first commit

2026-07-22 21:01:19 +02:00
commit 8bb06f3737
57 changed files with 3529 additions and 0 deletions
@@ -0,0 +1,2 @@
+# CIS Ubuntu 24.04 - core dumps restreints (1.5.3)
+* hard core 0
@@ -0,0 +1,2 @@
+# CIS Ubuntu 24.04 - core dumps restreints (1.5.3)
+fs.suid_dumpable = 0
@@ -0,0 +1,29 @@
+# CIS Ubuntu 24.04 - durcissement sysctl reseau (3.3.x)
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+net.ipv4.conf.all.secure_redirects = 0
+net.ipv4.conf.default.secure_redirects = 0
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv6.conf.all.accept_source_route = 0
+net.ipv6.conf.default.accept_source_route = 0
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.tcp_syncookies = 1
+net.ipv6.conf.all.accept_ra = 0
+net.ipv6.conf.default.accept_ra = 0
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+{% if ip_forwarding_disabled | default(false) %}
+# ip_forward desactive : ce host ne fait tourner ni Docker (NAT de ports publies) ni de relais VPN.
+net.ipv4.ip_forward = 0
+net.ipv6.conf.all.forwarding = 0
+{% else %}
+# ip_forward laisse actif (defaut systeme = 1) : ce host heberge Docker et/ou fait relais VPN,
+# le desactiver casserait le NAT des ports publies ou le routage entre pairs WireGuard.
+# CIS 35608 restera donc en echec ici par necessite fonctionnelle, pas par oubli.
+{% endif %}
@@ -0,0 +1,18 @@
+# Exclusions specifiques a cette infra (donnees volumineuses, evolution constante,
+# integrite geree par leurs propres mecanismes — pas pertinent pour un check AIDE)
+!/var/lib/docker$
+!/var/lib/docker/.*
+!/var/lib/wazuh-indexer$
+!/var/lib/wazuh-indexer/.*
+!/var/lib/postgresql$
+!/var/lib/postgresql/.*
+!/var/lib/redis$
+!/var/lib/redis/.*
+!/var/lib/clamav$
+!/var/lib/clamav/.*
+!/var/lib/beszel-agent$
+!/var/lib/beszel-agent/.*
+!/var/log/audit$
+!/var/log/audit/.*
+!/var/lib/containerd$
+!/var/lib/containerd/.*
@@ -0,0 +1,12 @@
+# CIS Ubuntu 24.04 - regles d'audit detaillees : surveillance sudo (6.2.3.1-6.2.3.3)
+
+# 6.2.3.1 - changements de perimetre d'administration (sudoers)
+-w /etc/sudoers -p wa -k scope
+-w /etc/sudoers.d -p wa -k scope
+
+# 6.2.3.2 - toute action executee en tant qu'un autre utilisateur (sudo -u, su, etc.)
+-a always,exit -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k user_emulation
+-a always,exit -F arch=b32 -C euid!=uid -F auid!=unset -S execve -k user_emulation
+
+# 6.2.3.3 - modifications du fichier de log sudo
+-w /var/log/sudo.log -p wa -k sudo_log_file
@@ -0,0 +1,5 @@
+# Regle custom (hors CIS) - surveillance dediee de l'utilisateur omnex
+# auid (login uid) persiste a travers tout sudo/su : capture donc TOUTES les commandes
+# executees par omnex, meme apres elevation de privileges.
+-a always,exit -F arch=b64 -F auid={{ omnex_uid }} -S execve -k omnex_actions
+-a always,exit -F arch=b32 -F auid={{ omnex_uid }} -S execve -k omnex_actions
@@ -0,0 +1,76 @@
+# CIS Ubuntu 24.04 - regles d'audit detaillees restantes (6.2.3.4-6.2.3.19)
+# UID_MIN lu dynamiquement depuis /etc/login.defs sur cet host : {{ uid_min }}
+
+# 6.2.3.4 - changements date/heure
+-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change
+-a always,exit -F arch=b32 -S adjtimex,settimeofday -k time-change
+-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -k time-change
+-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -k time-change
+-w /etc/localtime -p wa -k time-change
+
+# 6.2.3.5 - changements environnement reseau du systeme
+-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
+-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale
+-w /etc/issue -p wa -k system-locale
+-w /etc/issue.net -p wa -k system-locale
+-w /etc/hosts -p wa -k system-locale
+-w /etc/networks -p wa -k system-locale
+-w /etc/network/ -p wa -k system-locale
+-w /etc/netplan/ -p wa -k system-locale
+
+# 6.2.3.7 - tentatives d'acces fichier echouees
+-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>={{ uid_min }} -F auid!=unset -k access
+-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>={{ uid_min }} -F auid!=unset -k access
+-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>={{ uid_min }} -F auid!=unset -k access
+-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>={{ uid_min }} -F auid!=unset -k access
+
+# 6.2.3.8 - modifications informations user/group
+-w /etc/group -p wa -k identity
+-w /etc/passwd -p wa -k identity
+-w /etc/gshadow -p wa -k identity
+-w /etc/shadow -p wa -k identity
+-w /etc/security/opasswd -p wa -k identity
+-w /etc/nsswitch.conf -p wa -k identity
+-w /etc/pam.conf -p wa -k identity
+-w /etc/pam.d -p wa -k identity
+
+# 6.2.3.9 - modifications permissions discretionnaires (DAC)
+-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
+-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
+-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
+-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
+-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
+-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>={{ uid_min }} -F auid!=unset -F key=perm_mod
+
+# 6.2.3.10 - montages systeme de fichiers reussis
+-a always,exit -F arch=b32 -S mount -F auid>={{ uid_min }} -F auid!=unset -k mounts
+-a always,exit -F arch=b64 -S mount -F auid>={{ uid_min }} -F auid!=unset -k mounts
+
+# 6.2.3.11 - informations d'initiation de session
+-w /var/run/utmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+
+# 6.2.3.12 - evenements login/logout
+-w /var/log/lastlog -p wa -k logins
+-w /var/run/faillock -p wa -k logins
+
+# 6.2.3.13 - suppressions de fichiers par les utilisateurs
+-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>={{ uid_min }} -F auid!=unset -F key=delete
+-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>={{ uid_min }} -F auid!=unset -F key=delete
+
+# 6.2.3.14 - modifications du controle d'acces obligatoire (AppArmor)
+-w /etc/apparmor/ -p wa -k MAC-policy
+-w /etc/apparmor.d/ -p wa -k MAC-policy
+
+# 6.2.3.15-17 - commandes chcon / setfacl / chacl
+-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k perm_chng
+-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k perm_chng
+-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k perm_chng
+
+# 6.2.3.18 - commande usermod
+-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k usermod
+
+# 6.2.3.19 - chargement/dechargement/modification de modules noyau
+-a always,exit -F arch=b64 -S init_module,finit_module,delete_module,create_module,query_module -F auid>={{ uid_min }} -F auid!=unset -k kernel_modules
+-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>={{ uid_min }} -F auid!=unset -k kernel_modules
@@ -0,0 +1,33 @@
+# CIS Ubuntu 24.04 - modules noyau reseau et filesystem inutilises dans cette infra (3.2.1-3.2.4, 1.1.1.10)
+install dccp /bin/false
+blacklist dccp
+install tipc /bin/false
+blacklist tipc
+install rds /bin/false
+blacklist rds
+install sctp /bin/false
+blacklist sctp
+install afs /bin/false
+blacklist afs
+install ceph /bin/false
+blacklist ceph
+install cifs /bin/false
+blacklist cifs
+install exfat /bin/false
+blacklist exfat
+install ext /bin/false
+blacklist ext
+# fat et fuse sont compiles en dur dans le noyau Ubuntu (builtin, pas de .ko) : cette entree
+# ne change rien fonctionnellement et le check CIS 35509 restera en echec pour ces deux modules.
+install fat /bin/false
+blacklist fat
+install fscache /bin/false
+blacklist fscache
+install fuse /bin/false
+blacklist fuse
+install gfs2 /bin/false
+blacklist gfs2
+install nfs_common /bin/false
+blacklist nfs_common
+install nfsd /bin/false
+blacklist nfsd
@@ -0,0 +1 @@
+PasswordAuthentication no
@@ -0,0 +1,5 @@
+# Géré par Ansible (playbook-pam-hardening.yml) — CIS Ubuntu 24.04 (5.5.2/5.5.3)
+deny = {{ pam_faillock_deny }}
+unlock_time = {{ pam_faillock_unlock_time }}
+fail_interval = {{ pam_faillock_fail_interval }}
+even_deny_root
@@ -0,0 +1,48 @@
+global
+    log stdout format raw local0
+    maxconn 4096
+
+defaults
+    log     global
+    mode    http
+    option  httplog
+    option  dontlognull
+    timeout connect 5s
+    timeout client  30s
+    timeout server  30s
+    timeout http-request 10s
+    retries 2
+
+frontend fe_https
+    bind *:443 ssl crt /etc/haproxy/certs/mln-uber.club.pem
+    mode http
+    option forwardfor
+    http-request set-header X-Forwarded-Proto https
+
+    # /api/* et /uploads/* -> pool backend (Go), tout le reste -> pool frontend (SPA)
+    acl is_api path_beg /api/ /uploads/ /webhook/telegram /webhook/nowpayment
+    use_backend be_api if is_api
+    default_backend be_frontend
+
+# ============================================================
+# Pool API — TODO : /api/health n'existe pas encore côté backend,
+# ce check échouera tant que la route n'est pas ajoutée.
+# ============================================================
+backend be_api
+    mode http
+    option httpchk GET /api/health
+    http-check expect status 200
+
+    server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2
+    server replica-prod-uber {{ hostvars['replica-prod-uber']['vpn_ip'] | default('TODO-vpn_ip-manquant') }}:443 ssl verify none check inter 2s fall 3 rise 2 backup
+
+# ============================================================
+# Pool frontend statique (SPA) — check sur "/" (toujours servi par nginx même si l'API est down)
+# ============================================================
+backend be_frontend
+    mode http
+    option httpchk GET /
+    http-check expect status 200
+
+    server prod-uber {{ hostvars['prod-uber']['vpn_ip'] }}:443 ssl verify none check inter 2s fall 3 rise 2
+    server replica-prod-uber {{ hostvars['replica-prod-uber']['vpn_ip'] | default('TODO-vpn_ip-manquant') }}:443 ssl verify none check inter 2s fall 3 rise 2 backup
@@ -0,0 +1,9 @@
+Name: Notify of failed login attempts and reset count upon success
+Default: yes
+Priority: 1024
+Auth-Type: Primary
+Auth:
+	requisite	pam_faillock.so preauth
+Account-Type: Primary
+Account:
+	required	pam_faillock.so
@@ -0,0 +1,6 @@
+Name: Enable pam_faillock to deny access
+Default: yes
+Priority: 0
+Auth-Type: Primary
+Auth:
+	[default=die]	pam_faillock.so authfail
@@ -0,0 +1,6 @@
+Name: pwhistory password history checking
+Default: yes
+Priority: 1024
+Password-Type: Primary
+Password:
+	requisite	pam_pwhistory.so remember={{ pam_pwhistory_remember }} enforce_for_root try_first_pass use_authtok
@@ -0,0 +1,7 @@
+Name: Pwquality password strength checking
+Default: yes
+Priority: 1024
+Conflicts: cracklib
+Password-Type: Primary
+Password:
+	requisite	pam_pwquality.so retry=3
@@ -0,0 +1,23 @@
+Name: Unix authentication
+Default: yes
+Priority: 256
+Auth-Type: Primary
+Auth:
+	[success=end default=ignore]	pam_unix.so try_first_pass
+Auth-Initial:
+	[success=end default=ignore]	pam_unix.so
+Account-Type: Primary
+Account:
+	[success=end new_authtok_reqd=done default=ignore]	pam_unix.so
+Account-Initial:
+	[success=end new_authtok_reqd=done default=ignore]	pam_unix.so
+Session-Type: Additional
+Session:
+	required	pam_unix.so
+Session-Initial:
+	required	pam_unix.so
+Password-Type: Primary
+Password:
+	[success=end default=ignore]	pam_unix.so obscure use_authtok try_first_pass yescrypt
+Password-Initial:
+	[success=end default=ignore]	pam_unix.so obscure yescrypt
@@ -0,0 +1,8 @@
+# Géré par Ansible (playbook-pam-hardening.yml) — CIS Ubuntu 24.04 (5.5.4)
+minlen = {{ pam_pwquality_minlen }}
+dcredit = -1
+ucredit = -1
+lcredit = -1
+ocredit = -1
+difok = {{ pam_pwquality_difok }}
+enforce_for_root
@@ -0,0 +1,123 @@
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+Include /etc/ssh/sshd_config.d/*.conf
+
+#Port 22
+AddressFamily inet
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+AllowGroups {{ group_ssh }}
+AllowUsers {{ user_ssh }}
+#LoginGraceTime 2m
+PermitRootLogin no
+#StrictModes yes
+MaxAuthTries 3
+MaxSessions 2
+
+PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+#AuthorizedKeysFile     .ssh/authorized_keys .ssh/authorized_keys2
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+KbdInteractiveAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+MaxStartups 10:30:60
+PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem       sftp    /usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#       X11Forwarding no
+#       AllowTcpForwarding no
+#       PermitTTY no
+#       ForceCommand cvs server
@@ -0,0 +1,5 @@
+// Généré par ansible (infra/playbook-unattended-upgrades.yml) — ne pas éditer à la main.
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
@@ -0,0 +1,30 @@
+// Généré par ansible (infra/playbook-unattended-upgrades.yml) — ne pas éditer à la main.
+
+Unattended-Upgrade::Origins-Pattern {
+    "origin=Debian,codename=${distro_codename},label=Debian-Security";
+    "origin=Ubuntu,archive=${distro_codename}-security";
+};
+
+// Paquets sensibles exclus — mise à jour manuelle et review requises :
+// - postgresql/redis : pas de tolérance à une régression sur la DB/cache
+// - docker/containerd : un redémarrage du daemon peut interrompre les conteneurs en cours
+// - wireguard : composant réseau critique du VPN inter-serveurs
+Unattended-Upgrade::Package-Blacklist {
+    "postgresql*";
+    "redis*";
+    "docker-ce*";
+    "docker-ce-cli*";
+    "containerd.io";
+    "wireguard*";
+};
+
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+
+Unattended-Upgrade::Automatic-Reboot "true";
+Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
+Unattended-Upgrade::Automatic-Reboot-Time "00:00";
+
+// Pas d'email (host headless) — notification Telegram via le script/timer dédié.
+Unattended-Upgrade::Mail "";
@@ -0,0 +1,7 @@
+[Unit]
+Description=Notification Telegram post unattended-upgrades
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/unattended-upgrades-notify.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# Généré par ansible (infra/playbook-unattended-upgrades.yml) — ne pas éditer à la main.
+set -euo pipefail
+
+LOG="/var/log/unattended-upgrades/unattended-upgrades.log"
+TODAY="$(date +%Y-%m-%d)"
+HOSTNAME="$(hostname)"
+WEBHOOK_URL="{{ discord_infra_webhook_url }}"
+
+if [ -z "$WEBHOOK_URL" ]; then
+    exit 0
+fi
+
+INSTALLED=""
+if [ -f "$LOG" ]; then
+    INSTALLED=$(grep "^$TODAY" "$LOG" | grep -i "Packages that will be upgraded\|Packages that are upgraded" || true)
+fi
+
+REBOOT_STATUS="Pas de redémarrage requis"
+if [ -f /var/run/reboot-required ]; then
+    REBOOT_STATUS="⚠️ Redémarrage requis (programmé à 00:00 UTC)"
+fi
+
+if [ -z "$INSTALLED" ]; then
+    MESSAGE="🔒 [$HOSTNAME] Unattended-upgrades — aucun paquet de sécurité à installer aujourd'hui."
+else
+    MESSAGE="🔒 [$HOSTNAME] Unattended-upgrades — paquets mis à jour aujourd'hui :
+${INSTALLED}
+
+${REBOOT_STATUS}"
+fi
+
+PAYLOAD="$(jq -n --arg content "$MESSAGE" '{content: $content}')"
+
+curl -s -X POST "$WEBHOOK_URL" \
+    -H "Content-Type: application/json" \
+    -d "$PAYLOAD" \
+    > /dev/null
@@ -0,0 +1,10 @@
+[Unit]
+Description=Déclenche la notification Telegram post unattended-upgrades
+
+[Timer]
+OnCalendar=*-*-* 00:30:00
+Persistent=true
+RandomizedDelaySec=120
+
+[Install]
+WantedBy=timers.target