Эффективная защита Linux: использование Ansible для соблюдения рекомендаций ФСТЭК России

- name: 1 Create user fstec with root-level privileges   hosts: all   become: true   tasks:     - name: Add user fstec       user:         name: your_user         shell: /bin/bash         groups: wheel         append: yes     - name: Prompt for password for your user       pause:         prompt: "Enter password for your user:"       register: passwd_input     - name: Set password for your user       user:         name: your_user         password: "{{ passwd_input.user_input | password_hash('sha512') }}"         update_password: always     - name: Copy root's SSH key for your user       authorized_key:         user: your_user         key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"     - name: Add fstec to sudoers       lineinfile:         dest: /etc/sudoers         line: " your_user ALL=(ALL:ALL) ALL"         validate: 'visudo -cf %s'

- name: 2.1 Configuring authorization in Linux operating systems   hosts: all   become: true   remote_user: «your_user»   gather_facts: false   tasks:     - name: 2.1.1. Do not allow the use of user accounts with empty passwords.         Configure accounts so that each user of the system either has a password or         is blocked by a password. On Linux systems, this feature is provided by the         /etc/shadow file.       lineinfile:         path: /etc/shadow         regexp: ^([^:]+):([^:]*):([^:]*):([^:]*):([^:]*):([^:]*):([^:]*)         line: \1:*:\3:\4:\5:\6:\7         backrefs: yes       register: shadow_file     - name: Check the result of changes       debug:         var: shadow_file      - name: 2.1.2. Ensure that superuser login to the system via SSH is disabled by         setting the PermitRootLogin parameter to no in the /etc/ssh/sshd_config         file.       lineinfile:         dest: /etc/ssh/sshd_config         regexp: ^PermitRootLogin         line: PermitRootLogin no         state: present         backup: yes       notify:         - restart sshd   handlers:     - name: restart sshd       service:         name: sshd         state: restarted

- name: 2.2 Limitation of privilege mechanisms   hosts: all   become: true   remote_user: «your_user»   vars_prompt:     - name: "allowed_sudo_users"       prompt: "Specify a list of users who should be allowed to use the sudo command (separated by commas)"       private: no   tasks:     - name: 2.2.1 Add pam_wheel.so to /etc/pam.d/su       lineinfile:         path: /etc/pam.d/su         line: "auth required pam_wheel.so use_uid"         insertafter: EOF     - name: 2.2.1 Get list of users to add to wheel group       pause:         prompt: "Please provide the list of users to add to the wheel group"       register: admin_input     - name: Add users to wheel group       lineinfile:         path: /etc/group         regexp: '^wheel:'         line: "wheel:x:10:root,{{ admin_input.wheel_group }}"       when: wheel_group.stdout is defined     - name: 2.2.2 Limit the list of users who are allowed to use the sudo command and commands allowed to be executed via sudo by revising the /etc/sudoers file       lineinfile:         path: /etc/sudoers         line: "{{ item }} ALL=(ALL:ALL) ALL"         state: present         regexp: "^{{ item }}"       with_items: "{{ allowed_sudo_users.split(',') }}"       when: allowed_sudo_users is defined       changed_when: false     - name: Prohibit the use of sudo for other users       lineinfile:         path: /etc/sudoers         line: "{{ item }}"         state: absent       with_lines: "grep -vE '^{{ allowed_sudo_users }}' /etc/passwd | cut -d: -f1 | sed 's/^/%/g' | sed 's/$/ ALL=(ALL:ALL) ALL/'"       when: allowed_sudo_users is defined

- name: 2.3. Setting up access rights to file system objects   hosts: all   become: yes   remote_user: fstec   gather_facts: true   vars:     whitelist_apps:       - /usr/sbin/haproxy    tasks:      - name: 2.3.1 Set the rights to /etc/passwd       ansible.builtin.file:         path: /etc/passwd         owner: root         group: root         mode: '0644'       become: yes      - name: 2.3.1 Set the rights to /etc/group       ansible.builtin.file:         path: /etc/group         owner: root         group: root         mode: '0644'       become: yes      - name: 2.3.1 Set the rights to /etc/shadow       ansible.builtin.file:         path: /etc/shadow         owner: root         group: root         mode: '0600'       become: yes      - name: 2.3.2. Set the correct access rights to the files of running processes by executing a command like chmod go-w /path/to/file for all executable files currently running and the corresponding libraries. After that, it is necessary to check that the directory containing this file, as well as all parent directories, are not writable by unprivileged users.       shell: >        find /proc -maxdepth 2 -type f -executable -execdir chmod -R        go-w {} \;       register: procoutput       changed_when: false          - name: 2.3.3 Set file access rights for cron files       find:         paths: /etc/cron*         patterns: "*"         file_type: file         recurse: yes       register: cronfiles     - name: Set correct permissions for cron files       file:         path: "{{ item.path }}"         mode: "0640"       with_items: "{{ cronfiles.files }}"      - name: 2.3.4 Find files and links based on $PATH       shell: echo $PATH       register: pathvar      - name: Find regular files       find:         paths: '{{ pathvar.stdout.split(":") }}'         file_type: file         patterns: '*'         get_checksum: yes         hidden: yes       register: regular_files      - name: Find symlinks       find:         paths: '{{ pathvar.stdout.split(":") }}'         file_type: link         patterns: '*'         get_checksum: yes         hidden: yes       register: symlinks      - name: Output list of regular files to admin       debug:         msg: "Found regular applications: {{ regular_files.files | map(attribute='path') | list }}"      - name: Output list of symlinks to admin       debug:         msg: "Found symlinks: {{ symlinks.files | map(attribute='path') | list }}"      - pause:         prompt: "Do you want to change the permissions of these files to go-w? (yes/no)"       register: permissionapprovalfiles          - name: 2.3.4 Change permissions of files if admin approves       file:         path: "{{ item.path }}"         mode: go-w         state: file         owner: root       loop: "{{ regular_files.files }}"       when: permissionapprovalfiles.user_input == "yes"       become: true            - pause:         prompt: "Do you want to change the permissions of these links to go-w? (yes/no)"       register: permissionapprovallinks      - name: 2.3.4 Change permissions of links if admin approves       file:         path: "{{ item.path }}"         mode: go-w         state: link         owner: root       loop: "{{ symlinks.files }}"       when: permissionapprovallinks.user_input == "yes"       become: true      - name: 2.3.5. Set the correct access rights to the startup scripts       file:         path: "{{ item }}"         owner: root         group: root         mode: '0755'       with_fileglob:         - /etc/rc*.d/*          - name: Set access rights to .service files       find:         paths: /         patterns: "*.service"       register: service_files_result          - name: Set access rights for .service files       file:         path: "{{ item.path }}"         owner: root         group: root         mode: '0755'       loop: "{{ service_files_result.files }}"      - name: 2.3.6 Set access rights to /etc/crontab /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly       find:         paths: /etc/cron*         file_type: any       register: found_files     - name: Print found files       debug:         var: found_files         - name: Set access rights to found cron files       file:         path: "{{ item.path }}"         mode: 'go-w'       loop: "{{ cron_files.files }}"      - name: 2.3.7 Setting access rights to user files of cron tasks       shell: chmod go-w "{{ item }}"       with_fileglob:         - /var/spool/cron/crontabs/*       register: cron_files_result     - name: Check the result of changes       debug:         var: cron_files_result      - name: 2.3.8 Setting access rights to executable files and operating system libraries       shell: echo $PATH       register: path_result       changed_when: false     - name: Set access rights to executable files in paths       command: find "{{ item }}" -type f -exec chmod go-w {} +       with_items: "{{ path_result.stdout_lines[0].split(':') }}"       changed_when: false     - name: Set access rights to libraries in paths       command: find "{{ item }}" -type f -exec chmod go-w {} +       with_items:         - /lib         - /lib64         - /bin         - /usr/bin       changed_when: false     - name: Set access rights to kernel modules       command: find /lib/modules/{{ ansible_kernel }} -type f -exec chmod go-w {} +       changed_when: false      - name: 2.3.9 Find files with setuid permissions       command: find / -perm -4000 -type f       register: found_files_4000       ignore_errors: yes      - name: 2.3.9 Find files with setgid permissions       command: find / -perm -2000 -type f       register: found_files_2000       ignore_errors: yes      - name: Display found files with setuid permissions       debug:         msg: "{{ found_files_4000.stdout_lines }}"      - name: Display found files with setgid permissions       debug:         msg: "{{ found_files_2000.stdout_lines }}"      - name: 2.3.9 Remove write permissions from group and others for files with setuid permissions       file:         path: "{{ item }}"         mode: '4755'       loop: "{{ found_files_4000.stdout_lines | default([]) }}"      - name: 2.3.9 Remove write permissions from group and others for files with setgid permissions       file:         path: "{{ item }}"         mode: '2755'       loop: "{{ found_files_2000.stdout_lines | default([]) }}"      - name: 2.3.10 Get home directories       shell: ls -d /home/*/       register: home_directories_output       ignore_errors: true      - name: 2.3.10 Convert home directories output to list       set_fact:         home_directories: "{{ home_directories_output.stdout_lines }}"       when: home_directories_output is defined      - name: 2.3.10 Find dot files in home directories       find:         paths: "{{ item }}"         patterns: ".*"         file_type: file       register: dot_files       with_items: "{{ home_directories }}"       loop_control:         loop_var: item      - name: 2.3.10 Set the correct access rights to the contents of users' home directories       file:         path: "{{ item.path }}"         mode: go-rwx       with_items: "{{ dot_files.files }}"       when: dot_files.files | default([])       become: true      - name: 2.3.11. Set correct access rights to users' home directories       find:         paths: /home         patterns: "*"         depth: 1         file_type: directory       register: home_directories_result      - name: Set correct access rights to users' home directories       file:         path: "{{ item.path }}"         state: directory         mode: "0700"       loop: "{{ home_directories_result.files }}"

- name: 2.4 Configuring Linux Kernel protection mechanisms   hosts: all   become: true   remote_user: fstec    tasks:     - name: 2.4.1 Restrict access to kernel logs       sysctl:         name: kernel.dmesg_restrict         value: 1         state: present         sysctl_set: yes          - name: Check for CAP_SYSLOG capability       command: "sysctl -p"       changed_when: false       register: sysctl_result          - name: Print sysctl result       debug:         var: sysctl_result                - name: 2.4.2 Check and update kernel.kptr_restrict value and interface address       shell: cat /proc/sys/kernel/kptr_restrict       register: kptr_restrict_value            - name: Check if kptr_restrict value is 2       debug:         msg: "The kernel.kptr_restrict value is already set to 2"       when: kptr_restrict_value.stdout == "2\n"            - name: Set kernel.kptr_restrict value to 2       sysctl:         name: kernel.kptr_restrict         value: 2         state: present       register: kernel_kptr_restrict       when: kptr_restrict_value.stdout != "2\n"            - name: Get network interfaces information       shell: ip addr show       register: network_interface_info            - name: Check if any interface has address 0.0.0.0       debug:         msg: "Interface has address 0.0.0.0"       when: "'0.0.0.0' in network_interface_info.stdout"            - name: Set interface address to 0.0.0.0       shell: ip addr add 0.0.0.0 dev {{ item }}       with_items: "{{ ansible_interfaces }}"       register: interface_address_change       when: "'0.0.0.0' not in network_interface_info.stdout"            - name: Check if interface address was changed       debug:         msg: "Interface address changed"       when: interface_address_change.changed or interface_address_change.results | selectattr('changed', 'defined') | list | length > 0            - name: Persist interface address changes       shell: ip addr save       when: interface_address_change.changed or interface_address_change.results | selectattr('changed', 'defined') | list | length > 0            - name: Check if kernel.kptr_restrict value is set to 2       debug:         msg: "The kernel.kptr_restrict value is set to 2"       when: kernel_kptr_restrict.changed or interface_address_change.changed or interface_address_change.results | selectattr('changed', 'defined') | list | length > 0      - name: 2.4.3. Checking the value of the initonalloc kernel boot option       become: true       shell: cat /proc/cmdline       register: cmdlineoutput     - name: Checking the value of the initonalloc kernel boot option       become: true       debug:         msg: The initonalloc option is already set to 1!       when: "'initonalloc=1' in cmdlineoutput.stdout"     - name: Setting the value of the initonalloc kernel boot option       become: true       lineinfile:         dest: /etc/default/grub         regexp: ^GRUB_CMDLINE_LINUX=         line: GRUB_CMDLINE_LINUX="initonalloc=1"      - name: 2.4.4 Checking the value of the slab_nomerge option       blockinfile:         path: /etc/default/grub         block: |           # Added by Ansible to enable slab_nomerge           GRUB_CMDLINE_LINUX="slab_nomerge"         insertafter: EOF       changed_when: false      - name: 2.4.5. Initialize the IOMMU mechanism       blockinfile:         path: /etc/default/grub         block: |           # Added by Ansible: Initialize the IOMMU mechanism           GRUB_CMDLINE_LINUX="iommu=force iommu.strict=1 iommu.passthrough=0"         insertafter: EOF       changed_when: false     - name: 2.4.6. Randomize the location of the kernel stack       blockinfile:         path: /etc/default/grub         block: |           # Added by Ansible: Randomize the location of the kernel stack           GRUB_CMDLINE_LINUX="randomizekstackoffset=1"         insertafter: EOF       changed_when: false         - name: 2.4.7 Enable protection against CPU hardware vulnerabilities       blockinfile:         path: /etc/default/grub         block: |           # Added by Ansible: Enable protection against CPU hardware vulnerabilities           GRUB_CMDLINE_LINUX="mitigations=auto,nosmt"         insertafter: EOF       changed_when: false     - name: Update Grub       command: sudo grub2-mkconfig -o /boot/grub2/grub.cfg        - name: 2.4.8. Enable protection of the eBPF JIT subsystem of the Linux kernel       sysctl:         name: net.core.bpf_jit_harden         value: "2"         state: present

- name: 2.5 Reducing the attack perimeter of the Linux kernel   hosts: all   become: true   remote_user: fstec   tasks:     - name: 2.5.1 Disabling the outdated vsyscall interface       blockinfile:         path: /etc/default/grub         marker: "# {mark} ANSIBLE MANAGED BLOCK - vsyscall settings"         block: |           GRUB_CMDLINE_LINUX_DEFAULT="quiet splash vsyscall=none"                   - name: 2.5.2. Restrict access to performance events       sysctl:         name: kernel.perf_event_paranoid         value: "3"         state: present      - name: 2.5.3. Disable mounting of the debugfs virtual file system       blockinfile:         path: /etc/default/grub         marker: "# {mark} ANSIBLE MANAGED BLOCK - debugfs settings"         block: |           GRUB_CMDLINE_LINUX_DEFAULT="quiet splash debugfs=no-mount"            - name: 2.5.4. Disable the kexec_load system call       sysctl:         name: kernel.kexec_load_disabled         value: "1"         state: present      - name: 2.5.5. Restrict the use of user namespaces       sysctl:         name: user.max_user_namespaces         value: "0"         state: present      - name: 2.5.6. Prohibit the bpf system call for unprivileged users       sysctl:         name: kernel.unprivileged_bpf_disabled         value: "1"         state: present      - name: 2.5.7. Prohibit the userfaultfd system call for unprivileged users       sysctl:         name: vm.unprivileged_userfaultfd         value: "0"         state: present      - name: 2.5.8. Prohibition of automatic loading of kernel modules for terminal line discipline       sysctl:         name: dev.tty.ldisc_autoload         value: "0"         state: present      - name: 2.5.9. Disable Transactional Synchronization Extensions (TSX) technology       blockinfile:         path: /etc/default/grub         marker: "# {mark} ANSIBLE MANAGED BLOCK - TSX settings"         block: |           GRUB_CMDLINE_LINUX_DEFAULT="quiet splash tsx=off"       - name: 2.5.10 Configuring the vm.mmap_min_addr kernel parameter       sysctl:         name: vm.mmap_min_addr         value: "4096"         state: present      - name: 2.5.11. Implement address space randomization       sysctl:         name: kernel.randomize_va_space         value: "2"         state: present        - name: Applying sysctl change       command: sysctl -p

- name: 2.6 Configuring user space protection tools from the Linux kernel   hosts: all   become: true   remote_user: fstec   tasks:     - name: 2.6.1. Prohibit connection to other processes using ptrace       sysctl:         name: kernel.yama.ptrace_scope         value: "3"         state: present      - name: 2.6.2. Limit unsafe options for passing through symbolic links       sysctl:         name: fs.protected_symlinks         value: "1"         state: present       - name: 2.6.3. Limit unsafe options for working with hard links       sysctl:         name: fs.protected_hardlinks         value: "1"         state: present      - name: 2.6.4. Enable protection against unintentional writing to a FIFO object       sysctl:         name: fs.protected_fifos         value: "2"         state: present      - name: 2.6.5. Enable protection against unintentional writing to a file       become: yes       sysctl:         name: fs.protected_regular         value: 2       register: sysctl_result     - name: Check the result of changing the sysctl option       debug:         var: sysctl_result      - name: 2.6.6. Prohibit the creation of core dump       sysctl:         name: fs.suid_dumpable         value: 0       register: sysctl_result     - name: Check the result of changing the sysctl option       debug:         var: sysctl_result          - name: Applying sysctl change       command: sysctl -p  - name: Update Grub   hosts: all   become: true   remote_user: fstec   tasks:     - name: Update Grub configuration       command: sudo grub2-mkconfig -o /boot/grub2/grub.cfg