Update remediate.sh
This commit is contained in:
+48
-48
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
###############################################################################
|
||||
# NIST 800-53 / CIS Remediation Script – Fixes Wazuh SCA Failures
|
||||
# NIST 800-53 / CIS Remediation Script - Fixes Wazuh SCA Failures
|
||||
# Ubuntu 24.04 LTS (Proxmox VM Template)
|
||||
#
|
||||
# Run as root after the initial hardening script.
|
||||
@@ -17,7 +17,7 @@ banner() { printf '\n\e[1;36m>>> %s\e[0m\n' "$1"; }
|
||||
if [[ $EUID -ne 0 ]]; then echo "Run as root." >&2; exit 1; fi
|
||||
|
||||
###############################################################################
|
||||
# 35509 – Disable additional unused filesystem kernel modules
|
||||
# 35509 - Disable additional unused filesystem kernel modules
|
||||
###############################################################################
|
||||
banner "35509: Disable unused filesystem kernel modules"
|
||||
|
||||
@@ -59,7 +59,7 @@ blacklist smbfs
|
||||
EOF
|
||||
|
||||
###############################################################################
|
||||
# 35522 – Add nodev to /var mount
|
||||
# 35522 - Add nodev to /var mount
|
||||
###############################################################################
|
||||
banner "35522: Add nodev to /var mount"
|
||||
|
||||
@@ -69,7 +69,7 @@ if grep -q 'vg_nist/lv_var ' /etc/fstab; then
|
||||
fi
|
||||
|
||||
###############################################################################
|
||||
# 35537 – Enable AppArmor in bootloader
|
||||
# 35537 - Enable AppArmor in bootloader
|
||||
###############################################################################
|
||||
banner "35537: AppArmor in GRUB + audit at boot"
|
||||
|
||||
@@ -93,7 +93,7 @@ fi
|
||||
update-grub
|
||||
|
||||
###############################################################################
|
||||
# 35540 – Bootloader password (informational — uncomment to enable)
|
||||
# 35540 - Bootloader password (informational — uncomment to enable)
|
||||
###############################################################################
|
||||
banner "35540: Bootloader password (MANUAL STEP)"
|
||||
echo " To set a GRUB password:"
|
||||
@@ -105,7 +105,7 @@ echo " 3. Run: update-grub"
|
||||
echo " Skipping — requires interactive input."
|
||||
|
||||
###############################################################################
|
||||
# 35545 – Disable Apport (automatic error reporting)
|
||||
# 35545 - Disable Apport (automatic error reporting)
|
||||
###############################################################################
|
||||
banner "35545: Disable Apport"
|
||||
|
||||
@@ -115,14 +115,14 @@ systemctl mask apport.service 2>/dev/null || true
|
||||
apt-get purge -y apport 2>/dev/null || true
|
||||
|
||||
###############################################################################
|
||||
# 35573, 35585, 35587 – Remove rsync, telnet, ftp
|
||||
# 35573, 35585, 35587 - Remove rsync, telnet, ftp
|
||||
###############################################################################
|
||||
banner "35573/35585/35587: Remove rsync, telnet, ftp"
|
||||
|
||||
apt-get purge -y rsync telnet inetutils-telnet ftp tnftp 2>/dev/null || true
|
||||
|
||||
###############################################################################
|
||||
# 35589 – Time sync: Wazuh wants systemd-timesyncd but we use chrony
|
||||
# 35589 - Time sync: Wazuh wants systemd-timesyncd but we use chrony
|
||||
# Disable timesyncd cleanly since chrony is our NTP (AU-8)
|
||||
###############################################################################
|
||||
banner "35589: Time sync — chrony is authoritative"
|
||||
@@ -135,7 +135,7 @@ echo " chrony is running as the NTP source (AU-8). timesyncd masked."
|
||||
echo " If Wazuh still flags this, add an exception — chrony satisfies the control."
|
||||
|
||||
###############################################################################
|
||||
# 35600, 35601 – Restrict cron and at to authorized users
|
||||
# 35600, 35601 - Restrict cron and at to authorized users
|
||||
###############################################################################
|
||||
banner "35600/35601: Restrict cron and at"
|
||||
|
||||
@@ -151,7 +151,7 @@ chmod 640 /etc/at.allow
|
||||
chown root:root /etc/at.allow
|
||||
|
||||
###############################################################################
|
||||
# 35604-35607 – Disable network protocol kernel modules properly
|
||||
# 35604-35607 - Disable network protocol kernel modules properly
|
||||
###############################################################################
|
||||
banner "35604-35607: Disable unused network kernel modules"
|
||||
|
||||
@@ -170,7 +170,7 @@ blacklist tipc
|
||||
EOF
|
||||
|
||||
###############################################################################
|
||||
# 35619-35639 – Firewall: configure UFW properly
|
||||
# 35619-35639 - Firewall: configure UFW properly
|
||||
# CIS checks all three frameworks. We use UFW — nftables/iptables checks
|
||||
# will show "failed" because those aren't our chosen tool. That's expected.
|
||||
###############################################################################
|
||||
@@ -209,7 +209,7 @@ ufw --force enable
|
||||
ufw status verbose
|
||||
|
||||
###############################################################################
|
||||
# 35641-35642 – SSH host key permissions
|
||||
# 35641-35642 - SSH host key permissions
|
||||
# Keys were removed for template prep. Regenerate them now for testing;
|
||||
# the firstboot service will regenerate on each clone.
|
||||
###############################################################################
|
||||
@@ -226,7 +226,7 @@ chmod 644 /etc/ssh/ssh_host_*_key.pub
|
||||
chown root:root /etc/ssh/ssh_host_*
|
||||
|
||||
###############################################################################
|
||||
# 35643-35661 – SSH configuration (complete rewrite)
|
||||
# 35643-35661 - SSH configuration (complete rewrite)
|
||||
###############################################################################
|
||||
banner "35643-35661: Complete SSH hardening"
|
||||
|
||||
@@ -288,7 +288,7 @@ sshd -t && systemctl restart ssh
|
||||
echo " SSH config validated and restarted."
|
||||
|
||||
###############################################################################
|
||||
# 35664 – Sudo log file
|
||||
# 35664 - Sudo log file
|
||||
###############################################################################
|
||||
banner "35664: Sudo logging"
|
||||
|
||||
@@ -297,7 +297,7 @@ if ! grep -q 'Defaults.*logfile' /etc/sudoers; then
|
||||
fi
|
||||
|
||||
###############################################################################
|
||||
# 35668 – Restrict su to sudo group
|
||||
# 35668 - Restrict su to sudo group
|
||||
###############################################################################
|
||||
banner "35668: Restrict su command"
|
||||
|
||||
@@ -306,7 +306,7 @@ sed -i '/pam_wheel.so/d' /etc/pam.d/su
|
||||
echo "auth required pam_wheel.so use_uid group=sudo" >> /etc/pam.d/su
|
||||
|
||||
###############################################################################
|
||||
# 35672-35690 – PAM configuration (complete)
|
||||
# 35672-35690 - PAM configuration (complete)
|
||||
###############################################################################
|
||||
banner "35672-35690: PAM configuration"
|
||||
|
||||
@@ -360,7 +360,7 @@ session optional pam_systemd.so
|
||||
EOF
|
||||
|
||||
###############################################################################
|
||||
# 35681, 35683 – Password quality (maxsequence)
|
||||
# 35681, 35683 - Password quality (maxsequence)
|
||||
###############################################################################
|
||||
banner "35681/35683: Password quality — maxsequence"
|
||||
|
||||
@@ -381,7 +381,7 @@ enforcing = 1
|
||||
EOF
|
||||
|
||||
###############################################################################
|
||||
# 35694, 35695, 35698 – Password expiration and inactive lock
|
||||
# 35694, 35695, 35698 - Password expiration and inactive lock
|
||||
###############################################################################
|
||||
banner "35694/35695/35698: Password aging and inactive lock"
|
||||
|
||||
@@ -399,7 +399,7 @@ for user in $(awk -F: '($3 >= 1000) && ($7 != "/usr/sbin/nologin") {print $1}' /
|
||||
done
|
||||
|
||||
###############################################################################
|
||||
# 35703 – Root umask
|
||||
# 35703 - Root umask
|
||||
###############################################################################
|
||||
banner "35703: Root user umask"
|
||||
|
||||
@@ -421,7 +421,7 @@ if ! grep -q 'umask 027' /root/.bash_profile; then
|
||||
fi
|
||||
|
||||
###############################################################################
|
||||
# 35708 – Journald log rotation
|
||||
# 35708 - Journald log rotation
|
||||
###############################################################################
|
||||
banner "35708: Journald configuration"
|
||||
|
||||
@@ -440,7 +440,7 @@ EOF
|
||||
systemctl restart systemd-journald
|
||||
|
||||
###############################################################################
|
||||
# 35719 – rsyslog file creation mode
|
||||
# 35719 - rsyslog file creation mode
|
||||
###############################################################################
|
||||
banner "35719: rsyslog file creation mode"
|
||||
|
||||
@@ -453,7 +453,7 @@ EOF
|
||||
systemctl restart rsyslog
|
||||
|
||||
###############################################################################
|
||||
# 35720 – rsyslog remote logging (placeholder)
|
||||
# 35720 - rsyslog remote logging (placeholder)
|
||||
###############################################################################
|
||||
banner "35720: rsyslog remote logging"
|
||||
echo " Wazuh is handling remote log collection."
|
||||
@@ -462,7 +462,7 @@ echo " *.* @@your-syslog-server:514"
|
||||
echo " Skipping — environment-specific."
|
||||
|
||||
###############################################################################
|
||||
# 35722 – Log file permissions
|
||||
# 35722 - Log file permissions
|
||||
###############################################################################
|
||||
banner "35722: Fix log file permissions"
|
||||
|
||||
@@ -470,12 +470,12 @@ find /var/log -type f -exec chmod g-wx,o-rwx {} +
|
||||
find /var/log -type d -exec chmod g-w,o-rwx {} +
|
||||
|
||||
###############################################################################
|
||||
# 35725, 35726 – Audit at boot (handled above in GRUB section)
|
||||
# 35725, 35726 - Audit at boot (handled above in GRUB section)
|
||||
###############################################################################
|
||||
banner "35725/35726: Audit at boot — handled in GRUB section above"
|
||||
|
||||
###############################################################################
|
||||
# 35728-35730 – Auditd configuration
|
||||
# 35728-35730 - Auditd configuration
|
||||
###############################################################################
|
||||
banner "35728-35730: Auditd log management"
|
||||
|
||||
@@ -492,7 +492,7 @@ grep -q '^space_left_action' /etc/audit/auditd.conf || echo 'space_left_action =
|
||||
grep -q '^admin_space_left_action' /etc/audit/auditd.conf || echo 'admin_space_left_action = halt' >> /etc/audit/auditd.conf
|
||||
|
||||
###############################################################################
|
||||
# 35731-35748 – Comprehensive audit rules (CIS complete)
|
||||
# 35731-35748 - Comprehensive audit rules (CIS complete)
|
||||
###############################################################################
|
||||
banner "35731-35748: CIS-compliant audit rules"
|
||||
|
||||
@@ -506,23 +506,23 @@ cat > /etc/audit/rules.d/cis-nist.rules <<'AUDITRULES'
|
||||
## Failure mode
|
||||
-f 1
|
||||
|
||||
## 35731 – Sudoers changes
|
||||
## 35731 - Sudoers changes
|
||||
-w /etc/sudoers -p wa -k scope
|
||||
-w /etc/sudoers.d -p wa -k scope
|
||||
|
||||
## 35732 – Actions as another user
|
||||
## 35732 - Actions as another user
|
||||
-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation
|
||||
-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation
|
||||
|
||||
## 35733 – Sudo log file events
|
||||
## 35733 - Sudo log file events
|
||||
-w /var/log/sudo.log -p wa -k sudo_log
|
||||
|
||||
## 35734 – Date and time changes
|
||||
## 35734 - Date and time changes
|
||||
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
|
||||
-a always,exit -F arch=b32 -S adjtimex,settimeofday,clock_settime -k time-change
|
||||
-w /etc/localtime -p wa -k time-change
|
||||
|
||||
## 35735 – Network environment changes
|
||||
## 35735 - Network environment changes
|
||||
-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
|
||||
-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale
|
||||
-w /etc/issue -p wa -k system-locale
|
||||
@@ -531,20 +531,20 @@ cat > /etc/audit/rules.d/cis-nist.rules <<'AUDITRULES'
|
||||
-w /etc/hostname -p wa -k system-locale
|
||||
-w /etc/netplan/ -p wa -k system-locale
|
||||
|
||||
## 35736 – Unsuccessful file access attempts
|
||||
## 35736 - Unsuccessful file access attempts
|
||||
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
|
||||
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
|
||||
-a always,exit -F arch=b32 -S open,truncate,ftruncate,creat,openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access
|
||||
-a always,exit -F arch=b32 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access
|
||||
|
||||
## 35737 – User/group information changes
|
||||
## 35737 - User/group information changes
|
||||
-w /etc/group -p wa -k identity
|
||||
-w /etc/passwd -p wa -k identity
|
||||
-w /etc/gshadow -p wa -k identity
|
||||
-w /etc/shadow -p wa -k identity
|
||||
-w /etc/security/opasswd -p wa -k identity
|
||||
|
||||
## 35738 – DAC permission modification
|
||||
## 35738 - DAC permission modification
|
||||
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod
|
||||
-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod
|
||||
-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -k perm_mod
|
||||
@@ -552,40 +552,40 @@ cat > /etc/audit/rules.d/cis-nist.rules <<'AUDITRULES'
|
||||
-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod
|
||||
-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -k perm_mod
|
||||
|
||||
## 35739 – Successful file system mounts
|
||||
## 35739 - Successful file system mounts
|
||||
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k mounts
|
||||
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k mounts
|
||||
|
||||
## 35740 – Session initiation
|
||||
## 35740 - Session initiation
|
||||
-w /var/run/utmp -p wa -k session
|
||||
-w /var/log/wtmp -p wa -k session
|
||||
-w /var/log/btmp -p wa -k session
|
||||
|
||||
## 35741 – Login and logout events
|
||||
## 35741 - Login and logout events
|
||||
-w /var/log/lastlog -p wa -k logins
|
||||
-w /var/run/faillock -p wa -k logins
|
||||
|
||||
## 35742 – File deletion events
|
||||
## 35742 - File deletion events
|
||||
-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=unset -k delete
|
||||
-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=unset -k delete
|
||||
|
||||
## 35743 – Mandatory Access Controls
|
||||
## 35743 - Mandatory Access Controls
|
||||
-w /etc/apparmor/ -p wa -k MAC-policy
|
||||
-w /etc/apparmor.d/ -p wa -k MAC-policy
|
||||
|
||||
## 35744 – chcon command
|
||||
## 35744 - chcon command
|
||||
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng
|
||||
|
||||
## 35745 – setfacl command
|
||||
## 35745 - setfacl command
|
||||
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng
|
||||
|
||||
## 35746 – chacl command
|
||||
## 35746 - chacl command
|
||||
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_chng
|
||||
|
||||
## 35747 – usermod command
|
||||
## 35747 - usermod command
|
||||
-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k usermod
|
||||
|
||||
## 35748 – Kernel module loading/unloading
|
||||
## 35748 - Kernel module loading/unloading
|
||||
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>=1000 -F auid!=unset -k kernel_modules
|
||||
-w /sbin/insmod -p x -k kernel_modules
|
||||
-w /sbin/rmmod -p x -k kernel_modules
|
||||
@@ -605,7 +605,7 @@ augenrules --load 2>/dev/null || true
|
||||
systemctl restart auditd 2>/dev/null || true
|
||||
|
||||
###############################################################################
|
||||
# 35752 – Audit config file permissions
|
||||
# 35752 - Audit config file permissions
|
||||
###############################################################################
|
||||
banner "35752: Audit configuration file permissions"
|
||||
|
||||
@@ -613,7 +613,7 @@ find /etc/audit/ -type f \( -name '*.conf' -o -name '*.rules' \) -exec chmod 640
|
||||
chown -R root:root /etc/audit/
|
||||
|
||||
###############################################################################
|
||||
# 35755 – Audit tools permissions
|
||||
# 35755 - Audit tools permissions
|
||||
###############################################################################
|
||||
banner "35755: Audit tools permissions"
|
||||
|
||||
@@ -625,7 +625,7 @@ for tool in /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/aud
|
||||
done
|
||||
|
||||
###############################################################################
|
||||
# 35760 – AIDE protects audit tools
|
||||
# 35760 - AIDE protects audit tools
|
||||
###############################################################################
|
||||
banner "35760: AIDE audit tool integrity"
|
||||
|
||||
@@ -640,7 +640,7 @@ cat > /etc/aide/aide.conf.d/99_audit_tools <<'EOF'
|
||||
EOF
|
||||
|
||||
###############################################################################
|
||||
# 35770 – opasswd permissions
|
||||
# 35770 - opasswd permissions
|
||||
###############################################################################
|
||||
banner "35770: opasswd file permissions"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user