From 789e3ccb5deea012d36683ff126e2fef02a04b2c Mon Sep 17 00:00:00 2001 From: matt Date: Thu, 5 Sep 2024 18:31:30 +0200 Subject: [PATCH] Hardening SSH, appending iptables rules, adding iptables persistence --- 0 | 0 install.sh | 10 +++++++--- iptables/iptables-config.sh | 2 ++ iptables/rules.v4 | 17 +++++++++++++++++ sshd-config.sh | 9 +++++++++ 5 files changed, 35 insertions(+), 3 deletions(-) delete mode 100644 0 create mode 100755 iptables/iptables-config.sh create mode 100644 iptables/rules.v4 create mode 100755 sshd-config.sh diff --git a/0 b/0 deleted file mode 100644 index e69de29..0000000 diff --git a/install.sh b/install.sh index 481a5f1..362a232 100644 --- a/install.sh +++ b/install.sh @@ -5,8 +5,12 @@ # ln -sv “~/.dotfiles/runcom/.inputrc” ~ # ln -sv “~/.dotfiles/git/.gitconfig” ~ -# Setup our apt repos -./apt-repos.sh +# Safety first +./sshd-config.sh +./iptables/iptables-config.sh + +# Setup apt repos and install some of our favorites +./apt-install.sh # Install a retro looking font that I like to use in my terminal ./install-fonts.sh @@ -16,4 +20,4 @@ paste ~/.vimrc ./vimrc > ~/vimrc.new mv ~/.vimrc ~/.vimrc.bak mv ~/vimrc.new ~/.vimrc -./vim-setup.sh \ No newline at end of file +./vim-setup.sh diff --git a/iptables/iptables-config.sh b/iptables/iptables-config.sh new file mode 100755 index 0000000..6dc4cc1 --- /dev/null +++ b/iptables/iptables-config.sh @@ -0,0 +1,2 @@ +apt install -q -y iptables-persistent +yes | cp -rf ./rules.v4 /etc/iptables/rules.v4 diff --git a/iptables/rules.v4 b/iptables/rules.v4 new file mode 100644 index 0000000..103d3fc --- /dev/null +++ b/iptables/rules.v4 @@ -0,0 +1,17 @@ +# Generated by iptables-save v1.8.9 (nf_tables) on Thu Sep 5 12:02:50 2024 +*filter +:INPUT DROP [78122:5351686] +:FORWARD DROP [0:0] +-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 10 --hitcount 10 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP +-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource +-A INPUT -i eth0 -m set --match-set hostile-countries src -j DROP +-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource +-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 10 --hitcount 10 --name DEFAULT --mask 255.255.255.255 --rsource -j DROP +-A INPUT -i wg2 -j ACCEPT +-A INPUT -p udp -m udp --dport 51823 -j ACCEPT +-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd +-A INPUT -i wg0 -j ACCEPT +-A INPUT -p udp -m udp --dport 52821 -j ACCEPT +-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT +-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT +-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT diff --git a/sshd-config.sh b/sshd-config.sh new file mode 100755 index 0000000..fa70a27 --- /dev/null +++ b/sshd-config.sh @@ -0,0 +1,9 @@ +sudo -i +rm /etc/ssh/ssh_host_* +ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N "" +ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N "" +awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe +mv /etc/ssh/moduli.safe /etc/ssh/moduli +echo -e "# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\n +KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group14-sha256,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\n\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\n\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\n\nHostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256\n\nRequiredRSASize 3072\n\nCASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256\n\nGSSAPIKexAlgorithms gss-curve25519-sha256-,gss-group16-sha512-\n\nHostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256\n\nPubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256\n\n" > /etc/ssh/sshd_config.d/ssh-audit_hardening.conf +service ssh restart