Closed Iolaum closed 6 years ago
nachoparker
commented
6 years ago great stuff!
I'll have a close look later. Right now I can say that mysql does have root password ( in /root/.my.cnf ) that is randomly generated.
About security repository, there is no such thing in Raspbian, look here
nachoparker
commented
6 years ago I had the redis password thing on my list already but it is good to know that it gets checked by lynis.
I suggest we start with the biggest offenders
after this, we could harden further with some iptables rules and finally we could have a look at some of the tools proposed, such as the audit daemon.
Thoughts?
nachoparker
commented
6 years ago first phase is done
after this, we could harden further with some iptables rules and finally we could have a look at some of the tools proposed, such as the audit daemon.
this would be next
nachoparker
commented
6 years ago After a second round we went from 62 to 81!
Hardening index : 81 [################ ]I added a internal root password to the database, even though mysql_secure_installation says that this is not required because of /etc/.my.cnf.
Most of the remaining warnings stem from the fact that a RPi is not a powerful server so we're not changing things like the partitioning scheme.
Also stuff such as samhain and tripwire use up a lot of resources so they won't be used by default.
Once we have the iptables rules the score should go up a little bit more ;)
edit: thoughts about installing lynis by default? maybe we can include a hook in ncp-web
nachoparker
commented
6 years ago about the false positive for database password
Exploring lynis, a security auditing for UNIX derivatives.
Paste the output of
sudo ncp-reportNextCloudPi diagnostics
``` NextCloudPi version v0.41.8 NextCloudPi image NextCloudPi_12-04-17 distribution Raspbian GNU/Linux 9 \n \l automount yes USB devices sda datadir /media/USBdrive/ncdata data in SD no data filesystem ext2/ext3 data disk usage 1.3G/917G rootfs usage 1.6G/3.6G Nextcloud check ok Nextcloud version 12.0.4.3 HTTPD service up PHP service up MariaDB service up Redis service up Postfix service up internet check ok port check 80 open port check 443 open IP 192.168.1.20 gateway 192.168.1.1 interface eth0 certificates my.custom.domain certs due 88 days NAT loopback no uptime 1:42 ```Nextcloud configuration
``` { "system": { "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": { "0": "my.custom.domain:443", "1": "192.168.1.20", "4": "my.custom.domain", "2": "my.custom.domain" }, "datadirectory": "\/media\/USBdrive\/ncdata", "overwrite.cli.url": "https:\/\/my.custom.domain", "dbtype": "mysql", "version": "12.0.4.3", "dbname": "nextcloud", "dbhost": "localhost", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": "ocs86rkb5syt", "memcache.local": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "\/var\/run\/redis\/redis.sock", "port": 0, "timeout": 0 }, "mail_smtpmode": "php", "mail_smtpauthtype": "LOGIN", "mail_from_address": "admin", "mail_domain": "my.custom.domain", "overwriteprotocol": "https", "maintenance": false, "loglevel": "2", "logfile": "\/media\/wd1\/ncdata\/nextcloud.log", "log_type": "file" } } ```HTTPd logs
``` [Thu Dec 14 23:57:23.322365 2017] [ssl:warn] [pid 593:tid 1992904704] AH01909: localhost:4443:0 server certificate does NOT include an ID which matches the server name [Thu Dec 14 23:57:24.000233 2017] [:notice] [pid 593:tid 1992904704] ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/) configured. [Thu Dec 14 23:57:24.000335 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: APR compiled version="1.5.2"; loaded version="1.5.2" [Thu Dec 14 23:57:24.000365 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14" [Thu Dec 14 23:57:24.000385 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: LUA compiled version="Lua 5.1" [Thu Dec 14 23:57:24.000402 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: YAJL compiled version="2.1.0" [Thu Dec 14 23:57:24.000419 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: LIBXML compiled version="2.9.4" [Thu Dec 14 23:57:24.000434 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: Original server signature: Apache/2.4.25 (Raspbian) [Thu Dec 14 23:57:24.000715 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: StatusEngine call: "2.9.1,Apache/2.4.25 (Raspbian),1.5.2/1.5.2,8.39/8.39 2016-06-14,Lua 5.1,2.9.4,e4" [Thu Dec 14 23:57:24.462164 2017] [:notice] [pid 593:tid 1992904704] ModSecurity: StatusEngine call successfully sent. For more information visit: http://status.modsecurity.org/ [Thu Dec 14 23:57:24.956899 2017] [ssl:warn] [pid 884:tid 1992904704] AH01909: localhost:4443:0 server certificate does NOT include an ID which matches the server name [Thu Dec 14 23:57:25.017287 2017] [mpm_event:notice] [pid 884:tid 1992904704] AH00489: Apache/2.4.25 (Raspbian) OpenSSL/1.0.2l configured -- resuming normal operations [Thu Dec 14 23:57:25.017516 2017] [core:notice] [pid 884:tid 1992904704] AH00094: Command line: '/usr/sbin/apache2' [Fri Dec 15 00:40:28.806975 2017] [mpm_event:notice] [pid 884:tid 1992904704] AH00493: SIGUSR1 received. Doing graceful restart [Fri Dec 15 00:40:30.002592 2017] [mpm_event:notice] [pid 884:tid 1992904704] AH00489: Apache/2.4.25 (Raspbian) OpenSSL/1.0.2l configured -- resuming normal operations [Fri Dec 15 00:40:30.002681 2017] [core:notice] [pid 884:tid 1992904704] AH00094: Command line: '/usr/sbin/apache2' [Fri Dec 15 00:40:46.709146 2017] [mpm_event:notice] [pid 884:tid 1992904704] AH00493: SIGUSR1 received. Doing graceful restart [Fri Dec 15 00:40:48.002648 2017] [mpm_event:notice] [pid 884:tid 1992904704] AH00489: Apache/2.4.25 (Raspbian) OpenSSL/1.0.2l configured -- resuming normal operations [Fri Dec 15 00:40:48.002737 2017] [core:notice] [pid 884:tid 1992904704] AH00094: Command line: '/usr/sbin/apache2' ```Database logs
``` tail: cannot open '/var/log/mysql/*.log' for reading: No such file or directory ```Nextcloud logs
``` {"reqId":"mSKJSTlg249c9hS10r14","level":4,"time":"2017-12-04T15:00:14+00:00","remoteAddr":"","user":"--","app":"cron","method":"--","url":"--","message":"Not installed","userAgent":"--","version":""} {"reqId":"q27zHS2lTQ2SWLQQCau3","level":4,"time":"2017-12-04T15:15:13+00:00","remoteAddr":"","user":"--","app":"cron","method":"--","url":"--","message":"Not installed","userAgent":"--","version":""} {"reqId":"k6rSDAJZ7dpjUXvy5kAw","level":4,"time":"2017-12-04T15:30:15+00:00","remoteAddr":"","user":"--","app":"cron","method":"--","url":"--","message":"Not installed","userAgent":"--","version":""} {"reqId":"a6Bi2SH6CD4IGtquXoah","level":4,"time":"2017-12-04T15:47:28+00:00","remoteAddr":"","user":"--","app":"cron","method":"--","url":"--","message":"Not installed","userAgent":"--","version":""} {"reqId":"WitQsH8AAQEAAAMhyXIAAFAD","level":2,"time":"2017-12-09T02:55:45+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WitQtn8AAQEAAAMhyXQAAFEB","level":2,"time":"2017-12-09T02:55:51+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WitQvX8AAQEAAAMhyXgAAFIP","level":2,"time":"2017-12-09T02:55:58+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WitQwn8AAQEAAAMhyXoAAFQC","level":2,"time":"2017-12-09T02:56:04+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WitQyn8AAQEAAAMhyXwAAFUU","level":2,"time":"2017-12-09T02:56:12+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WitQ138AAQEAAAMhyX4AAFYK","level":2,"time":"2017-12-09T02:56:26+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WitQ4n8AAQEAAAMhyYMAAFgH","level":2,"time":"2017-12-09T02:56:41+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi0gnX8AAQEAAAMqA60AAEQU","level":2,"time":"2017-12-10T11:55:09+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi0ij38AAQEAAAMprDEAABYD","level":2,"time":"2017-12-10T12:03:28+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi0itX8AAQEAAAMqA7AAAEYX","level":2,"time":"2017-12-10T12:04:06+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi0mSX8AAQEAAAMqA7MAAEgE","level":2,"time":"2017-12-10T12:19:23+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi0n8n8AAQEAAAMprDMAAA8F","level":2,"time":"2017-12-10T12:26:28+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi0oC38AAQEAAAMprDUAABAH","level":2,"time":"2017-12-10T12:26:54+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi08Wn8AAQEAAAMiy@MAAEkN","level":2,"time":"2017-12-10T13:53:37+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"Wi08kH8AAQEAAAMiy@UAAEoD","level":2,"time":"2017-12-10T13:54:37+00:00","remoteAddr":"192.168.1.7","user":"--","app":"core","method":"POST","url":"\/index.php\/login?user=admin","message":"Login failed: 'admin' (Remote IP: '192.168.1.7')","userAgent":"Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:57.0) Gecko\/20100101 Firefox\/57.0","version":"12.0.4.3"} {"reqId":"WjMUfn8AAQEAAAN@nOQAAABY","level":3,"time":"2017-12-15T00:17:02+00:00","remoteAddr":"187.95.130.246","user":"--","app":"PHP","method":"GET","url":"\/admin\/config.php","message":"Exception: The requested uri(\/admin\/config.php) cannot be processed by the script '\/core\/templates\/404.php') at \/var\/www\/nextcloud\/lib\/private\/AppFramework\/Http\/Request.php#729","userAgent":"curl\/7.15.5 (x86_64-redhat-linux-gnu) libcurl\/7.15.5 OpenSSL\/0.9.8b zlib\/1.2.3 libidn\/0.6.5","version":"12.0.4.3"} ```We install lynis according to the official installation instructions and run as root. Usage is simple:
Since this is automated some warnings/suggestions might be off.
The ones I think are worthy of conideration (feel free to point out why I 'm wrong) are:
Some others might be interested for our users to implement by themselves based on their specific setup.