chore: update hardening

2026-07-29 19:00:53 +02:00
parent 8bb06f3737
commit 76592a5c12
5 changed files with 230 additions and 0 deletions
@@ -0,0 +1,7 @@
+# CIS Ubuntu 24.04 - rotation des logs journald (6.1.1.3)
+[Journal]
+SystemMaxUse=1G
+SystemKeepFree=500M
+RuntimeMaxUse=200M
+RuntimeKeepFree=50M
+MaxFileSec=1month
@@ -0,0 +1,2 @@
+# CIS Ubuntu 24.04 - mode de creation des fichiers de log rsyslog (6.1.3.4)
+$FileCreateMode 0640
@@ -0,0 +1,6 @@
+# CIS Ubuntu 24.04 - serveur NTP autorise explicite (2.3.2.1)
+# Rend explicite le serveur deja utilise par defaut sur Ubuntu (ntp.ubuntu.com),
+# aucun changement de comportement reel, juste rendu auditable pour le check CIS.
+[Time]
+NTP=ntp.ubuntu.com
+FallbackNTP=0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org
@@ -0,0 +1,50 @@
+#!/bin/bash
+# CIS Ubuntu 24.04 - 6.1.4.1 Ensure access to all logfiles has been configured.
+# Adaptation simplifiee du script officiel CIS pour Ubuntu (retire les cas RHEL/SSSD/gdm
+# non pertinents ici). Ne fait que RESTREINDRE les permissions, jamais les elargir.
+
+set -u
+
+fix_file() {
+    local f="$1" perm_mask="$2" rperms="$3" auser="$4" agroup="$5"
+    local mode user group
+    read -r mode user group < <(stat -Lc '%#a %U %G' "$f" 2>/dev/null)
+    [ -z "${mode:-}" ] && return
+    if [ $(( mode & perm_mask )) -gt 0 ]; then
+        chmod "$rperms" "$f"
+    fi
+    if [[ ! "$user" =~ ^($auser)$ ]]; then
+        chown root "$f"
+    fi
+    if [[ ! "$group" =~ ^($agroup)$ ]]; then
+        chgrp root "$f"
+    fi
+}
+
+while IFS= read -r -d '' file; do
+    base="$(basename "$file")"
+    dir="$(dirname "$file")"
+    case "$base" in
+        lastlog|lastlog.*|wtmp|wtmp.*|wtmp-*|btmp|btmp.*|btmp-*)
+            # group-write tolere : necessaire au bon fonctionnement de last/who/lastlog
+            # (groupe utmp) — plus strict casserait ces commandes, ecart assume vs le
+            # check SCA generique qui ne distingue pas ces fichiers.
+            fix_file "$file" 0113 "ug-x,o-wx" "root" "root|utmp"
+            ;;
+        README)
+            fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|adm"
+            ;;
+        *.journal|*.journal~)
+            fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|systemd-journal"
+            ;;
+        *)
+            if [[ "$dir" == *"/apt" ]]; then
+                fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|adm"
+            else
+                fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root|syslog" "root|adm"
+            fi
+            ;;
+    esac
+done < <(find -L /var/log -type f \( -perm /0137 -o ! -user root -o ! -group root \) -print0 2>/dev/null)
+
+echo "OK"