Skip to content

Commit b817b90

Browse files
author
nacho
committed
security hardening
1 parent 42a079d commit b817b90

File tree

6 files changed

+93
-157
lines changed

6 files changed

+93
-157
lines changed

‎changelog.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11

2-
[v0.41.10](https://github.com/nextcloud/nextcloudpi/commit/72785d5) (2017-12-16) dnsmasq: added interface
2+
[v0.41.11](https://github.com/nextcloud/nextcloudpi/commit/17af1ab) (2017-12-16) security hardening
33

4-
[v0.41.9](https://github.com/nextcloud/nextcloudpi/commit/e4e205f) (2017-12-14) fix occ command without execute permissions
4+
[v0.41.10](https://github.com/nextcloud/nextcloudpi/commit/330df57) (2017-12-16) dnsmasq: added interface
55

6-
[v0.41.8](https://github.com/nextcloud/nextcloudpi/commit/26d6f66) (2017-12-13) Fixed configuration interoperability between nc-datadit and fail2ban. (#323)
6+
[v0.41.9 ](https://github.com/nextcloud/nextcloudpi/commit/e4e205f) (2017-12-14) fix occ command without execute permissions
7+
8+
[v0.41.8 ](https://github.com/nextcloud/nextcloudpi/commit/26d6f66) (2017-12-13) Fixed configuration interoperability between nc-datadit and fail2ban. (#323)
79

810
[v0.41.7 ](https://github.com/nextcloud/nextcloudpi/commit/ce92a4f) (2017-12-12) replace ping to github.com to google.com
911

‎etc/nextcloudpi-config.d/nc-init.sh‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ configure()
3030
{
3131
echo "Setting up a clean Nextcloud instance... wait until message 'NC init done'"
3232

33+
# checks
34+
local REDISPASS=$( grep "^requirepass" /etc/redis/redis.conf | cut -d' ' -f2 )
35+
[[ "$REDISPASS" == "" ]] && { echo "redis server without a password. Abort"; return 1; }
36+
3337
## RE-CREATE DATABASE TABLE
3438

3539
echo "Setting up database..."
@@ -91,14 +95,15 @@ EOF
9195

9296
# redis cache
9397
sed -i '$d' config/config.php
94-
cat >> config/config.php <<'EOF'
95-
'memcache.local' => '\OC\Memcache\Redis',
96-
'memcache.locking' => '\OC\Memcache\Redis',
98+
cat >> config/config.php <<EOF
99+
'memcache.local' => '\\OC\\Memcache\\Redis',
100+
'memcache.locking' => '\\OC\\Memcache\\Redis',
97101
'redis' =>
98102
array (
99103
'host' => '/var/run/redis/redis.sock',
100104
'port' => 0,
101105
'timeout' => 0.0,
106+
'password' => '$REDISPASS',
102107
),
103108
);
104109
EOF

‎etc/nextcloudpi-config.d/nc-nextcloud.sh‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ install()
4444
$APTINSTALL -o "Dpkg::Options::=--force-confold" php-smbclient
4545
$APTINSTALL lbzip2 iputils-ping
4646

47+
# POSTFIX
4748
[[ "$ARMBIANBUILD" != 1 ]] && {
4849
$APTINSTALL postfix
4950
} || {
@@ -53,15 +54,20 @@ install()
5354
sed -i '/Package: postfix/{n;d}' /var/lib/dpkg/status
5455
sed -i '/Package: postfix/a;Status: install ok installed|' /var/lib/dpkg/status
5556
}
57+
sed -i 's|^smtpd_banner .*|smtpd_banner = $myhostname ESMTP|' /etc/postfix/main.cf
58+
sed -i 's|^disable_vrfy_command .*|disable_vrfy_command = yes|' /etc/postfix/main.cf
5659

5760
# REDIS
5861
$APTINSTALL redis-server php7.0-redis
5962

6063
local REDIS_CONF=/etc/redis/redis.conf
64+
local REDISPASS=$( openssl rand -base64 32 )
6165
sed -i "s|# unixsocket .*|unixsocket /var/run/redis/redis.sock|" $REDIS_CONF
6266
sed -i "s|# unixsocketperm .*|unixsocketperm 770|" $REDIS_CONF
67+
sed -i "s|# requirepass .*|requirepass $REDISPASS|" $REDIS_CONF
68+
sed -i 's|# rename-command CONFIG ""|rename-command CONFIG ""|' $REDIS_CONF
6369
sed -i "s|^port.*|port 0|" $REDIS_CONF
64-
echo "maxmemory ${REDIS_MEM}" >> $REDIS_CONF
70+
echo "maxmemory $REDIS_MEM" >> $REDIS_CONF
6571
echo 'vm.overcommit_memory = 1' >> /etc/sysctl.conf
6672

6773
usermod -a -G redis www-data

‎lamp.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ install()
3737

3838
# Randomize mariaDB password
3939
# Suggested by @enoch85 and taken from the nextcloud vm ( https://github.com/nextcloud/vm/blob/master/lib.sh#L46 )
40-
DBPASSWD=$(tr -dc "a-zA-Z0-9@#*=" < /dev/urandom | fold -w "$(shuf -i 30-35 -n 1)" | head -n 1)
40+
DBPASSWD=$( openssl rand -base64 32 )
4141
echo -e "[client]\npassword=$DBPASSWD" > /root/.my.cnf
4242
chmod 600 /root/.my.cnf
4343

‎nextcloudpi.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,34 @@ EOF
199199

200200
## tag image
201201
echo "NextCloudPi_$( date "+%m-%d-%y" )" > /usr/local/etc/ncp-baseimage
202+
203+
## SSH hardening
204+
sed -i 's|^#AllowTcpForwarding .*|AllowTcpForwarding no|' /etc/ssh/sshd_config
205+
sed -i 's|^#ClientAliveCountMax .*|ClientAliveCountMax 2|' /etc/ssh/sshd_config
206+
sed -i 's|^#MaxAuthTries .*|MaxAuthTries 2|' /etc/ssh/sshd_config
207+
sed -i 's|^#MaxSessions .*|MaxSessions 2|' /etc/ssh/sshd_config
208+
sed -i 's|^#PermitRootLogin .*|PermitRootLogin no|' /etc/ssh/sshd_config
209+
sed -i 's|^#TCPKeepAlive .*|TCPKeepAlive no|' /etc/ssh/sshd_config
210+
sed -i 's|^#X11Forwarding .*|X11Forwarding no|' /etc/ssh/sshd_config
211+
sed -i 's|^#AllowAgentForwarding .*|AllowAgentForwarding no|' /etc/ssh/sshd_config
212+
213+
## kernel hardening
214+
cat >> /etc/sysctl.conf <<EOF
215+
sysctl fs.protected_hardlinks=1
216+
sysctl fs.protected_symlinks=1
217+
sysctl kernel.core_uses_pid=1
218+
sysctl kernel.dmesg_restrict=1
219+
sysctl kernel.kptr_restrict=2
220+
sysctl kernel.sysrq=0
221+
sysctl net.ipv4.conf.all.accept_redirects=0
222+
sysctl net.ipv4.conf.all.log_martians=1
223+
sysctl net.ipv4.conf.all.rp_filter=1
224+
sysctl net.ipv4.conf.all.send_redirects=0
225+
sysctl net.ipv4.conf.default.accept_redirects=0
226+
sysctl net.ipv4.conf.default.accept_source_route=0
227+
sysctl net.ipv4.conf.default.log_martians=1
228+
sysctl net.ipv4.tcp_timestamps=0
229+
EOF
202230
fi
203231
}
204232

‎update.sh‎

Lines changed: 44 additions & 149 deletions
Original file line numberDiff line numberDiff line change
@@ -115,155 +115,6 @@ done
115115
# only for image builds
116116
[[ ! -f /.ncp-image ]] && {
117117

118-
# log adjustment for wizard
119-
test -f /home/www/ncp-launcher.sh && \
120-
cat > /home/www/ncp-launcher.sh <<'EOF'
121-
#!/bin/bash
122-
DIR=/usr/local/etc/nextcloudpi-config.d
123-
test -f $DIR/$1 || { echo "File not found"; exit 1; }
124-
source /usr/local/etc/library.sh
125-
cd $DIR
126-
touch /run/ncp.log
127-
chmod 640 /run/ncp.log
128-
chown root:www-data /run/ncp.log
129-
launch_script $1 &> /run/ncp.log
130-
RET=$?
131-
132-
# clean log for the next PHP backend call to start clean,
133-
# but wait until everything from current execution is read
134-
sleep 0.5 && echo "" > /run/ncp.log
135-
136-
exit $RET
137-
EOF
138-
139-
# 2 days to avoid very big backups requests to timeout
140-
test -f /etc/apache2/sites-available/ncp.conf && {
141-
grep -q TimeOut /etc/apache2/sites-available/ncp.conf || \
142-
sed -i '/SSLCertificateKeyFile/aTimeOut 172800' /etc/apache2/sites-available/ncp.conf
143-
} || echo "Warning. File /etc/apache2/sites-available/ncp.conf not found on your ncp."
144-
145-
# relocate noip2 config
146-
mkdir -p /usr/local/etc/noip2
147-
148-
# redis
149-
REDIS_CONF=/etc/redis/redis.conf
150-
sysctl vm.overcommit_memory=1 &>/dev/null
151-
grep -q APCu /var/www/nextcloud/config/config.php && {
152-
echo "installing redis..."
153-
apt-get update
154-
apt-get install -y --no-install-recommends redis-server php7.0-redis
155-
156-
sed -i '/memcache/d' /var/www/nextcloud/config/config.php
157-
sed -i '$d' /var/www/nextcloud/config/config.php
158-
159-
cat >> /var/www/nextcloud/config/config.php <<'EOF'
160-
'memcache.local' => '\OC\Memcache\Redis',
161-
'memcache.locking' => '\OC\Memcache\Redis',
162-
'redis' =>
163-
array (
164-
'host' => '/var/run/redis/redis.sock',
165-
'port' => 0,
166-
'timeout' => 0.0,
167-
),
168-
);
169-
EOF
170-
171-
REDIS_MEM=3gb
172-
sed -i "s|# unixsocket .*|unixsocket /var/run/redis/redis.sock|" $REDIS_CONF
173-
sed -i "s|# unixsocketperm .*|unixsocketperm 770|" $REDIS_CONF
174-
sed -i "s|port.*|port 0|" $REDIS_CONF
175-
echo "maxmemory ${REDIS_MEM}" >> $REDIS_CONF
176-
echo 'vm.overcommit_memory = 1' >> /etc/sysctl.conf
177-
178-
sudo usermod -a -G redis www-data
179-
180-
systemctl restart redis-server
181-
systemctl enable redis-server
182-
183-
# need to restart php
184-
bash -c " sleep 3
185-
systemctl stop php7.0-fpm
186-
systemctl stop mysqld
187-
sleep 0.5
188-
systemctl start php7.0-fpm
189-
systemctl start mysqld
190-
" &>/dev/null &
191-
}
192-
sed -i 's|^logfile.*|logfile /var/log/redis/redis-server.log|' $REDIS_CONF
193-
194-
# fix redis update bug
195-
grep -q sock700 $REDIS_CONF && {
196-
sed -i '/unixsocket/d' $REDIS_CONF
197-
echo "unixsocket /var/run/redis/redis.sock" >> $REDIS_CONF
198-
echo "unixsocketperm 770" >> $REDIS_CONF
199-
systemctl restart redis-server
200-
}
201-
grep -q unixsocketperm $REDIS_CONF || echo unixsocketperm 770 >> $REDIS_CONF
202-
203-
# fix unattended
204-
NUSER=$( grep USER_ /usr/local/etc/nextcloudpi-config.d/nc-notify-updates.sh | head -1 | cut -f2 -d= )
205-
cat > /usr/local/bin/ncp-notify-unattended-upgrade <<EOF
206-
#!/bin/bash
207-
208-
LOGFILE=/var/log/unattended-upgrades/unattended-upgrades.log
209-
STAMPFILE=/var/run/.ncp-notify-unattended-upgrades
210-
VERFILE=/usr/local/etc/ncp-version
211-
212-
test -e "\$LOGFILE" || { echo "\$LOGFILE not found"; exit 1; }
213-
214-
# find lines with package updates
215-
LINE=\$( grep "INFO Packages that will be upgraded:" "\$LOGFILE" )
216-
217-
[[ "\$LINE" == "" ]] && { echo "no new upgrades"; exit 0; }
218-
219-
# extract package names
220-
PKGS=\$( sed 's|^.*Packages that will be upgraded: ||' <<< "\$LINE" | tr '\\n' ' ' )
221-
222-
# mark lines as read
223-
sed -i 's|INFO Packages that will be upgraded:|INFO Packages that will be upgraded :|' \$LOGFILE
224-
225-
echo -e "Packages automatically upgraded: \$PKGS\\n"
226-
227-
# notify
228-
sudo -u www-data php /var/www/nextcloud/occ notification:generate \
229-
$NUSER "NextCloudPi Unattended Upgrades" \
230-
-l "Packages automatically upgraded \$PKGS"
231-
EOF
232-
chmod +x /usr/local/bin/ncp-notify-unattended-upgrade
233-
234-
# fix modsecurity uploads
235-
sed -i 's|^SecRequestBodyLimit .*|#SecRequestBodyLimit 13107200|' /etc/modsecurity/modsecurity.conf
236-
237-
# fix ramlogs
238-
[[ $( grep "^ACTIVE_" /usr/local/etc/nextcloudpi-config.d/nc-ramlogs.sh | cut -f2 -d'=' ) == "yes" ]] && {
239-
mkdir -p /usr/lib/systemd/system
240-
cat > /usr/lib/systemd/system/ramlogs.service <<'EOF'
241-
[Unit]
242-
Description=Populate ramlogs dir
243-
Requires=network.target
244-
Before=redis-server apache2 mysqld
245-
246-
[Service]
247-
ExecStart=/bin/bash /usr/local/bin/ramlog-dirs.sh
248-
249-
[Install]
250-
WantedBy=multi-user.target
251-
EOF
252-
253-
cat > /usr/local/bin/ramlog-dirs.sh <<'EOF'
254-
#!/bin/bash
255-
mkdir -p /var/log/myslq
256-
chown mysql /var/log/mysql
257-
258-
mkdir -p /var/log/apache2
259-
chown apache2 /var/log/apache2
260-
261-
mkdir -p /var/log/redis
262-
chown redis /var/log/redis
263-
EOF
264-
systemctl enable ramlogs
265-
}
266-
267118
# fix automount in latest images
268119
test -f /etc/udev/rules.d/90-qemu.rules && {
269120
rm -f /etc/udev/rules.d/90-qemu.rules
@@ -276,6 +127,50 @@ EOF
276127
apt-get update
277128
apt-get install -y --no-install-recommends btrfs-tools
278129
}
130+
131+
# harden security
132+
133+
## harden redis
134+
REDIS_CONF=/etc/redis/redis.conf
135+
REDISPASS=$( grep "^requirepass" /etc/redis/redis.conf | cut -d' ' -f2 )
136+
[[ "$REDISPASS" == "" ]] && REDISPASS=$( openssl rand -base64 32 )
137+
sed -i 's|# rename-command CONFIG ""|rename-command CONFIG ""|' $REDIS_CONF
138+
sed -i "s|# requirepass .*|requirepass $REDISPASS|" $REDIS_CONF
139+
140+
grep -q "'password'" /var/www/nextcloud/config/config.php || \
141+
sed -i "/timeout/a'password' => '$REDISPASS'," /var/www/nextcloud/config/config.php
142+
143+
## harden postfix
144+
sed -i 's|^smtpd_banner .*|smtpd_banner = $myhostname ESMTP|' /etc/postfix/main.cf
145+
sed -i 's|^disable_vrfy_command .*|disable_vrfy_command = yes|' /etc/postfix/main.cf
146+
147+
## harden SSH
148+
sed -i 's|^#AllowTcpForwarding .*|AllowTcpForwarding no|' /etc/ssh/sshd_config
149+
sed -i 's|^#ClientAliveCountMax .*|ClientAliveCountMax 2|' /etc/ssh/sshd_config
150+
sed -i 's|^#MaxAuthTries .*|MaxAuthTries 2|' /etc/ssh/sshd_config
151+
sed -i 's|^#MaxSessions .*|MaxSessions 2|' /etc/ssh/sshd_config
152+
sed -i 's|^#PermitRootLogin .*|PermitRootLogin no|' /etc/ssh/sshd_config
153+
sed -i 's|^#TCPKeepAlive .*|TCPKeepAlive no|' /etc/ssh/sshd_config
154+
sed -i 's|^#X11Forwarding .*|X11Forwarding no|' /etc/ssh/sshd_config
155+
sed -i 's|^#AllowAgentForwarding .*|AllowAgentForwarding no|' /etc/ssh/sshd_config
156+
157+
## harden kernel
158+
grep -q protected_hardlinks=1 /etc/sysctl.conf || cat >> /etc/sysctl.conf <<EOF
159+
fs.protected_hardlinks=1
160+
fs.protected_symlinks=1
161+
kernel.core_uses_pid=1
162+
kernel.dmesg_restrict=1
163+
kernel.kptr_restrict=2
164+
kernel.sysrq=0
165+
net.ipv4.conf.all.accept_redirects=0
166+
net.ipv4.conf.all.log_martians=1
167+
net.ipv4.conf.all.rp_filter=1
168+
net.ipv4.conf.all.send_redirects=0
169+
net.ipv4.conf.default.accept_redirects=0
170+
net.ipv4.conf.default.accept_source_route=0
171+
net.ipv4.conf.default.log_martians=1
172+
net.ipv4.tcp_timestamps=0
173+
EOF
279174
}
280175

281176
exit 0

0 commit comments

Comments
 (0)