search

VeeamHub / veeam-hardened-repository

Sample code for hardening a Veeam Repository
MIT License
31 stars 6 forks source link

Ubuntu 22.04 Support #4

Open Wolfg1 opened 9 months ago

Wolfg1 commented 9 months ago

or is it a good idea to install 20.04, run the script and then upgrade to 22.04?

Best regards, Wolfgang

carceneaux commented 9 months ago

This script currently only supports Ubuntu 20.04.

A DISA STIG profile has yet to be released for Ubuntu 22.04. As such, it's recommended currently to stick with 20.04 for this project.

Here's a good reference:

https://ubuntu.com/security/certifications/docs/2204

yuabe1 commented 8 months ago

How soon will the scripts be available once the DISA STIG profile for Ubuntu 22.04 is released?

celeroncool commented 6 months ago

Hello, DISA STIG for 22.04 has been released April 4th, https://public.cyber.mil/announcement/disa-releases-the-canonical-ubuntu-22-04-lts-security-technical-implementation-guide/

jay29300 commented 5 months ago

Hello, DISA STIG for 22.04 has been released April 4th, https://public.cyber.mil/announcement/disa-releases-the-canonical-ubuntu-22-04-lts-security-technical-implementation-guide/

hello, i see this news for 22.04, i try to download in public but the link is broken. do you think a script for 22.04 will be avaliable soon ? 20.04 has end of standard security maintenance in april 2025 ;-(

bnjmnflow commented 3 months ago

Hello, any timeline about a script for 22.04 LTS ? We are waiting on it as end of security maintenance of 20.04 is soon. Thank you !

carceneaux commented 3 months ago

Hi @bnjmnflow,

The current script should support Ubuntu 22.04 DISA STIG but it has yet to be tested.

As this is a community built and supported script, please test and let us know.

natecohen commented 2 months ago

usg-report-20240917.2035.zip

I am not well versed in DISA STIG but have been testing Ubuntu 22.04 in a lab environment for VHR use.

All changes by the hardening script ended up showing PASS results in the report, except for these, but they all appeared to be false positives, and remediation was not applicable (this was after a reboot):

  1. xccdf_org.ssgproject.content_rule_accounts_tmout
  2. xccdf_org.ssgproject.content_rule_sshd_use_approved_macs_ordered_stig
  3. xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies
  4. xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog
  5. xccdf_org.ssgproject.content_rule_chronyd_sync_clock
  6. xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space