Skip to content

Commit e28420d

Browse files
deajandeajan
committed
Rebuilt target
1 parent 851eb2e commit e28420d

File tree

1 file changed

+32
-30
lines changed

1 file changed

+32
-30
lines changed

‎ks.el9-10.cfg‎

Lines changed: 32 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -986,6 +986,7 @@ lang C.UTF-8
986986
# Security & basic setup configuration script from NetPerfect
987987
# Works with RHEL / AlmaLinux / RockyLinux / CentOS EL8, EL9 and EL10
988988
# Works with Debian 12
989+
# Works with Debian 13, although atm no scap profile is available as of 27-08-2025
989990

990991
SCRIPT_BUILD="2025080501"
991992

@@ -1022,6 +1023,7 @@ EOF
10221023
# Select SCAP PROFILE, choosing "" disables scap profile
10231024
# Get profile list with oscap info "/usr/share/xml/scap/ssg/content/ssg-${DIST}${RELEASE}-ds.xml"
10241025
# where flavor in rhel,debian and release = major os version
1026+
# See https://www.open-scap.org/download/
10251027
SCAP_PROFILE=anssi_bp28_high
10261028
#SCAP_PROFILE=anssi_bp28_intermediary
10271029
#SCAP_PROFILE=false
@@ -1072,6 +1074,10 @@ CONFIGURE_FAIL2BAN=true
10721074
# Optional whitelist IPs / CIDR for Fail2ban
10731075
FAIL2BAN_IGNORE_IP_LIST="${FIREWALL_WHITELIST_IP_LIST}"
10741076

1077+
# Optionl allow non protected fs symlinks
1078+
# Will be necessary for docker to write to /dev/stdout via mount --bind links
1079+
ALLOW_UNPROTECTED_FS_SYMLINKS=false
1080+
10751081
LOG_FILE=/root/.el-configurator.log
10761082

10771083
log() {
@@ -1167,17 +1173,18 @@ get_el_version() {
11671173
# DIST must contain "rhel", "almalinux", "debian" or alike
11681174
# The following awk line has been tested on almalinux 8, rhel 10 and debian 12
11691175
DIST=$(awk '{ if ($1~/^ID=/) { sub("ID=","", $0); gsub("\"","", $0); print tolower($0) }}' /etc/os-release)
1176+
RELEASE=0
11701177
if grep 'ID="rhel"' /etc/os-release > /dev/null || grep 'ID_LIKE="*rhel*' /etc/os-release > /dev/null; then
11711178
FLAVOR=rhel
11721179
if grep -e 'PLATFORM_ID=".*el10' /etc/os-release > /dev/null; then
11731180
RELEASE=10
1174-
SYSTEMD_PREFIX=/usr/lib/systemd
1181+
SYSTEMD_PREFIX=/usr/lib/systemd
11751182
elif grep -e 'PLATFORM_ID=".*el9' /etc/os-release > /dev/null; then
11761183
RELEASE=9
1177-
SYSTEMD_PREFIX=/etc/systemd
1184+
SYSTEMD_PREFIX=/etc/systemd
11781185
elif grep -e 'PLATFORM_ID=".*el8' /etc/os-release > /dev/null; then
11791186
RELEASE=8
1180-
SYSTEMD_PREFIX=/etc/systemd
1187+
SYSTEMD_PREFIX=/etc/systemd
11811188
else
11821189
log_quit "RHEL or alike release not compatible: dist=${DIST},flavor=${FLAVOR},release=${RELEASE}"
11831190
fi
@@ -1190,12 +1197,15 @@ get_el_version() {
11901197
FLAVOR=debian
11911198
if grep -e 'VERSION_ID="11' /etc/os-release > /dev/null; then
11921199
RELEASE=11
1193-
SYSTEMD_PREFIX=/etc/systemd
1200+
SYSTEMD_PREFIX=/etc/systemd
11941201
elif grep -e 'VERSION_ID="12' /etc/os-release > /dev/null; then
11951202
RELEASE=12
1196-
SYSTEMD_PREFIX=/etc/systemd
1203+
SYSTEMD_PREFIX=/etc/systemd
1204+
elif grep -e 'VERSION_ID="13' /etc/os-release > /dev/null; then
1205+
RELEASE=13
1206+
SYSTEMD_PREFIX=/etc/systemd
11971207
fi
1198-
if [ "${RELEASE}" -eq 11 ] || [ "${RELEASE}" -eq 12 ]; then
1208+
if [ "${RELEASE}" -eq 11 ] || [ "${RELEASE}" -eq 12 ] || [ "${RELEASE}" -eq 13 ]; then
11991209
log "Found Linux ${DIST} release ${RELEASE}"
12001210
else
12011211
log_quit "Not compatible with ${DIST} release ${RELEASE} "
@@ -1331,22 +1341,7 @@ if [ "${SCAP_PROFILE}" != false ]; then
13311341
if [ "${FLAVOR}" = "rhel" ]; then
13321342
dnf install -y openscap scap-security-guide 2> "${LOG_FILE}" || log "OpenSCAP is missing and cannot be installed" "ERROR"
13331343
elif [ "${FLAVOR}" = "debian" ]; then
1334-
# Download debian 12 anssi profiles which need ssg-debian 0.17.4 at least
1335-
# which are not available in stable as of 2025/02/14
1336-
# As of 2025/04/24, ssg-debian 0.1.76-1 is the most recent release one can get
1337-
if [ "${RELEASE}" -eq 12 ]; then
1338-
log "Downloading up ssg openscap data for debian 12"
1339-
if type curl > /dev/null 2>&1; then
1340-
curl -OL http://ftp.debian.org/debian/pool/main/s/scap-security-guide/ssg-base_0.1.76-1_all.deb 2> "${LOG_FILE}" || log "OpenSCAP new deb 12 profiles ssg-base cannot be downloaded with curl" "ERROR"
1341-
curl -OL http://ftp.debian.org/debian/pool/main/s/scap-security-guide/ssg-debian_0.1.76-1_all.deb 2> "${LOG_FILE}" || log "OpenSCAP new deb 12 profiles ssg-debian cannot be downloaded with curl" "ERROR"
1342-
else
1343-
wget http://ftp.debian.org/debian/pool/main/s/scap-security-guide/ssg-base_0.1.76-1_all.deb 2> "${LOG_FILE}" || log "OpenSCAP new deb 12 profiles ssg-base cannot be downloaded with wget" "ERROR"
1344-
wget http://ftp.debian.org/debian/pool/main/s/scap-security-guide/ssg-debian_0.1.76-1_all.deb 2> "${LOG_FILE}" || log "OpenSCAP new deb 12 profiles ssg-debian cannot be downloaded with wget" "ERROR"
1345-
fi
1346-
dpkg -i ssg-base_0.1.76-1_all.deb 2> "${LOG_FILE}" || log "OpenSCAP new deb 12 profiles ssg-base cannot be installed" "ERROR"
1347-
dpkg -i ssg-debian_0.1.76-1_all.deb 2> "${LOG_FILE}" || log "OpenSCAP new deb 12 profiles ssg-debian cannot be installed" "ERROR"
1348-
fi
1349-
apt install -y openscap-utils 2> "${LOG_FILE}" || log "OpenSCAP is missing and cannot be installed" "ERROR"
1344+
apt install -y openscap-utils ssg-base ssg-debderived ssg-debian ssg-applications 2> "${LOG_FILE}" || log "OpenSCAP is missing and cannot be installed" "ERROR"
13501345
else
13511346
log_quit "Cannot setup OpenSCAP on this system"
13521347
fi
@@ -1396,8 +1391,8 @@ fi
13961391
check_internet
13971392
if [ $? -eq 0 ]; then
13981393
log "Install available with internet. setting up additional packages."
1399-
dnf install -4 -y tar >> "${LOG_FILE}" || log "Cannot install tar" "ERROR"
14001394
if [ "${FLAVOR}" = "rhel" ]; then
1395+
dnf install -4 -y tar >> "${LOG_FILE}" || log "Cannot install tar" "ERROR"
14011396
dnf install -4 -y epel-release 2>> "${LOG_FILE}" || log "Failed to install epel-release, some tools like fail2ban will not be installed" "ERROR"
14021397
# The following packages are epel dependent
14031398
# WIP: RHEL 10 ha no atop nor nmon for the moment
@@ -1417,6 +1412,7 @@ if [ $? -eq 0 ]; then
14171412
dnf install -4 -y tuned 2>> "${LOG_FILE}" || log "Failed to install tuned" "ERROR"
14181413
fi
14191414
elif [ "${FLAVOR}" = "debian" ]; then
1415+
apt install -y tar 2>> "${LOG_FILE}" || log "Cannot install tar" "ERROR"
14201416
apt install -y htop atop nmon iftop iptraf-ng tar 2>> "${LOG_FILE}" || log "Failed to install additional tools" "ERROR"
14211417
if [ "${CONFIGURE_AUTOMATIC_UPDATES}" != false ]; then
14221418
apt install -y unattended-upgrades 2>> "${LOG_FILE}" || log "Failed to install unattended-upgrades" "ERROR"
@@ -2714,10 +2710,10 @@ if [ "${CONFIGURE_AUTOMATIC_UPDATES}" != false ]; then
27142710
if [ "${FLAVOR}" = "rhel" ]; then
27152711
log "Setup DNF automatic except for updates that require reboot"
27162712
auto_upgrades_file="/etc/dnf/automatic.conf"
2717-
set_conf_value "${auto_upgrades_file}" "upgrade_type" "security" " = "
2718-
set_conf_value "${auto_upgrades_file}" "download_updates" "yes" " = "
2719-
set_conf_value "${auto_upgrades_file}" "apply_updates" "yes" " = "
2720-
set_conf_value "${auto_upgrades_file}" "emit_via" "stdio" " = "
2713+
set_conf_value "${auto_upgrades_file}" "upgrade_type" "security" "="
2714+
set_conf_value "${auto_upgrades_file}" "download_updates" "yes" "="
2715+
set_conf_value "${auto_upgrades_file}" "apply_updates" "yes" "="
2716+
set_conf_value "${auto_upgrades_file}" "emit_via" "stdio" "="
27212717
systemctl enable dnf-automatic.timer 2>> "${LOG_FILE}" || log "Failed to start dnf-automatic timer" "ERROR"
27222718
elif [ "${FLAVOR}" = "debian" ]; then
27232719
log "Setup unattended automatic upgrades"
@@ -2831,7 +2827,7 @@ if [ "${CONFIGURE_FAIL2BAN}" != false ]; then
28312827
systemctl enable fail2ban 2>> "${LOG_FILE}" || log "Failed to enable fail2ban" "ERROR"
28322828
# Starting fail2ban may need a reboot to work, so let's not log start failures here
28332829
systemctl start fail2ban
2834-
fi
2830+
fi
28352831
fi
28362832

28372833
# Enable guest agent on KVM
@@ -2890,6 +2886,12 @@ EOF
28902886
chmod +x /usr/local/bin/el_configurator_metrics.sh || log "Failed to chmod /usr/local/bin/el_configurator_metrics.sh" "ERROR"
28912887
fi
28922888

2889+
if [ "${ALLOW_UNPROTECTED_FS_SYMLINKS}" != false ]; then
2890+
log "Allowing unprotected symlinks in filesystems"
2891+
sysctl -w fs.protected_symlinks=0 2>> "${LOG_FILE}" || log "Failed to set fs.protected_symlinks at runtime" "ERROR"
2892+
set_conf_value /etc/sysctl.d/99-fs-symlinks.conf "fs.protected_symlinks" "0" || log "Failed to set fs.protected_symlinks in /etc/sysctl.d/99-fs-symlinks.conf" "ERROR"
2893+
fi
2894+
28932895
# Setting up watchdog in systemd
28942896
if [ "${CONFIGURE_WATCHDOG}" != false ]; then
28952897
log "Setting up systemd watchdog"
@@ -2912,14 +2914,14 @@ fi
29122914
if [ "${ALLOW_SUDO}" = true ] && [ "${SCAP_PROFILE}" != false ]; then
29132915
log "Allowing sudo command regardless of scap profile ${SCAP_PROFILE}"
29142916
# Patch sudoers file since noexec is set by default, which prevents sudo
2915-
sed -i 's/^Defaults noexec/#Defaults noexec/g' /etc/sudoers 2>> "${LOG_FILE}" || log "Failed to sed /etc/sudoers" "ERROR"
2916-
if [ "${FLAVOR}" = "rhel" ]; then
2917+
if [ "${FLAVOR}" = "rhel" ]; then
29172918
dnf install -y sudo 2>> "${LOG_FILE}" || log "Failed to install sudo" "ERROR"
29182919
# chmod 4111 /usr/bin/sudo is not needed on RHEL normally
29192920
elif [ "${FLAVOR}" = "debian" ]; then
29202921
apt install -y sudo 2>> "${LOG_FILE}" || log "Failed to install sudo" "ERROR"
29212922
chmod 4755 /usr/bin/sudo 2>> "${LOG_FILE}" || log "Failed to chmod /usr/bin/sudo" "ERROR"
29222923
fi
2924+
sed -i 's/^Defaults noexec/#Defaults noexec/g' /etc/sudoers 2>> "${LOG_FILE}" || log "Failed to sed /etc/sudoers" "ERROR"
29232925
else
29242926
log "Not altering sudo behavior"
29252927
fi

0 commit comments

Comments
 (0)