feat(install): security baseline: fail2ban, unattended-upgrades, sshd hardening
Always applied in the Linux block, no prompt, idempotent: - install_fail2ban: fail2ban + nftables, etc/fail2ban/jail.d/local.conf. sshd jail reads the journal (backend systemd, works with or without auth.log) and bans the offender on every port, so the SSH port is irrelevant: the previous server's jail banned 22 while sshd listened on 337. 5 failures / 10 min / 1 h. Loopback + RFC1918 never banned. - install_unattended_upgrades: package + 20auto-upgrades (the file dpkg-reconfigure writes, without the prompt). - harden_sshd: sshd_config.d/20-hardening.conf (PermitRootLogin no, MaxAuthTries 3, LoginGraceTime 20), sshd -t gated: a rejected file is removed and the install continues with a warning. Auth methods, port and user lists untouched. Docs: README table + step 13 + packages, CLAUDE.md layout.
This commit is contained in:
bastien
@@ -50,3 +50,13 @@ Root cause: /tmp is tmpfs (50% RAM) → agents fill it → RAM halved + ENOSPC b
|
||||
- [x] reconcile: merge main (a210d01 dtach) into develop via lib helper
|
||||
- [x] gitflow finish feature → develop (explicit user signal: "puis merge")
|
||||
- [x] runbook for live apply on this machine
|
||||
|
||||
## Feature — security baseline in install.sh (2026-09-22)
|
||||
Branch: feature/security-baseline (off develop). Scope approved: fail2ban, unattended-upgrades, sshd hardening. auditd + ufw declined.
|
||||
- [x] etc/fail2ban/jail.d/local.conf — sshd jail, backend systemd, allports ban, RFC1918 ignoreip
|
||||
- [x] etc/apt/apt.conf.d/20auto-upgrades — Periodic Update-Package-Lists + Unattended-Upgrade = 1
|
||||
- [x] etc/ssh/sshd_config.d/20-hardening.conf — PermitRootLogin no, MaxAuthTries 3, LoginGraceTime 20
|
||||
- [x] install.sh: install_fail2ban / install_unattended_upgrades / harden_sshd (sshd -t gated), called in Linux block
|
||||
- [x] README.md (table, step 13, packages) + CLAUDE.md layout
|
||||
- [x] shellcheck + bash -n; stub harness harden_sshd (accept / reject paths); configparser check of jail file
|
||||
- [x] commit; registries (BDR-013, LRN-012); runbook. No finish without explicit signal.
|
||||
|
||||
@@ -26,6 +26,9 @@ etc/profile.d/disk-usage-warning.sh login-time low-disk warning → /etc/pro
|
||||
etc/tmpfiles.d/tmp.conf disk-backed /tmp cleanup rules (offer: /tmp on disk)
|
||||
etc/systemd/ssh.service.d/override.conf sshd OOM-exempt drop-in (offer: SSH memory guard)
|
||||
etc/default/earlyoom earlyoom args, spare sshd / kill node first (same offer)
|
||||
etc/fail2ban/jail.d/local.conf sshd jail: journal backend, all-ports ban, LAN ignored (always)
|
||||
etc/apt/apt.conf.d/20auto-upgrades unattended security upgrades on (always)
|
||||
etc/ssh/sshd_config.d/20-hardening.conf sshd limits that cannot lock out, sshd -t gated (always)
|
||||
cloudpex/{cloudpex,install.sh,README.md} on-demand SMB mount helper → /usr/local/bin; site values
|
||||
prompted at install → /etc/cloudpex.conf, never in the script (FR docs)
|
||||
.claude/{tasks,memory,audits}/ Claude working state
|
||||
|
||||
@@ -21,6 +21,9 @@ curl -fsSL https://git.bchanot.fr/bchanot/config/raw/branch/master/remote-instal
|
||||
| `etc/tmpfiles.d/tmp.conf` | Cleanup rules for a disk-backed `/tmp` (wiped at boot, 10-day purge). Deployed by the `/tmp` on disk offer. |
|
||||
| `etc/systemd/ssh.service.d/override.conf` | `ssh.service` drop-in: sshd exempt from the OOM killer + memory reclaim protection. Deployed by the SSH memory guard offer. |
|
||||
| `etc/default/earlyoom` | earlyoom arguments: spare sshd/systemd, kill node/java first. Deployed by the SSH memory guard offer. |
|
||||
| `etc/fail2ban/jail.d/local.conf` | fail2ban sshd jail: journal backend, all-ports ban, 5 tries / 10 min / 1 h, private LAN never banned. Deployed on every Linux install. |
|
||||
| `etc/apt/apt.conf.d/20auto-upgrades` | Enables unattended security upgrades (what `dpkg-reconfigure` writes). Deployed on every Linux install. |
|
||||
| `etc/ssh/sshd_config.d/20-hardening.conf` | sshd limits that cannot lock you out: `PermitRootLogin no`, `MaxAuthTries 3`, `LoginGraceTime 20`. Deployed on every Linux install after `sshd -t`. |
|
||||
| `vim/vimrc` | Vim config: pathogen, molokai, syntastic (C with `-Wall -Werror -Wextra`), NERDTree, 42-style canonical class generators (`:ClassH`, `:ClassC`). |
|
||||
| `vim/autoload/` | `pathogen.vim` plugin loader (committed). |
|
||||
| `vim/colors/` | `molokai.vim` colorscheme (committed). |
|
||||
@@ -66,8 +69,9 @@ What it does:
|
||||
10. On Linux, installs **code-server** (VS Code in the browser) via its vendor script — skipped if already present — and enables the `code-server@$USER` systemd service.
|
||||
11. On Linux, sets up **RDP remote login** via `gnome-remote-desktop` (Wayland-native): installs the daemon + `openssl`, generates a self-signed TLS cert once, and prompts interactively for shared "gate" credentials (skipped when no terminal is attached, or already set). Disables `xrdp` if present; opens UFW port `3389` only when UFW is already active.
|
||||
12. On Linux, installs the **`cloudpex`** NAS mount helper to `/usr/local/bin` via `cloudpex/install.sh`, which prompts for the NAS host, share name, SMB user, mount point and SMB version and writes them to `/etc/cloudpex.conf` (root, `0600`; an existing config is shown and kept unless you say `n`; skipped when no terminal is attached). Nothing is mounted, no password stored, see [`cloudpex/README.md`](cloudpex/README.md).
|
||||
13. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
|
||||
14. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.
|
||||
13. On Linux, installs the **security baseline**, always, no prompt: **fail2ban** (+ `nftables`) with `etc/fail2ban/jail.d/local.conf` (sshd jail reading the journal, bans the offending IP on every port so the SSH port does not matter, 5 failures in 10 min → 1 h ban, loopback and private LAN ranges never banned); **unattended-upgrades** enabled through `etc/apt/apt.conf.d/20auto-upgrades`; and the **sshd drop-in** `etc/ssh/sshd_config.d/20-hardening.conf` (`PermitRootLogin no`, `MaxAuthTries 3`, `LoginGraceTime 20`), checked with `sshd -t` and removed again if sshd rejects it, then `reload ssh`. Authentication methods, port and user lists are left as they are.
|
||||
14. On Linux, at the very end, **offers** (`[y/N]`, skipped when no terminal is attached) to move **`/tmp` to disk**: Ubuntu mounts `/tmp` as a RAM-backed tmpfs capped at 50% of RAM, which agent runs fill, halving the RAM and breaking every shell with "No space left on device". Accepting masks `tmp.mount` and installs `etc/tmpfiles.d/tmp.conf` (wipe at boot, 10-day purge). Effective at the next reboot.
|
||||
15. On Linux, at the very end, **offers** to keep **SSH reachable under memory pressure**: installs the `ssh.service` drop-in (`OOMScoreAdjust=-1000`, `MemoryMin=256M`) and `earlyoom` with `etc/default/earlyoom` (kills the largest process, `node`/`java` first and never `sshd`, once free RAM and swap both drop under 10%). Restarting `ssh` keeps open sessions. Note: `MemoryMin` protects the sshd daemon only; login sessions live in `user.slice`, so no setting can reserve RAM for a future shell. earlyoom acting in time is the real protection.
|
||||
|
||||
### Packages installed (apt)
|
||||
|
||||
@@ -79,6 +83,7 @@ What it does:
|
||||
- **Docker**: `docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin` (via Docker's repo)
|
||||
- **Remote access**: `gnome-remote-desktop openssl` (apt) + `code-server` (via its vendor install script, not apt) — RDP remote login + browser VS Code
|
||||
- **pipx**: `PyMuPDF` (`pymupdf`), `Markdown` (`markdown_py`)
|
||||
- **Security baseline (Linux, always)**: `fail2ban nftables unattended-upgrades`
|
||||
- **Optional (end-of-install offer, Linux)**: `earlyoom`
|
||||
|
||||
The script is re-runnable: each run re-backs up to `~/Oldconfig` (overwriting the previous backup), re-clones plugins, skips Docker if already installed, and re-deploys the `bin/` scripts.
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
// Automatic security updates, deployed by install.sh. Same content as
|
||||
// `dpkg-reconfigure -plow unattended-upgrades` writes, without the prompt.
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
@@ -0,0 +1,20 @@
|
||||
# fail2ban local settings, deployed by install.sh. Debian's defaults-debian.conf
|
||||
# enables the sshd jail; this file decides how it bans.
|
||||
[DEFAULT]
|
||||
# Never ban loopback or the private LAN ranges: five typos from the LAN must not
|
||||
# lock the admin out for an hour. Trade-off: a compromised LAN host is never banned.
|
||||
ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
|
||||
bantime = 1h
|
||||
findtime = 10m
|
||||
maxretry = 5
|
||||
banaction = nftables
|
||||
banaction_allports = nftables[type=allports]
|
||||
|
||||
[sshd]
|
||||
enabled = true
|
||||
# Read the journal directly: works with or without /var/log/auth.log (rsyslog).
|
||||
backend = systemd
|
||||
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
|
||||
# Ban the offender on every port, so the port sshd listens on is irrelevant. The
|
||||
# previous server's jail banned port 22 only while sshd listened on 337.
|
||||
banaction = %(banaction_allports)s
|
||||
@@ -0,0 +1,5 @@
|
||||
# sshd hardening, deployed by install.sh. Only settings that cannot lock anyone
|
||||
# out: authentication methods, ports and user lists are left to the host.
|
||||
PermitRootLogin no
|
||||
MaxAuthTries 3
|
||||
LoginGraceTime 20
|
||||
+45
@@ -141,6 +141,46 @@ install_cloudpex() {
|
||||
bash "$SCRIPT_DIR/cloudpex/install.sh"
|
||||
}
|
||||
|
||||
# fail2ban: bans an IP on every port after repeated SSH failures. The sshd jail
|
||||
# reads the journal (works with or without /var/log/auth.log) and bans all ports,
|
||||
# so the port sshd listens on does not matter — the previous server's jail only
|
||||
# banned port 22 while sshd listened on 337. Private LAN ranges are never banned.
|
||||
# nftables is the ban backend. Idempotent: config overwritten, service restarted.
|
||||
install_fail2ban() {
|
||||
echo "Installing fail2ban (sshd jail, all-ports ban)"
|
||||
sudo apt-get install -y fail2ban nftables
|
||||
sudo install -D -m 0644 "$SCRIPT_DIR/etc/fail2ban/jail.d/local.conf" \
|
||||
/etc/fail2ban/jail.d/local.conf
|
||||
sudo systemctl enable fail2ban
|
||||
sudo systemctl restart fail2ban
|
||||
}
|
||||
|
||||
# Automatic security updates: the file dpkg-reconfigure would write, deployed
|
||||
# directly so the install stays non-interactive. Idempotent.
|
||||
install_unattended_upgrades() {
|
||||
echo "Enabling unattended security upgrades"
|
||||
sudo apt-get install -y unattended-upgrades
|
||||
sudo install -D -m 0644 "$SCRIPT_DIR/etc/apt/apt.conf.d/20auto-upgrades" \
|
||||
/etc/apt/apt.conf.d/20auto-upgrades
|
||||
}
|
||||
|
||||
# sshd hardening drop-in (PermitRootLogin, MaxAuthTries, LoginGraceTime): only
|
||||
# settings that cannot lock anyone out; authentication methods stay untouched.
|
||||
# Validated with sshd -t before the reload. A rejected file is removed rather than
|
||||
# left in place, so sshd keeps starting on the next boot; the install goes on and
|
||||
# the warning tells you.
|
||||
harden_sshd() {
|
||||
echo "Deploying sshd hardening drop-in"
|
||||
sudo install -D -m 0644 "$SCRIPT_DIR/etc/ssh/sshd_config.d/20-hardening.conf" \
|
||||
/etc/ssh/sshd_config.d/20-hardening.conf
|
||||
if ! sudo sshd -t; then
|
||||
sudo rm -f /etc/ssh/sshd_config.d/20-hardening.conf
|
||||
echo "sshd rejected 20-hardening.conf — removed, sshd config unchanged" >&2
|
||||
return 0
|
||||
fi
|
||||
sudo systemctl reload ssh
|
||||
}
|
||||
|
||||
# Yes/no prompt for the optional system changes offered at the end of the install.
|
||||
# Declines (returns 1) when no terminal is attached (curl | bash), so an offer is
|
||||
# skipped with a hint instead of blocking; re-run ./install.sh from a terminal to
|
||||
@@ -245,6 +285,11 @@ if command -v apt-get >/dev/null 2>&1; then
|
||||
|
||||
# On-demand NAS mount helper (cloudpex/).
|
||||
install_cloudpex
|
||||
|
||||
# Security baseline: brute-force bans, automatic security updates, sshd limits.
|
||||
install_fail2ban
|
||||
install_unattended_upgrades
|
||||
harden_sshd
|
||||
else
|
||||
echo "apt-get not found — skipping system packages (install vim/git manually)."
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user