################################################################
|
||||||
|
grub_parameter:
|
||||||
|
##############################################################################################################################
|
||||||
|
# Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go
|
||||||
|
# undetected. During boot if audit=1, then the backlog will hold 64 records. If more than 64 records are created during boot,
|
||||||
|
# auditd records will be lost, and potential malicious activity could go undetected.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "audit=1"
|
||||||
|
- "audit_backlog_limit=8192"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Distrusts CPU bootloader for initial entropy at boot. Distrusts the CPU for initial entropy at boot, as it is not possible
|
||||||
|
# to audit, may contain weaknesses or a backdoor.
|
||||||
|
# https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||||
|
# https://twitter.com/pid_eins/status/1149649806056280069
|
||||||
|
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||||
|
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||||
|
# https://lkml.org/lkml/2022/6/5/271
|
||||||
|
##############################################################################################################################
|
||||||
|
- "random.trust_cpu=off"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Distrusts the bootloader for initial entropy at boot.
|
||||||
|
# https://lkml.org/lkml/2022/6/5/271
|
||||||
|
##############################################################################################################################
|
||||||
|
- "random.trust_bootloader=off"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# ASLR (Address Space Layout Randomization) causes central areas of memory to be assigned random addresses each time a program
|
||||||
|
# is started. These include: Stack, Heap, Shared libraries (e.g., libc), mmap regions, VDSO/VSyscall. The executable itself
|
||||||
|
# (only with PIE binaries). The aim is to make it more difficult for attackers to predict memory addresses, thereby preventing
|
||||||
|
# classic exploits that rely on known addresses from succeeding.
|
||||||
|
# 0: disabled Fixed memory addresses – insecure, testable.
|
||||||
|
# 1: Partial ASLR Heap, mmap are randomized, stack only partially randomized.
|
||||||
|
# 2: Full ASLR (default) Stack, mmap, heap, VDSO, shared libraries all randomized.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "randomize_va_space=2"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enables IOMMU to prevent DMA attacks. intel_iommu=on amd_iommu=force_isolation iommu=force
|
||||||
|
# Multiple IOMMU switches are redundant; iommu=force is usually sufficient. Forces an IOMMU to be initialized and used
|
||||||
|
# completely, even if the BIOS or ACPI wanted to disable it. It activates the basic DMA remapping function. However, it does
|
||||||
|
# not say anything about how restrictive the mapping strategy is, 'passthrough', 'strict', see below.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "iommu=force"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enables strict enforcement of IOMMU TLB invalidation, so devices will never be able to access stale data contents. #
|
||||||
|
# iommu.passthrough=0
|
||||||
|
# Prevents devices from operating in identity-mapped passthrough mode. Without this parameter (or with =1), devices could be
|
||||||
|
# passed through without being monitored by the IOMMU in a truly restrictive manner. From a security standpoint,
|
||||||
|
# iommu.passthrough=0 is an important step toward DMA isolation for all devices, especially for untrusted PCI(e) devices. #
|
||||||
|
# iommu.strict=1
|
||||||
|
# Enables Strict Mode for dma-iommu.c (i.e., all DMA transactions are validated synchronously). Without this parameter, the
|
||||||
|
# kernel often runs in lazy mode, where mapping caches are used.
|
||||||
|
# Performance vs. security: strict=1= more secure, but potentially slower, especially with many small DMA transfers. #
|
||||||
|
# https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97
|
||||||
|
# Page 11 of https://lenovopress.lenovo.com/lp1467.pdf
|
||||||
|
##############################################################################################################################
|
||||||
|
- "iommu.passthrough=0"
|
||||||
|
- "iommu.strict=1"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Disable the busmaster bit on all PCI bridges during very early boot to avoid holes in IOMMU. #
|
||||||
|
# https://mjg59.dreamwidth.org/54433.html
|
||||||
|
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||||
|
##############################################################################################################################
|
||||||
|
- "efi=disable_early_pci_dma"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Disables the merging of slabs of similar sizes. Sometimes a slab can be used vulnerably, which an attacker can exploit.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "slab_nomerge"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Zero memory at allocation and free time.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "init_on_alloc=1"
|
||||||
|
- "init_on_free=1"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# This option randomizes page allocator freelists, improving security by making page allocations less predictable. This also
|
||||||
|
# improves performance.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "page_alloc.shuffle=1"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# When releasing (i.e., free_pages()), all bytes with a marker value (e.g., 0xAA) are overwritten. If later code
|
||||||
|
# (accidentally or maliciously) accesses this page, it will most likely crash or produce recognizable artifacts. Only
|
||||||
|
# supported if the kernel was built with CONFIG_PAGE_POISONING=y (default on Debian: enabled since Bookworm).
|
||||||
|
##############################################################################################################################
|
||||||
|
- "page_poison=1"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "pti=on"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# The setting 'vsyscall' is obsolete, are at fixed addresses and are a target for ROP.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "vsyscall=none"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# The kernel adds a small random padding offset to the stack pointer with every system call or kernel entry. The starting
|
||||||
|
# point for local variables is at a different position within the stack with every call. This makes ROP chains
|
||||||
|
# (return-oriented programming) or stack pivoting attacks significantly more difficult.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "randomize_kstack_offset=on"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Prevents the debugfsfile system from being made available at boot time. This is a useful hardening measure because debugfs
|
||||||
|
# reveals a lot of potentially security-relevant kernel information by default, which can be misused by normal users and by
|
||||||
|
# exploits.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "debugfs=off"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Force the kernel to panic on "oopses" (which may be due to false positives).
|
||||||
|
# - 'panic=N' (e.g., 'panic=60'): Wait N seconds and then reboot.
|
||||||
|
# - 'panic=0' No automatic action (System remains stuck in panic state).
|
||||||
|
# - 'panic=-1' Also explicitly prevents any automatic reboot.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "oops=panic"
|
||||||
|
- "panic=-1"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enable a subset of known mitigations for CPU vulnerabilities and disable SMT.
|
||||||
|
# - 'mitigations=auto' Enables all available CPU-specific security measures based on the detected CPU, microcode version, and
|
||||||
|
# kernel build configuration, if applicable.
|
||||||
|
# - 'nosmt' Disables Simultaneous Multithreading (SMT) (e.g., Hyper-Threading on Intel) system-wide to prevent shared cache
|
||||||
|
# attacks (SMoTHER, MDS, L1TF, TAA, Snoop-assisted).
|
||||||
|
# Why is 'mitigations=auto,nosmt' better than setting everything manually?
|
||||||
|
# Automatically adjusted: Depending on CPU family, stepping, microcode.
|
||||||
|
# Consistency guaranteed: No contradictions between flags possible
|
||||||
|
# (e.g., spec_store_bypass_disable=on vs. nospec_store_bypass_disable=off).
|
||||||
|
# Future-proof: Even new features (e.g., bhi=flush or srbds) are automatically activated without having to know about them. #
|
||||||
|
##############################################################################################################################
|
||||||
|
- "mitigations=auto,nosmt"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||||
|
# Enable mitigations for both 'Spectre Variant 2' (indirect branch speculation) and Intel branch history injection (BHI)
|
||||||
|
# vulnerabilities.
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
||||||
|
##############################################################################################################################
|
||||||
|
#- "spectre_v2=on"
|
||||||
|
#- "spectre_v2_user=on"
|
||||||
|
#- "spectre_bhi=on"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||||
|
# Disable Speculative Store Bypass (Spectre Variant 4).
|
||||||
|
# https://www.suse.com/support/kb/doc/?id=000019189
|
||||||
|
##############################################################################################################################
|
||||||
|
#- "spec_store_bypass_disable=on"
|
||||||
|
#- "nospec_store_bypass_disable=off"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||||
|
# Enable mitigations for the L1TF vulnerability through disabling SMT and L1D flush runtime control. #
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
||||||
|
##############################################################################################################################
|
||||||
|
#- "l1tf=full,force"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||||
|
# Enable mitigations for the MDS vulnerability through clearing buffer cache and disabling SMT. #
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
||||||
|
##############################################################################################################################
|
||||||
|
#- "mds=full,nosmt"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||||
|
# Patches the TAA vulnerability by disabling TSX and enables mitigations using TSX Async Abort along with disabling SMT. #
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
||||||
|
##############################################################################################################################
|
||||||
|
#- "tsx=off"
|
||||||
|
#- "tsx_async_abort=full,nosmt"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit.
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html
|
||||||
|
##############################################################################################################################
|
||||||
|
- "kvm.nx_huge_pages=force"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Force disable SMT as it has caused numerous CPU vulnerabilities. The only full mitigation of cross-HT attacks is disabling. #
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||||||
|
##############################################################################################################################
|
||||||
|
- "nosmt=force"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enables the prctl interface to prevent leaks from L1D on context switches.
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
|
||||||
|
##############################################################################################################################
|
||||||
|
- "l1d_flush=on"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
|
||||||
|
# mmio_stale_data=off No mitigation (unsafe)
|
||||||
|
# mmio_stale_data=full All known measures active
|
||||||
|
# mmio_stale_data=full,nosmt Full mitigation + SMT disabling
|
||||||
|
# mmio_stale_data=auto Activated depending on CPU/microcode
|
||||||
|
# mmio_stale_data=full,force Forces mitigation even on CPUs that are supposedly not affected. #
|
||||||
|
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||||||
|
##############################################################################################################################
|
||||||
|
- "mmio_stale_data=full,force"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with Return Instructions) vulnerability and disable
|
||||||
|
# SMT. If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant mitigations, provided the CPU
|
||||||
|
# is affected; 'retbleed=auto,nosmt' explicitly overrides the internal assessment and forces full protection. If maximum
|
||||||
|
# hardening is required, and one does not want to rely on "auto-detection" then it is recommended to additionally set
|
||||||
|
# 'retbleed=auto,nosmt' otherwise, 'mitigations=auto,nosmt' is sufficient.
|
||||||
|
# https://www.suse.com/support/kb/doc/?id=000020693
|
||||||
|
##############################################################################################################################
|
||||||
|
- "retbleed=auto,nosmt"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enables kernel lockdown mode with a focus on confidentiality. The kernel is configured in such a way that even privileged
|
||||||
|
# users (such as root) have limited access to kernel data and debug mechanisms.
|
||||||
|
# 'confidentiality': Maximum restriction to ensure the security and integrity of the system. This prevents direct access to
|
||||||
|
# hardware and debug interfaces, for example. Useful for highly secure environments as it reduces the attack surface to kernel
|
||||||
|
# data. However, some applications that require debugging or hardware access may have problems. #
|
||||||
|
# https://blog.cloudflare.com/de-de/linux-kernel-hardening/
|
||||||
|
# https://www.linux-magazine.com/Issues/2020/239/Lockdown-Mode
|
||||||
|
##############################################################################################################################
|
||||||
|
- "lockdown=confidentiality"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Enables 'Read-Only Data Protection', which implements read-only memory areas for kernel data structures. This protects the
|
||||||
|
# kernel from certain types of exploit (e.g., buffer overflows). 'on': Forces the corresponding areas to remain read-only.
|
||||||
|
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
||||||
|
##############################################################################################################################
|
||||||
|
- "rodata=on"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety error detector. KFENCE detects heap
|
||||||
|
# out-of-bounds access, use-after-free, and invalid-free errors. KFENCE is designed to be enabled in production kernels, and
|
||||||
|
# has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind
|
||||||
|
# KFENCE design is that with enough total uptime, KFENCE will detect bugs in code paths not typically exercised by
|
||||||
|
# non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a
|
||||||
|
# large fleet of machines.
|
||||||
|
# https://docs.kernel.org/dev-tools/kfence.html
|
||||||
|
##############################################################################################################################
|
||||||
|
- "kfence.sample_interval=100"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# CFI Ensures that only controlled, predefined transitions are possible in the programs' control flow.
|
||||||
|
# kcfi (Kernel Control Flow Integrity): Specific implementation of CFI for the Linux kernel that is particularly robust and
|
||||||
|
# provides accurate control flow validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special
|
||||||
|
# checks and instrumentation into the kernel code.
|
||||||
|
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||||
|
##############################################################################################################################
|
||||||
|
- "cfi=kcfi"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Remove additional (32-bit) attack surface, unless you really need them.
|
||||||
|
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html
|
||||||
|
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||||
|
##############################################################################################################################
|
||||||
|
- "ia32_emulation=0"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Removes mapping for 32-bit VDSO (for ia32binaries). On 32-bit processes that rely on VDSO, this causes a fallback to classic
|
||||||
|
# syscalls (slower) or errors. On a system without CONFIG_IA32_EMULATION or with ia32_emulation=0, vdso32=0 is effective but
|
||||||
|
# redundant.
|
||||||
|
##############################################################################################################################
|
||||||
|
- "vdso32=0"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Checks every copy_to_user() / copy_from_user()operation. Prevents kernels from accidentally copying unallocated memory to
|
||||||
|
# userspace. Stop exploits that trigger buffer overflows or use-after-free via copy_*_user(), for example. Effect: Detects
|
||||||
|
# heap/SLOB abuse, overwrites. Leads to BUG() & stack trace if suspicious access is detected. #
|
||||||
|
##############################################################################################################################
|
||||||
|
- "hardened_usercopy=1"
|
||||||
|
|
||||||
|
##############################################################################################################################
|
||||||
|
# Sets the minimum log output of the kernel at boot time to level 0 (= KERN_EMERG).
|
||||||
|
##############################################################################################################################
|
||||||
|
- "loglevel=0"
|
||||||
|
|
||||||
|
################################################################################################################################
|
||||||
|
# Grub settings
|
||||||
################################################################################################################################
|
################################################################################################################################
|
||||||
grub:
|
grub:
|
||||||
background: # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
|
background: # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
|
||||||
@@ -367,63 +663,23 @@ ntp:
|
|||||||
timezone: "Europe/Lisbon" # Any valid setting for $TZ; see the contents of '/usr/share/zoneinfo' for valid values.
|
timezone: "Europe/Lisbon" # Any valid setting for $TZ; see the contents of '/usr/share/zoneinfo' for valid values.
|
||||||
utc: true # Controls whether the hardware clock is set to UTC.
|
utc: true # Controls whether the hardware clock is set to UTC.
|
||||||
|
|
||||||
|
|
||||||
################################################################################################################################
|
|
||||||
# Dropbear settings
|
|
||||||
################################################################################################################################
|
|
||||||
dropbear:
|
|
||||||
boot: true # Dropbear initramfs integration.
|
|
||||||
dhcp: true # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
|
|
||||||
firewall: false # Yet not implemented. MUST be "false".
|
|
||||||
# Additional ultra hardening of the dropbear initramfs environment via firewall.
|
|
||||||
# The "bastion_ipv4" MUST be provided.
|
|
||||||
port: 42137 # SSH Port dropbear initramfs should listen.
|
|
||||||
|
|
||||||
################################################################################################################################
|
################################################################################################################################
|
||||||
# SSH settings
|
# SSH settings
|
||||||
################################################################################################################################
|
################################################################################################################################
|
||||||
ssh:
|
ssh:
|
||||||
allow_hardening: true # For additional hardening of SSH connections via TCP wrapper: '/etc/hosts.allow'.
|
allow_hardening: true # For additional hardening of SSH connections via TCP wrapper: '/etc/hosts.allow'.
|
||||||
# If "allow_policies" = "true", at least one 'bastion_ipv4' MUST be provided.
|
# If "allow_hardening" = "true", at least one 'allow_ipv4' MUST be provided.
|
||||||
# One or multiple Domains could be provided as well via 'allow_domain'.
|
allow_ipv4: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv4.
|
||||||
|
|
||||||
allow_domain:
|
|
||||||
- vpn00.x448.eu
|
|
||||||
allow_ipv4:
|
|
||||||
- 202.61.246.50
|
- 202.61.246.50
|
||||||
allow_ipv6:
|
allow_ipv6: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv6.
|
||||||
- 2a03:4000:53:f:abcd:9494:0:2
|
- 2a03:4000:53:f:abcd:9494:0:2
|
||||||
port: 42137
|
port: 42137 # SSH Port.
|
||||||
root_ca: "/.preseed/ssh_root_ca.pub"
|
root_ca: "/.preseed/ssh_root_ca.pub"
|
||||||
|
|
||||||
################################################################################################################################
|
|
||||||
# Grub Bootparameter
|
|
||||||
################################################################################################################################
|
|
||||||
grub_parameter:
|
|
||||||
- "audit=1 audit_backlog_limit=8192"
|
|
||||||
- "random.trust_cpu=off"
|
|
||||||
|
|
||||||
################################################################################################################################
|
################################################################################################################################
|
||||||
# User settings
|
# User settings
|
||||||
################################################################################################################################
|
################################################################################################################################
|
||||||
user:
|
user:
|
||||||
allow_policies: true # For additional hardening of SSH connections '/etc/hosts.allow'.
|
|
||||||
# If "allow_policies" = "true", at least one 'bastion_ipv4' MUST be provided.
|
|
||||||
# One or multiple Domains could be provided as well 'allow_domain'.
|
|
||||||
bastion_enable: false # In case 'bastion_ipv4' and 'bastion_ipv6' are SSH Bastion IPs set this to "true".
|
|
||||||
# If these are Jump Server and / or static VPN-Exit-Nodes, set this to "false".
|
|
||||||
bastion_ipv4: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv4.
|
|
||||||
- 202.61.246.50
|
|
||||||
bastion_ipv6: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv6.
|
|
||||||
- 2a03:4000:53:f:abcd:9494:0:2
|
|
||||||
allow_domain: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes Domains.
|
|
||||||
- vpn00.x448.eu
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
ssh_port: 42137 # SSH Port. In case "dropbear_boot" = "true" the same SSH Port will be used.
|
|
||||||
ssh_rootca: "/.preseed/ssh_root_ca.pub"
|
|
||||||
|
|
||||||
##############################################################################################################################
|
##############################################################################################################################
|
||||||
# root – Superuser account (normally disabled for direct login)
|
# root – Superuser account (normally disabled for direct login)
|
||||||
##############################################################################################################################
|
##############################################################################################################################
|
||||||
@@ -482,9 +738,9 @@ user:
|
|||||||
restricted: false # If true, user is limited in scope (e.g., no login, no file access).
|
restricted: false # If true, user is limited in scope (e.g., no login, no file access).
|
||||||
shell_access: true # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.
|
shell_access: true # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.
|
||||||
|
|
||||||
################################################################################
|
##############################################################################################################################
|
||||||
# ansible – System user for automation, no interactive shell
|
# ansible – System user for automation, no interactive shell
|
||||||
################################################################################
|
##############################################################################################################################
|
||||||
user1:
|
user1:
|
||||||
ensure: present # "present" = create user; "absent" = remove user
|
ensure: present # "present" = create user; "absent" = remove user
|
||||||
protected: true # Prevent unintentional edits or deletions.
|
protected: true # Prevent unintentional edits or deletions.
|
||||||
|
|||||||
@@ -30,13 +30,14 @@ yaml_parser() {
|
|||||||
|
|
||||||
yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
|
yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
|
||||||
|
|
||||||
declare -agx ARY_NTPSRVR ARY_PACKAGES
|
declare -agx ARY_BOOTPARAM ARY_NTPSRVR ARY_PACKAGES
|
||||||
declare var_key var_value
|
declare var_key var_value
|
||||||
|
|
||||||
while IFS='=' read -r var_key var_value; do
|
while IFS='=' read -r var_key var_value; do
|
||||||
var_value=${var_value#\'}
|
var_value=${var_value#\'}
|
||||||
var_value=${var_value%\'}
|
var_value=${var_value%\'}
|
||||||
case "${var_key}" in
|
case "${var_key}" in
|
||||||
|
grub_parameter_[0-9]*) ARY_BOOTPARAM+=("${var_value}") ;;
|
||||||
ntp_server_[0-9]*) ARY_NTPSRVR+=("${var_value}") ;;
|
ntp_server_[0-9]*) ARY_NTPSRVR+=("${var_value}") ;;
|
||||||
software_[0-9]*) ARY_PACKAGES+=("${var_value}") ;;
|
software_[0-9]*) ARY_PACKAGES+=("${var_value}") ;;
|
||||||
esac
|
esac
|
||||||
|
|||||||
@@ -18,340 +18,34 @@ guard_sourcing
|
|||||||
#######################################
|
#######################################
|
||||||
# Hardening Grub boot parameter.
|
# Hardening Grub boot parameter.
|
||||||
# Globals:
|
# Globals:
|
||||||
|
# ARY_BOOTPARAM
|
||||||
# TARGET
|
# TARGET
|
||||||
# VAR_GRUB_CMDLINE_LINUX
|
# VAR_GRUB_CMDLINE_LINUX_DEFAULT
|
||||||
# VAR_SETUP_PATH
|
|
||||||
# Arguments:
|
# Arguments:
|
||||||
# None
|
# None
|
||||||
# Returns:
|
# Returns:
|
||||||
# 0: on success
|
# 0: on success
|
||||||
#######################################
|
#######################################
|
||||||
setup_grub_bootparameter() {
|
setup_grub_bootparameter() {
|
||||||
### Install Kernel Hardening-Presets
|
declare var_param
|
||||||
cp "${VAR_SETUP_PATH}/includes/etc/sysctl.d/99_local.hardened.ini" "${TARGET}/etc/sysctl.d/99_local.hardened"
|
|
||||||
chmod 0644 "${TARGET}/etc/sysctl.d/99_local.hardened"
|
|
||||||
|
|
||||||
### Entropy collection improvements
|
|
||||||
mkdir -p "${TARGET}/usr/lib/modules-load.d"
|
|
||||||
cat << EOF >| "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
|
|
||||||
## https://www.whonix.org/wiki/Dev/Entropy
|
|
||||||
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972
|
|
||||||
## https://forums.whonix.org/t/jitterentropy-rngd/7204
|
|
||||||
jitterentropy_rng
|
|
||||||
EOF
|
|
||||||
chmod 0644 "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
|
|
||||||
|
|
||||||
grub_extract_current_string
|
grub_extract_current_string
|
||||||
|
|
||||||
###########################################################################################
|
for var_param in "${ARY_BOOTPARAM[@]}"; do
|
||||||
# Audit events need to be captured on processes that start up prior to auditd, #
|
|
||||||
# so that potential malicious activity cannot go undetected. During boot if audit=1, then #
|
|
||||||
# the backlog will hold 64 records. If more than 64 records are created during boot, #
|
|
||||||
# auditd records will be lost and potential malicious activity could go undetected #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} audit=1 audit_backlog_limit=8192"
|
|
||||||
|
|
||||||
###########################################################################################
|
if [[ -z "${var_param}" ]]; then
|
||||||
# Distrusts CPU bootloader for initial entropy at boot. #
|
do_log "warn" "true" "Empty GRUB parameter detected and skipped."
|
||||||
# Distrusts the CPU for initial entropy at boot, as it is not possible to audit, #
|
continue
|
||||||
# may contain weaknesses or a backdoor. #
|
fi
|
||||||
###########################################################################################
|
|
||||||
# https://en.wikipedia.org/wiki/RDRAND#Reception #
|
|
||||||
# https://twitter.com/pid_eins/status/1149649806056280069 #
|
|
||||||
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
|
||||||
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
|
||||||
# https://lkml.org/lkml/2022/6/5/271 #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} random.trust_cpu=off"
|
|
||||||
|
|
||||||
###########################################################################################
|
if grep -q --word-regexp "${var_param%%=*}" <<< "${VAR_GRUB_CMDLINE_LINUX_DEFAULT}"; then
|
||||||
# Distrusts the bootloader for initial entropy at boot. #
|
do_log "info" "true" "Skipping duplicate kernel parameter: '${var_param}'."
|
||||||
# https://lkml.org/lkml/2022/6/5/271 #
|
continue
|
||||||
###########################################################################################
|
fi
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} random.trust_bootloader=off"
|
|
||||||
|
|
||||||
###########################################################################################
|
VAR_GRUB_CMDLINE_LINUX_DEFAULT+=" ${var_param}"
|
||||||
# ASLR (Address Space Layout Randomization) causes central areas of memory to be assigned #
|
|
||||||
# random addresses each time a program is started. These include: Stack, Heap, Shared #
|
|
||||||
# libraries (e.g., libc), mmap regions, VDSO/VSyscall. The executable itself (only with #
|
|
||||||
# PIE binaries). The aim is to make it more difficult for attackers to predict memory #
|
|
||||||
# addresses, thereby preventing classic exploits that rely on known addresses from #
|
|
||||||
# succeeding. #
|
|
||||||
# 0: disabled Fixed memory addresses – insecure, testable. #
|
|
||||||
# 1: Partial ASLR Heap, mmap are randomized, stack only partially randomized. #
|
|
||||||
# 2: Full ASLR (default) Stack, mmap, heap, VDSO, shared libraries all randomized. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} randomize_va_space=2"
|
|
||||||
|
|
||||||
###########################################################################################
|
done
|
||||||
# Enables IOMMU to prevent DMA attacks. #
|
|
||||||
# intel_iommu=on amd_iommu=force_isolation iommu=force #
|
|
||||||
# Multiple IOMMU switches are redundant; iommu=force is usually sufficient. #
|
|
||||||
# Forces an IOMMU to be initialized and used completely, even if the BIOS or ACPI wanted #
|
|
||||||
# to disable it. It activates the basic DMA remapping function. However, it does not say #
|
|
||||||
# anything about how restrictive the mapping strategy is, passthrough, strict, see below #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} iommu=force"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enables strict enforcement of IOMMU TLB invalidation, so devices will never be able to #
|
|
||||||
# access stale data contents. #
|
|
||||||
# iommu.passthrough=0 #
|
|
||||||
# Prevents devices from operating in identity-mapped passthrough mode. Without this #
|
|
||||||
# parameter (or with =1), devices could be passed through without being monitored by the #
|
|
||||||
# IOMMU in a truly restrictive manner. From a security standpoint, iommu.passthrough=0 is #
|
|
||||||
# an important step toward DMA isolation for all devices, especially for untrusted PCI(e) #
|
|
||||||
# devices. #
|
|
||||||
# iommu.strict=1 #
|
|
||||||
# Enables Strict Mode for dma-iommu.c (i.e., all DMA transactions are validated #
|
|
||||||
# synchronously). Without this parameter, the kernel often runs in lazy mode, where #
|
|
||||||
# mapping caches are used. #
|
|
||||||
# Performance vs. security: strict=1= more secure, but potentially slower, especially #
|
|
||||||
# with many small DMA transfers. #
|
|
||||||
# https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97 #
|
|
||||||
# Page 11 of https://lenovopress.lenovo.com/lp1467.pdf #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} iommu.passthrough=0 iommu.strict=1"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Disable the busmaster bit on all PCI bridges during very early boot to avoid holes in #
|
|
||||||
# IOMMU. #
|
|
||||||
# https://mjg59.dreamwidth.org/54433.html #
|
|
||||||
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} efi=disable_early_pci_dma"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Disables the merging of slabs of similar sizes. #
|
|
||||||
# Sometimes a slab can be used vulnerably, which an attacker can exploit. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} slab_nomerge"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Zero memory at allocation and free time. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} init_on_alloc=1 init_on_free=1"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# This option randomizes page allocator freelists, improving security by making page #
|
|
||||||
# allocations less predictable. This also improves performance. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} page_alloc.shuffle=1"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# When releasing (i.e., free_pages()), all bytes with a marker value (e.g., 0xAA) are #
|
|
||||||
# overwritten. If later code (accidentally or maliciously) accesses this page, it will #
|
|
||||||
# most likely crash or produce recognizable artifacts. Only supported if the kernel was #
|
|
||||||
# built with CONFIG_PAGE_POISONING=y (default on Debian: enabled since Bookworm). #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} page_poison=1"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} pti=on"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# The setting 'vsyscall' is obsolete, are at fixed addresses and are a target for ROP. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} vsyscall=none"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# The kernel adds a small random padding offset to the stack pointer with every system #
|
|
||||||
# call or kernel entry. The starting point for local variables is at a different position #
|
|
||||||
# within the stack with every call. This makes ROP chains (return-oriented programming) #
|
|
||||||
# or stack pivoting attacks significantly more difficult. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} randomize_kstack_offset=on"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Prevents the debugfsfile system from being made available at boot time. This is a #
|
|
||||||
# useful hardening measure because debugfs reveals a lot of potentially security-relevant #
|
|
||||||
# kernel information by default, which can be misused by normal users (and by exploits). #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} debugfs=off"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Force the kernel to panic on "oopses" (which may be due to false positives). #
|
|
||||||
# panic=N (e.g., panic=60): Wait N seconds and then reboot. #
|
|
||||||
# panic=0 No automatic action (System remains stuck in panic state). #
|
|
||||||
# panic=-1 Also explicitly prevents any automatic reboot. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} oops=panic panic=-1"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enable a subset of known mitigations for CPU vulnerabilities and disable SMT. #
|
|
||||||
# mitigations=auto Enables all available CPU-specific security measures based on the #
|
|
||||||
# detected CPU, microcode version, and kernel build configuration, if applicable. #
|
|
||||||
# 'nosmt' Disables Simultaneous Multithreading (SMT) (e.g., Hyper-Threading on Intel) #
|
|
||||||
# system-wide to prevent shared cache attacks (SMoTHER, MDS, L1TF, TAA, Snoop-assisted). #
|
|
||||||
# Why is 'mitigations=auto,nosmt' better than setting everything manually? #
|
|
||||||
# Automatically adjusted: Depending on CPU family, stepping, microcode. #
|
|
||||||
# Consistency guaranteed: No contradictions between flags possible #
|
|
||||||
# (e.g., spec_store_bypass_disable=on vs. nospec_store_bypass_disable=off). #
|
|
||||||
# Future-proof: Even new kernel features (e.g., bhi=flush or srbds) are automatically #
|
|
||||||
# activated without having to know about them. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} mitigations=auto,nosmt"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set #
|
|
||||||
# individually because they are redundant. Enable mitigations for both Spectre Variant 2 #
|
|
||||||
# (indirect branch speculation) and Intel branch history injection (BHI) vulnerabilities. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html #
|
|
||||||
###########################################################################################
|
|
||||||
# VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} spectre_v2=on spectre_v2_user=on spectre_bhi=on"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set #
|
|
||||||
# individually because they are redundant. #
|
|
||||||
# Disable Speculative Store Bypass (Spectre Variant 4). #
|
|
||||||
# https://www.suse.com/support/kb/doc/?id=000019189 #
|
|
||||||
###########################################################################################
|
|
||||||
# VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} spec_store_bypass_disable=on nospec_store_bypass_disable=off"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set #
|
|
||||||
# individually because they are redundant. #
|
|
||||||
# Enable mitigations for the L1TF vulnerability through disabling SMT and L1D flush #
|
|
||||||
# runtime control. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html #
|
|
||||||
###########################################################################################
|
|
||||||
# VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} l1tf=full,force"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set #
|
|
||||||
# individually because they are redundant. #
|
|
||||||
# Enable mitigations for the MDS vulnerability through clearing buffer cache #
|
|
||||||
# and disabling SMT. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html #
|
|
||||||
###########################################################################################
|
|
||||||
# VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} mds=full,nosmt"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set #
|
|
||||||
# individually because they are redundant. #
|
|
||||||
# Patches the TAA vulnerability by disabling TSX and enables mitigations using TSX Async #
|
|
||||||
# Abort along with disabling SMT. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html #
|
|
||||||
###########################################################################################
|
|
||||||
# VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} tsx=off tsx_async_abort=full,nosmt"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} kvm.nx_huge_pages=force"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Force disable SMT as it has caused numerous CPU vulnerabilities. #
|
|
||||||
# The only full mitigation of cross-HT attacks is to disable SMT. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} nosmt=force"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enables the prctl interface to prevent leaks from L1D on context switches. #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} l1d_flush=on"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT. #
|
|
||||||
# mmio_stale_data=off No mitigation (unsafe) #
|
|
||||||
# mmio_stale_data=full All known measures active #
|
|
||||||
# mmio_stale_data=full,nosmt Full mitigation + SMT disabling #
|
|
||||||
# mmio_stale_data=auto Activated depending on CPU/microcode #
|
|
||||||
# mmio_stale_data=full,force Forces mitigation even on CPUs that are supposedly not #
|
|
||||||
# affected #
|
|
||||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} mmio_stale_data=full,force"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with #
|
|
||||||
# Return Instructions) vulnerability and disable SMT. #
|
|
||||||
# If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant #
|
|
||||||
# mitigations, provided the CPU is affected; 'retbleed=auto,nosmt' explicitly overrides #
|
|
||||||
# the internal assessment and forces full protection. If maximum hardening is required, #
|
|
||||||
# and one does not want to rely on "auto-detection" then it is recommended to additionally#
|
|
||||||
# set 'retbleed=auto,nosmt' otherwise, 'mitigations=auto,nosmt' is sufficient. #
|
|
||||||
# https://www.suse.com/support/kb/doc/?id=000020693 #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} retbleed=auto"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enables kernel lockdown mode with a focus on confidentiality. The kernel is #
|
|
||||||
# configured in such a way that even privileged users (such as root) have limited access #
|
|
||||||
# to kernel data and debug mechanisms. 'confidentiality': Maximum restriction to ensure #
|
|
||||||
# the security and integrity of the system. This prevents direct access to hardware and #
|
|
||||||
# debug interfaces, for example. Useful for highly secure environments as it reduces the #
|
|
||||||
# attack surface to kernel data. However, some applications that require debugging or #
|
|
||||||
# hardware access may have problems. #
|
|
||||||
# https://blog.cloudflare.com/de-de/linux-kernel-hardening/ #
|
|
||||||
# https://www.linux-magazine.com/Issues/2020/239/Lockdown-Mode #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} lockdown=confidentiality"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Enables 'Read-Only Data Protection', which implements read-only memory areas #
|
|
||||||
# for kernel data structures. This protects the kernel from certain types of exploit #
|
|
||||||
# (e.g., buffer overflows). 'on': Forces the corresponding areas to remain read-only. #
|
|
||||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} rodata=on"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety #
|
|
||||||
# error detector. KFENCE detects heap out-of-bounds access, use-after-free, and #
|
|
||||||
# invalid-free errors. KFENCE is designed to be enabled in production kernels, and has #
|
|
||||||
# near zero performance overhead. Compared to KASAN, KFENCE trades performance for #
|
|
||||||
# precision. The main motivation behind KFENCE’s design is that with enough total uptime #
|
|
||||||
# KFENCE will detect bugs in code paths not typically exercised by non-production test #
|
|
||||||
# workloads. One way to quickly achieve a large enough total uptime is when the tool is #
|
|
||||||
# deployed across a large fleet of machines. #
|
|
||||||
# https://docs.kernel.org/dev-tools/kfence.html #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} kfence.sample_interval=100"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# CFI Ensures that only controlled, predefined transitions are possible in the #
|
|
||||||
# programs' control flow. kcfi (Kernel Control Flow Integrity): Specific implementation of#
|
|
||||||
# CFI for the Linux kernel that is particularly robust and provides accurate control flow #
|
|
||||||
# validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special #
|
|
||||||
# checks and instrumentation into the kernel code. #
|
|
||||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} cfi=kcfi"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Remove additional (32-bit) attack surface, unless you really need them. #
|
|
||||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
|
||||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} ia32_emulation=0"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Removes mapping for 32-bit VDSO (for ia32binaries). On 32-bit processes that rely on #
|
|
||||||
# VDSO, this causes a fallback to classic syscalls (slower) or errors. On a system #
|
|
||||||
# without CONFIG_IA32_EMULATION or with ia32_emulation=0, vdso32=0 is effective but #
|
|
||||||
# redundant. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} vdso32=0"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Checks every copy_to_user() / copy_from_user()operation. Prevents kernels from #
|
|
||||||
# accidentally copying unallocated memory to userspace. Stop exploits that trigger #
|
|
||||||
# buffer overflows or use-after-free via copy_*_user(), for example. Effect: Detects #
|
|
||||||
# heap/SLOB abuse, overwrites. Leads to BUG() & stack trace if suspicious access is #
|
|
||||||
# detected. #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} hardened_usercopy=1"
|
|
||||||
|
|
||||||
###########################################################################################
|
|
||||||
# Sets the minimum log output of the kernel at boot time to level 0 (= KERN_EMERG). #
|
|
||||||
###########################################################################################
|
|
||||||
VAR_GRUB_CMDLINE_LINUX_DEFAULT="${VAR_GRUB_CMDLINE_LINUX_DEFAULT} loglevel=0"
|
|
||||||
|
|
||||||
grub_finalize_string
|
grub_finalize_string
|
||||||
|
|
||||||
|
|||||||
40
func/4165_kernel_modules.sh
Normal file
40
func/4165_kernel_modules.sh
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# SPDX-Version: 3.0
|
||||||
|
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||||
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||||
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||||
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||||
|
# SPDX-FileType: SOURCE
|
||||||
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||||
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||||
|
# SPDX-PackageName: CISS.debian.installer
|
||||||
|
# SPDX-Security-Contact: security@coresecret.eu
|
||||||
|
|
||||||
|
### Options in "GRUB_CMDLINE_LINUX" are always effective.
|
||||||
|
### Options in "GRUB_CMDLINE_LINUX_DEFAULT" are effective ONLY during normal boot (NOT during recovery mode).
|
||||||
|
|
||||||
|
guard_sourcing
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
# Entropy collection improvements '/usr/lib/modules-load.d/30_security-misc.conf'.
|
||||||
|
# Globals:
|
||||||
|
# TARGET
|
||||||
|
# Arguments:
|
||||||
|
# None
|
||||||
|
# Returns:
|
||||||
|
# 0: on success
|
||||||
|
#######################################
|
||||||
|
setup_kernel_modules() {
|
||||||
|
### Entropy collection improvements
|
||||||
|
mkdir -p "${TARGET}/usr/lib/modules-load.d"
|
||||||
|
cat << EOF >| "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
|
||||||
|
## https://www.whonix.org/wiki/Dev/Entropy
|
||||||
|
## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972
|
||||||
|
## https://forums.whonix.org/t/jitterentropy-rngd/7204
|
||||||
|
jitterentropy_rng
|
||||||
|
EOF
|
||||||
|
chmod 0644 "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
|
||||||
|
do_log "info" "true" "Installed: '/usr/lib/modules-load.d/30_security-misc.conf'."
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||||
34
func/4166_kernel_sysctl.sh
Normal file
34
func/4166_kernel_sysctl.sh
Normal file
@@ -0,0 +1,34 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# SPDX-Version: 3.0
|
||||||
|
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||||
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||||||
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||||||
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||||||
|
# SPDX-FileType: SOURCE
|
||||||
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||||||
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||||||
|
# SPDX-PackageName: CISS.debian.installer
|
||||||
|
# SPDX-Security-Contact: security@coresecret.eu
|
||||||
|
|
||||||
|
### Options in "GRUB_CMDLINE_LINUX" are always effective.
|
||||||
|
### Options in "GRUB_CMDLINE_LINUX_DEFAULT" are effective ONLY during normal boot (NOT during recovery mode).
|
||||||
|
|
||||||
|
guard_sourcing
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
# Install Kernel Hardening-Presets '/etc/sysctl.d/99_local.hardened'.
|
||||||
|
# Globals:
|
||||||
|
# TARGET
|
||||||
|
# VAR_SETUP_PATH
|
||||||
|
# Arguments:
|
||||||
|
# None
|
||||||
|
# Returns:
|
||||||
|
# 0: on success
|
||||||
|
#######################################
|
||||||
|
setup_kernel_sysctl() {
|
||||||
|
install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/sysctl.d/99_local.hardened.ini" \
|
||||||
|
"${TARGET}/etc/sysctl.d/99_local.hardened"
|
||||||
|
do_log "info" "true" "Installed: '/etc/sysctl.d/99_local.hardened'."
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||||
@@ -22,7 +22,7 @@ guard_sourcing
|
|||||||
# VAR_FINAL_IPV4
|
# VAR_FINAL_IPV4
|
||||||
# VAR_FINAL_IPV6
|
# VAR_FINAL_IPV6
|
||||||
# VAR_SETUP_PATH
|
# VAR_SETUP_PATH
|
||||||
# user_ssh_port
|
# ssh_port
|
||||||
# user_user0_name
|
# user_user0_name
|
||||||
# Arguments:
|
# Arguments:
|
||||||
# None
|
# None
|
||||||
@@ -67,15 +67,15 @@ setup_ssh() {
|
|||||||
sed -i "/^\s*ListenAddress\s*::/d" "${TARGET}/etc/ssh/sshd_config"
|
sed -i "/^\s*ListenAddress\s*::/d" "${TARGET}/etc/ssh/sshd_config"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
sed -i "s/Port MUST_BE_CHANGED/Port ${user_ssh_port}/" "${TARGET}/etc/ssh/sshd_config"
|
sed -i "s/Port MUST_BE_CHANGED/Port ${ssh_port}/" "${TARGET}/etc/ssh/sshd_config"
|
||||||
|
|
||||||
if [[ -n "${user_user0_name}" ]]; then
|
if [[ -n "${user_user0_name}" ]]; then
|
||||||
sed -i "s/AllowUsers root/AllowUsers root ${ary_user[*]}/" "${TARGET}/etc/ssh/sshd_config"
|
sed -i "s/AllowUsers root/AllowUsers root ${ary_user[*]}/" "${TARGET}/etc/ssh/sshd_config"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [[ -n "${user_ssh_rootca}" ]]; then
|
if [[ -n "${ssh_root_ca}" ]]; then
|
||||||
install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${user_ssh_rootca}" "${TARGET}/etc/ssh/"
|
install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${ssh_root_ca}" "${TARGET}/etc/ssh/"
|
||||||
sed -i "s/TrustedUserCAKeys none/TrustedUserCAKeys \/etc\/ssh\/${user_ssh_rootca}/" "${TARGET}/etc/ssh/sshd_config"
|
sed -i "s/TrustedUserCAKeys none/TrustedUserCAKeys \/etc\/ssh\/${ssh_root_ca}/" "${TARGET}/etc/ssh/sshd_config"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
do_in_target_script "${TARGET}" "sshd -T >| ${DIR_LOG}/sshd_config.log"
|
do_in_target_script "${TARGET}" "sshd -T >| ${DIR_LOG}/sshd_config.log"
|
||||||
|
|||||||
@@ -27,15 +27,14 @@ guard_sourcing
|
|||||||
# VAR_SETUP_PATH
|
# VAR_SETUP_PATH
|
||||||
# network_static_ipv4nameserver_0
|
# network_static_ipv4nameserver_0
|
||||||
# network_static_ipv4nameserver_1
|
# network_static_ipv4nameserver_1
|
||||||
# user_bastion_enable
|
# ssh_allow_ipv4_0
|
||||||
# user_bastion_ipv4_0
|
|
||||||
# dropbear_dhcp
|
# dropbear_dhcp
|
||||||
# dropbear_firewall
|
# dropbear_firewall
|
||||||
# user_root_ssh_pubkeys_0
|
# user_root_ssh_pubkeys_0
|
||||||
# user_root_ssh_pubkeys_1
|
# user_root_ssh_pubkeys_1
|
||||||
# user_root_ssh_pubkeys_2
|
# user_root_ssh_pubkeys_2
|
||||||
# user_root_ssh_pubkeys_3
|
# user_root_ssh_pubkeys_3
|
||||||
# user_ssh_port
|
# ssh_port
|
||||||
# Arguments:
|
# Arguments:
|
||||||
# None
|
# None
|
||||||
# Returns:
|
# Returns:
|
||||||
@@ -138,15 +137,14 @@ EOF
|
|||||||
install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/dropbear_fw.sh" \
|
install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/dropbear_fw.sh" \
|
||||||
"${TARGET}/includes/initramfs-tools/files/"
|
"${TARGET}/includes/initramfs-tools/files/"
|
||||||
|
|
||||||
if [[ "${dropbear_firewall,,}" == "true" && -n "${user_bastion_ipv4_0}" ]]; then
|
if [[ "${dropbear_firewall,,}" == "true" && -n "${ssh_allow_ipv4_0}" ]]; then
|
||||||
|
|
||||||
sed -i 's/^DROPBEAR_FIREWALL_ENABLED=0$/DROPBEAR_FIREWALL_ENABLED=1/' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
|
sed -i 's/^DROPBEAR_FIREWALL_ENABLED=0$/DROPBEAR_FIREWALL_ENABLED=1/' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
|
||||||
sed -i '/^# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh$/d' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
|
sed -i '/^# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh$/d' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
|
||||||
|
|
||||||
cat << EOF >> "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
|
cat << EOF >> "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
|
||||||
DROPBEAR_PORT=${dropbear_port}
|
DROPBEAR_PORT=${dropbear_port}
|
||||||
DROPBEAR_JUMP_SERVER_IP=${user_bastion_ipv4_0}
|
DROPBEAR_JUMP_SERVER_IP=${ssh_allow_ipv4_0}
|
||||||
DROPBEAR_BASTION_ENABLE=${user_bastion_enable}
|
|
||||||
|
|
||||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||||
EOF
|
EOF
|
||||||
@@ -165,7 +163,7 @@ EOF
|
|||||||
# Write '/etc/dropbear/initramfs/dropbear.conf'.
|
# Write '/etc/dropbear/initramfs/dropbear.conf'.
|
||||||
# Globals:
|
# Globals:
|
||||||
# TARGET
|
# TARGET
|
||||||
# user_ssh_port
|
# ssh_port
|
||||||
# Arguments:
|
# Arguments:
|
||||||
# None
|
# None
|
||||||
# Returns:
|
# Returns:
|
||||||
@@ -188,7 +186,7 @@ write_dropbear_conf() {
|
|||||||
# -K: Keepalive interval in seconds
|
# -K: Keepalive interval in seconds
|
||||||
# -p: Specify port (and optionally address)
|
# -p: Specify port (and optionally address)
|
||||||
# -w: Disable root login (SHOULD NOT be implemented for initramfs)
|
# -w: Disable root login (SHOULD NOT be implemented for initramfs)
|
||||||
DROPBEAR_OPTIONS="-b /etc/dropbear/initramfs/banner -c /usr/local/bin/unlock_wrapper.sh -E -I 300 -K 60 -p ${user_ssh_port:-2222}"
|
DROPBEAR_OPTIONS="-b /etc/dropbear/initramfs/banner -c /usr/local/bin/unlock_wrapper.sh -E -I 300 -K 60 -p ${dropbear_port:-2222}"
|
||||||
|
|
||||||
#
|
#
|
||||||
# On local (non-NFS) mounts, interfaces matching this pattern are
|
# On local (non-NFS) mounts, interfaces matching this pattern are
|
||||||
|
|||||||
@@ -18,16 +18,6 @@
|
|||||||
#
|
#
|
||||||
# IPv6 is not supported in initramfs at this stage due to complexity.
|
# IPv6 is not supported in initramfs at this stage due to complexity.
|
||||||
# Only trusted IPv4 addresses are allowed.
|
# Only trusted IPv4 addresses are allowed.
|
||||||
#
|
|
||||||
# ┌─────────────────────────────────────────────────────────────┐
|
|
||||||
# │ ACCESS LOGIC: │
|
|
||||||
# │ │
|
|
||||||
# │ - If is_jump_host = true: │
|
|
||||||
# │ then allow all IPv4 connections to the Dropbear port │
|
|
||||||
# │ │
|
|
||||||
# │ - If is_jump_host = false: │
|
|
||||||
# │ then allow only the bastion/jump-server IPv4 address │
|
|
||||||
# └─────────────────────────────────────────────────────────────┘
|
|
||||||
|
|
||||||
PREREQ="dropbear"
|
PREREQ="dropbear"
|
||||||
|
|
||||||
@@ -42,6 +32,8 @@ DROPBEAR_FW_CONF="/etc/initramfs-tools/conf.d/dropbear_fw.cnf"
|
|||||||
if [ -f "${DROPBEAR_FW_CONF}" ]; then
|
if [ -f "${DROPBEAR_FW_CONF}" ]; then
|
||||||
# shellcheck disable=SC1090
|
# shellcheck disable=SC1090
|
||||||
. "${DROPBEAR_FW_CONF}"
|
. "${DROPBEAR_FW_CONF}"
|
||||||
|
else
|
||||||
|
DROPBEAR_FIREWALL_ENABLED=0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
### Abort if the firewall flag is not set or disabled.
|
### Abort if the firewall flag is not set or disabled.
|
||||||
@@ -65,17 +57,8 @@ if command -v iptables >/dev/null 2>&1; then
|
|||||||
### Allow local loopback.
|
### Allow local loopback.
|
||||||
iptables -A INPUT -i lo -j ACCEPT
|
iptables -A INPUT -i lo -j ACCEPT
|
||||||
|
|
||||||
### Access control based on the host role.
|
|
||||||
if [ "${DROPBEAR_BASTION_ENABLE}" = true ]; then
|
|
||||||
|
|
||||||
### SSH Bastion Host: allow any source IP on the dropbear SSH port.
|
|
||||||
iptables -A INPUT -p tcp --dport "${DROPBEAR_PORT}" -j ACCEPT
|
|
||||||
|
|
||||||
else
|
|
||||||
|
|
||||||
### Infrastructure host / Jump-Server / VPN-Exit-Node: only allow SSH from the specified IPv4.
|
### Infrastructure host / Jump-Server / VPN-Exit-Node: only allow SSH from the specified IPv4.
|
||||||
iptables -A INPUT -p tcp --dport "${DROPBEAR_PORT}" -s "${DROPBEAR_JUMP_SERVER_IP}" -j ACCEPT
|
iptables -A INPUT -p tcp --dport "${DROPBEAR_PORT}" -s "${DROPBEAR_JUMP_SERVER_IP}" -j ACCEPT
|
||||||
fi
|
|
||||||
|
|
||||||
fi
|
fi
|
||||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||||
|
|||||||
Reference in New Issue
Block a user