119 lines
3.9 KiB
YAML
119 lines
3.9 KiB
YAML
os_desktop_enable: false
|
|
os_env_extra_user_paths: []
|
|
os_env_umask: '027'
|
|
os_auth_pw_max_age: 60
|
|
os_auth_pw_min_age: 7 # discourage password cycling
|
|
os_auth_retries: 5
|
|
os_auth_lockout_time: 600 # 10min
|
|
os_auth_timeout: 60
|
|
os_auth_allow_homeless: false
|
|
os_auth_pam_passwdqc_enable: true
|
|
os_auth_pam_passwdqc_options: 'min=disabled,disabled,16,12,8' # used in RHEL6
|
|
os_auth_pam_pwquality_options: 'try_first_pass retry=3 type=' # used in RHEL7
|
|
os_auth_root_ttys: [console, tty1, tty2, tty3, tty4, tty5, tty6]
|
|
os_auth_uid_min: 1000
|
|
os_auth_gid_min: 1000
|
|
os_auth_sys_uid_min: 100
|
|
os_auth_sys_uid_max: 999
|
|
os_auth_sys_gid_min: 100
|
|
os_auth_sys_gid_max: 999
|
|
|
|
os_chfn_restrict: ''
|
|
# may contain: change_user
|
|
os_security_users_allow: []
|
|
# specify system accounts those login should not be disabled and password not changed
|
|
os_ignore_users: ['vagrant']
|
|
os_security_kernel_enable_module_loading: true
|
|
os_security_kernel_enable_core_dump: false
|
|
os_security_suid_sgid_enforce: true
|
|
# user-defined blacklist and whitelist
|
|
os_security_suid_sgid_blacklist: []
|
|
os_security_suid_sgid_whitelist: []
|
|
# if this is true, remove any suid/sgid bits from files that were not in the whitelist
|
|
os_security_suid_sgid_remove_from_unknown: false
|
|
|
|
# remove packages with known issues
|
|
os_security_packages_clean: true
|
|
os_security_packages_list: ['xinetd','inetd','ypserv','telnet-server','rsh-server','rsync']
|
|
|
|
# Allow interactive startup (rhel, centos)
|
|
os_security_init_prompt: true
|
|
# Require root password for single user mode. (rhel, centos)
|
|
os_security_init_single: false
|
|
|
|
# Apply ufw defaults
|
|
ufw_manage_defaults: true
|
|
|
|
# Empty variable disables IPT_SYSCTL in /etc/default/ufw
|
|
# by default in Ubuntu it set to: /etc/ufw/sysctl.conf
|
|
# CAUTION
|
|
# if you enable it - it'll overwrite /etc/sysctl.conf file, managed by hardening framework
|
|
ufw_ipt_sysctl: ''
|
|
|
|
# Default ufw variables
|
|
ufw_default_input_policy: 'DROP'
|
|
ufw_default_output_policy: 'ACCEPT'
|
|
ufw_default_forward_policy: 'DROP'
|
|
ufw_default_application_policy: 'SKIP'
|
|
ufw_manage_builtins: 'no'
|
|
ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
|
|
|
|
# CAUTION
|
|
# If you want to overwrite sysctl-variables,
|
|
# you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
|
|
|
|
sysctl_config:
|
|
# Disable IPv4 traffic forwarding.
|
|
net.ipv4.ip_forward: 0
|
|
|
|
# Disable IPv6 traffic forwarding.
|
|
net.ipv6.conf.all.forwarding: 0
|
|
|
|
# ignore RAs on Ipv6.
|
|
net.ipv6.conf.all.accept_ra: 0
|
|
net.ipv6.conf.default.accept_ra: 0
|
|
|
|
# Enable RFC-recommended source validation feature.
|
|
net.ipv4.conf.all.rp_filter: 1
|
|
net.ipv4.conf.default.rp_filter: 1
|
|
|
|
# Reduce the surface on SMURF attacks.
|
|
# Make sure to ignore ECHO broadcasts, which are only required in broad network analysis.
|
|
net.ipv4.icmp_echo_ignore_broadcasts: 1
|
|
|
|
# There is no reason to accept bogus error responses from ICMP, so ignore them instead.
|
|
net.ipv4.icmp_ignore_bogus_error_responses: 1
|
|
|
|
# Limit the amount of traffic the system uses for ICMP.
|
|
net.ipv4.icmp_ratelimit: 100
|
|
|
|
# Adjust the ICMP ratelimit to include ping, dst unreachable,
|
|
# source quench, ime exceed, param problem, timestamp reply, information reply
|
|
net.ipv4.icmp_ratemask: 88089
|
|
|
|
# Disable IPv6
|
|
net.ipv6.conf.all.disable_ipv6: 1
|
|
|
|
# Protect against wrapping sequence numbers at gigabit speeds
|
|
net.ipv4.tcp_timestamps: 0
|
|
|
|
# Define restriction level for announcing the local source IP
|
|
net.ipv4.conf.all.arp_ignore: 1
|
|
|
|
# Define mode for sending replies in response to
|
|
# received ARP requests that resolve local target IP addresses
|
|
net.ipv4.conf.all.arp_announce: 2
|
|
|
|
# RFC 1337 fix F1
|
|
net.ipv4.tcp_rfc1337: 1
|
|
|
|
# CAUTION
|
|
# If you want to overwrite sysctl-variables,
|
|
# you have to overwrite the *whole* dict, or else only the single overwritten will be actually used.
|
|
|
|
sysctl_rhel_config:
|
|
# ExecShield protection against buffer overflows
|
|
kernel.exec-shield: 1
|
|
# Syncookies is used to prevent SYN-flooding attacks.
|
|
net.ipv4.tcp_syncookies: 1
|