-
Notifications
You must be signed in to change notification settings - Fork 1
/
harden.py
191 lines (175 loc) · 8.97 KB
/
harden.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
# Author:sidious
import os
import requests
import subprocess as subp
# Define color support
CYA = '\033[96m'
GRE = '\033[92m'
RED = '\033[31m'
NOR = '\033[0m'
#Check network connectivity
def inet_check():
try:
global ip
ip = requests.get("http://ifconfig.me")
if ip.status_code == 200:
ip = ip.text.strip()
else:
print(F"[!]Internet connectivity{RED}failed{NOR}.")
exit()
except (ConnectionResetError, ConnectionRefusedError) as error:
print("[!]Connecting to ifconfig.me failed. Test your internet connection manually.")
exit()
#Banner inlcuding IPaddress
def banner():
print(f'''\n{CYA}
██╗ ██╗ █████╗ ██████╗ ██████╗ ███████╗███╗ ██╗
██║ ██║██╔══██╗██╔══██╗██╔══██╗██╔════╝████╗ ██║
███████║███████║██████╔╝██║ ██║█████╗ ██╔██╗ ██║
██╔══██║██╔══██║██╔══██╗██║ ██║██╔══╝ ██║╚██╗██║
██║ ██║██║ ██║██║ ██║██████╔╝███████╗██║ ╚████║
╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═══╝
-sidious-
IP:{NOR} {ip}
''')
# Update the system
def update_config():
print(f"[{CYA}*{NOR}]Attempting {CYA}OS updates{NOR}, please hold")
update = subp.run(["apt", "update"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
upgrade = subp.run(["apt", "upgrade", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
cmd = "export PATH=$PATH:/usr/sbin"
os.system(cmd)
if upgrade.returncode == 0:
print(f"[{GRE}*{NOR}]OS updates {GRE}completed.{NOR}")
else:
print(f"[!]OS update {RED}failed.{NOR}")
exit()
# Install fail2ban to protect against brute-force attacks
def fail2ban_config():
print(f"[{CYA}*{NOR}]Attempting to install{CYA} fail2ban{NOR}")
fail2ban = subp.run(["apt", "install", "fail2ban", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if fail2ban.returncode == 0:
print(f"[{GRE}*{NOR}]Installation of fail2ban {GRE}completed{NOR}.")
else:
print(f"[{RED}!{NOR}]Installation of fail2ban {RED}failed{NOR}.")
exit()
# Set the SSH port to a non-standard port
def sshd_hardening():
print(f"[{CYA}*{NOR}]Attempting to configure {CYA}sshd_config{NOR}")
subp.run(["mv", "/etc/ssh/sshd_config", "/etc/ssh/sshd_config.bak"])
file = open("sshd_config", "w")
file.write('''Protocol 2\nIgnoreRhosts yes\nHostbasedAuthentication no\nPermitRootLogin no\nPermitEmptyPasswords no\nX11Forwarding no\nMaxAuthTries 5\nClientAliveInterval 900\nClientAliveCountMax 0\nUsePAM yes\nHostKey /etc/ssh/ssh_host_ed25519_key\nHostKey /etc/ssh/ssh_host_rsa_key\nKexAlgorithms curve25519-sha256@libssh.org\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com\n''')
subp.run(["mv", "sshd_config", "/etc/ssh/"])
restart_sshd = subp.run(["systemctl", "restart", "sshd.service"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if restart_sshd.returncode == 0:
print(f"[{GRE}*{NOR}]sshd configuration {GRE}completed{NOR}")
else:
print(f"[{RED}!{NOR}]sshd configuration {RED}failed{NOR}")
# Set up a firewall
def firewall_config():
print(f"[{CYA}*{NOR}]Attempting to install {CYA}ufw firewall rules{NOR}")
install_uwf = subp.run(["apt", "install", "ufw", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
subp.run(["ufw", "default", "deny", "incoming"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
subp.run(["ufw", "default", "allow", "outgoing"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
subp.run(["ufw", "allow", "ssh"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
subp.run(["ufw", "allow", "2107/tcp"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
enable_rules = subp.run(["ufw", "enable"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if install_uwf.returncode == 0:
print(f"[{GRE}*{NOR}]Installation of ufw {GRE}completed{NOR}.")
else:
print(f"[!]Installation of ufw {GRE}failed{NOR}.")
if enable_rules.returncode == 0:
print(f"[{GRE}*{NOR}]Configuration of firewall rules is {GRE}completed{NOR}")
else:
print(f"[{RED}!{NOR}]Configuration of firewall rules {RED}failed{NOR}.")
def auto_updates():
auto_up = input(f"[{CYA}*{NOR}]Would you like to have auto updates enabled press y/n: ")
if auto_up == "y":
print(f"[{CYA}*{NOR}]Attempting to configure {CYA}unattended-upgrades{NOR}")
subp.run(["apt", "install", "unattended-upgrades", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
with open("/etc/apt/apt.conf.d/20auto-upgrades", "a") as f:
f.write('APT::Periodic::Update-Package-Lists "1";\n')
f.write('APT::Periodic::Unattended-Upgrade "1";\n')
elif auto_up == "n":
print(f"[{GRE}*{NOR}]Skipping{CYA} unattended-upgrades{NOR}")
pass
else:
print(f"[{RED}!{NOR}]Did not select an option, skipping")
pass
# Remove unnecessary packages and services
def remove_unn():
print(f"[{CYA}*{NOR}]Attempting to remove {CYA}unnecesarry packages{NOR}")
unnecessary_packages = subp.run(["apt", "remove", "telnet*", "rsh-client*", "rsh-redone-client", "talk*",
"xinetd", "ypserv*", "tftp*", "openbsd-inetd", "bind9", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if unnecessary_packages.returncode == 0:
print(f"[{GRE}*{NOR}]Removing unnecessary packages {GRE}completed{NOR}.")
else:
print(f"[{RED}!{NOR}]Removing of unnecessary packages {RED}failed{NOR}.")
# Enable auditd to track changes to the system
def install_auditd():
print(f"[{CYA}*{NOR}]Attempting to install {CYA}auditd{NOR}")
auditd = subp.run(["apt", "install", "auditd", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if auditd.returncode == 0:
print(f"[{GRE}*{NOR}]Installation of auditd {GRE}completed{NOR}.")
else:
print(f"[{RED}!{NOR}]Installation of auditd {RED}failed{NOR}.")
# Secure the GRUB bootloader
def secure_grub():
print(f"[{CYA}*{NOR}]Attempting to {CYA}secure GRUB{NOR}")
subp.run(["sed", "-i", "s/GRUB_CMDLINE_LINUX=\"\"/GRUB_CMDLINE_LINUX=\"audit=1\"/", "/etc/default/grub"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
update_grub = subp.run(["update-grub"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if update_grub.returncode == 0:
print(f"[{GRE}*{NOR}]Secure configuartion of grub {GRE}completed{NOR}.")
else:
print(f"[{RED}!{NOR}]Secure configuration of grub {RED}failed{NOR}.")
# Configure AppArmor to enforce security policies
def install_apparmor():
apparmor_config = input(f"[{CYA}*{NOR}]Would you like to install AppArmor on the system? Press y/n: ")
if apparmor_config == "y":
print(f"[{CYA}*{NOR}]Attempting to install {CYA}AppArmor{NOR}")
install_apparmor = subp.run(["apt", "install", "apparmor", "apparmor-utils", "-y"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if install_apparmor.returncode == 0:
print(f"[{GRE}*{NOR}]Installation of AppArmor is {GRE}completed{NOR}")
else:
print(f"[{RED}!{NOR}]Installation of AppArmor {GRE}failed{NOR}.")
elif apparmor_config == "n":
print(f"[{GRE}*{NOR}]Skipping installation of {CYA}AppArmor{NOR}")
else:
print("Did not select an option, skipping")
pass
# Enable kernel protection features
def kernel_hardening():
print(f"[{CYA}*{NOR}]Attempting to hardenen the {CYA}kernel{NOR}")
with open("/etc/sysctl.conf", "a") as f:
f.write('kernel.kptr_restrict = 2\n')
f.write('kernel.dmesg_restrict = 1\n')
f.write('kernel.perf_event_paranoid = 2\n')
f.write('kernel.randomize_va_space = 2\n')
f.write('kernel.yama.ptrace_scope = 1\n')
f.write('kernel.yama.protected_nonaccess_hardlinks = 1\n')
f.write('kernel.yama.protected_sticky_symlinks = 1\n')
reload_mod = subp.run(["sysctl", "-p"], stdout=subp.DEVNULL, stderr=subp.DEVNULL)
if reload_mod.returncode == 255:
print(f"[{GRE}*{NOR}]Kernel hardening {GRE}completed{NOR}")
else:
print(f"[{RED}!{NOR}]Kernel hardening {RED}failed{NOR}.")
if __name__ == '__main__':
try:
inet_check()
banner()
update_config()
fail2ban_config()
sshd_hardening()
firewall_config()
auto_updates()
remove_unn()
install_auditd()
secure_grub()
install_apparmor()
kernel_hardening()
except KeyboardInterrupt:
print("\nExited by user.")
exit()
except Exception as error:
print(error)
exit()