Ansible battle tested hardening for Linux, SSH, Nginx, MySQL

yjftsjthsd-h 8 hours ago | parent | next [-]

"battle tested" how? Widely deployed? Red teamed and shown to actually help?

	▲	observationist 4 hours ago \| parent [-]
		They've got a red-team type process they apply repeatedly, you have to piece things together from the changelogs to get a grasp on what they're doing. They've built a positive feedback loop on which to iterate improvements in security, and bundled it in a way to be used effectively with Ansible. They're following CIS guidelines, so if you're in a situation where that matters, it's probably a solid starting point for building things you need to have compliant and predictable. Could probably save weeks of effort, depending on the size of the team.

▲

TacticalCoder 5 hours ago | parent | prev | next [-]

The Linux hardening list lists quite some modifications but what hardening is made to SSH compared to a stock config? For Linux they summarize the list of hardened changes but for SSH I couldn't find it.

For SSH it's basically a list of default values with a comment saying "change this if you must". Some summary as to what is hardened compared to a stock SSH install would be nice.

	▲	observationist 4 hours ago \| parent [-]
		https://github.com/dev-sec/ansible-collection-hardening/blob... The changelogs contain a summary of actions and changes, and full changelogs go into detail.

▲

Spivak 6 hours ago | parent | prev | next [-]

These playbooks apply the CIS benchmarks, very very useful for compliance. I use them at $dayjob to build our base AMIs.

As for whether they actually harden your servers, that's up for you to decide if you think that CIS actually helps. It certainly does reduce attack surface.

▲

hackernudes 5 hours ago | parent | next [-]

Context: https://www.cisecurity.org/cis-benchmarks, https://www.cisecurity.org/about-us

"""The CIS Benchmarks® are prescriptive configuration recommendations for more than 25+ vendor product families. They represent the consensus-based effort of cybersecurity experts globally to help you protect your systems against threats more confidently."""

	▲	infocollector an hour ago \| parent [-]
		https://learn.cisecurity.org/benchmarks - this seems broken at least right now. Are these benchmarks on github so that I can download and run it on a linux box?

▲

wingmanjd 6 hours ago | parent | prev [-]

At my $DAYJOB, we have a bunch in-house saltstack states for applying the CIS benchmarks for Ubuntu, Debian, and CentOS. I never looked into it, but I always wondered if I'd be allowed to publish them publicly.

	▲	bhattisatish 4 hours ago \| parent [-]
		Well there is one available for oscap at https://github.com/ComplianceAsCode/content

▲

mhb 7 hours ago | parent | prev [-]

What does this mean?

	▲	ggm 4 hours ago \| parent [-]
		If you have compliance for contractual reasons (e/g you are the supply chain for an entity which has been declared to be a national-strategic service delivery) then this would probably help get you over the line to meet minimum proofs you have tried to comply with the obligations. So, "what does this mean" is "it means you can tender to sell services to people who put CIS obligations in the contract"