36 lines
602 B
YAML
36 lines
602 B
YAML
|
---
|
||
|
|
# Hardening configuration
|
||
|
|
cis_level: 1
|
||
|
|
disable_root_login: true
|
||
|
|
secure_ssh_config: true
|
||
|
|
firewall_policy: deny
|
||
|
|
auditd_enabled: true
|
||
|
|
selinux_mode: enforcing
|
||
|
|
apparmor_enabled: true
|
||
|
|
|
||
|
|
# SSH Hardening
|
||
|
|
ssh_max_auth_tries: 3
|
||
|
|
ssh_client_alive_interval: 300
|
||
|
|
ssh_client_alive_count_max: 2
|
||
|
|
|
||
|
|
# Firewall rules for SSH (trusted networks)
|
||
|
|
ssh_allowed_networks:
|
||
|
|
- 10.0.0.0/8
|
||
|
|
- 172.16.0.0/12
|
||
|
|
- 192.168.0.0/16
|
||
|
|
|
||
|
|
# Services to disable
|
||
|
|
unnecessary_services:
|
||
|
|
- cups
|
||
|
|
- avahi-daemon
|
||
|
|
- bluetooth
|
||
|
|
- nfs-server
|
||
|
|
- rpcbind
|
||
|
|
|
||
|
|
# Packages to remove
|
||
|
|
unnecessary_packages:
|
||
|
|
- telnet
|
||
|
|
- rsh-client
|
||
|
|
- talk
|
||
|
|
- ntalk
|