Guide to the Secure Configuration of Debian 12

[xdmcp]
Enable=false

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

difok = 4
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3

ENCRYPT_METHOD 
         

$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d

PASS_MIN_DAYS 
         

PASS_MIN_LEN 
         

PASS_WARN_AGE 
         

$ sudo chage -M  root

$ sudo awk -F: '!$2 {print $1}' /etc/shadow

$ sudo passwd [username]

$ sudo passwd -l [username]

password [success=1 default=ignore] pam_unix.so ...existing_options... rounds=
         

$ sudo echo > /etc/securetty

ttyS0
ttyS1

vc/1
vc/2
vc/3
vc/4

# ls -ld DIR
         

PATH=:/bin
PATH=/bin:
PATH=/bin::/sbin

UMASK 
         

umask 
         

umask 
         

$ sudo systemctl enable ip6tables.service

$ sudo systemctl enable iptables.service

:INPUT DROP [0:0]

$ sudo service ip6tables reload

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

options ipv6 disable=1

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.default.disable_ipv6 = 1

$ sudo sysctl -w net.ipv6.conf.all.accept_ra_defrtr=0

net.ipv6.conf.all.accept_ra_defrtr = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0

net.ipv6.conf.all.accept_ra_pinfo = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_ra_rtr_pref=0

net.ipv6.conf.all.accept_ra_rtr_pref = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0

net.ipv6.conf.all.accept_redirects = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0

net.ipv6.conf.all.accept_source_route = 0

$ sudo sysctl -w net.ipv6.conf.all.autoconf=0

net.ipv6.conf.all.autoconf = 0

$ sudo sysctl -w net.ipv6.conf.all.max_addresses=1

net.ipv6.conf.all.max_addresses = 1

$ sudo sysctl -w net.ipv6.conf.all.router_solicitations=0

net.ipv6.conf.all.router_solicitations = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0

net.ipv6.conf.default.accept_ra_defrtr = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0

net.ipv6.conf.default.accept_ra_pinfo = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0

net.ipv6.conf.default.accept_ra_rtr_pref = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0

net.ipv6.conf.default.accept_redirects = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

net.ipv6.conf.default.accept_source_route = 0

$ sudo sysctl -w net.ipv6.conf.default.autoconf=0

net.ipv6.conf.default.autoconf = 0

$ sudo sysctl -w net.ipv6.conf.default.max_addresses=1

net.ipv6.conf.default.max_addresses = 1

$ sudo sysctl -w net.ipv6.conf.default.router_solicitations=0

net.ipv6.conf.default.router_solicitations = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_local=0

net.ipv4.conf.all.accept_local = 0

$ sudo sysctl -w net.ipv4.conf.all.arp_filter=
         

net.ipv4.conf.all.arp_filter = 
         

$ sudo sysctl -w net.ipv4.conf.all.arp_ignore=
         

net.ipv4.conf.all.arp_ignore = 
         

$ sudo sysctl -w net.ipv4.conf.all.route_localnet=0

net.ipv4.conf.all.route_localnet = 0

$ sudo sysctl -w net.ipv4.conf.all.shared_media=
         

net.ipv4.conf.all.shared_media = 
         

$ sudo sysctl -w net.ipv4.conf.default.shared_media=
         

net.ipv4.conf.default.shared_media = 
         

$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

net.ipv4.conf.all.accept_redirects = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0

net.ipv4.conf.all.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.all.drop_gratuitous_arp=1

net.ipv4.conf.all.drop_gratuitous_arp = 1

$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1

net.ipv4.conf.all.rp_filter = 1

$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0

net.ipv4.conf.all.secure_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0

net.ipv4.conf.default.accept_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0

net.ipv4.conf.default.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1

net.ipv4.conf.default.rp_filter = 1

$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0

net.ipv4.conf.default.secure_redirects = 0

$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

net.ipv4.icmp_ignore_bogus_error_responses = 1

$ sudo sysctl -w net.ipv4.ip_local_port_range=32768 65535

net.ipv4.ip_local_port_range = 32768 65535

$ sudo sysctl -w net.ipv4.tcp_rfc1337=1

net.ipv4.tcp_rfc1337 = 1

$ sudo sysctl -w net.ipv4.tcp_syncookies=1

net.ipv4.tcp_syncookies = 1

$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0

net.ipv4.conf.all.send_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0

net.ipv4.conf.default.send_redirects = 0

$ sudo sysctl -w net.ipv4.ip_forward=0

net.ipv4.ip_forward = 0

$ sudo chgrp root /etc/group-

$ sudo chgrp shadow /etc/gshadow-

$ sudo chgrp root /etc/passwd-

$ sudo chgrp shadow /etc/shadow-

$ sudo chgrp root /etc/group

$ sudo chgrp shadow /etc/gshadow

$ sudo chgrp root /etc/passwd

$ sudo chgrp shadow /etc/shadow

$ sudo chown root /etc/group- 

$ sudo chown root /etc/gshadow- 

$ sudo chown root /etc/passwd- 

$ sudo chown root /etc/shadow- 

$ sudo chown root /etc/group 

$ sudo chown root /etc/gshadow 

$ sudo chown root /etc/passwd 

$ sudo chown root /etc/shadow 

$ sudo chmod 0644 /etc/group-

$ sudo chmod 0640 /etc/gshadow-

$ sudo chmod 0644 /etc/passwd-

$ sudo chmod 0640 /etc/shadow-

$ sudo chmod 0644 /etc/group

$ sudo chmod 0640 /etc/gshadow

$ sudo chmod 0644 /etc/passwd

$ sudo chmod 0640 /etc/shadow

$ sudo chgrp root /etc/shells

$ sudo chown root /etc/shells 

$ sudo chmod 0644 /etc/shells

$ sudo chgrp root /var/log

$ sudo chgrp root /var/log/messages

$ sudo chgrp adm /var/log/syslog

$ sudo chown root /var/log 

$ sudo chown root /var/log/messages 

$ sudo chown syslog /var/log/syslog 

$ sudo chmod 0755 /var/log

$ sudo chmod 0640 /var/log/messages

$ sudo chmod 0640 /var/log/syslog

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin

$ sudo chown root DIR
         

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chown root DIR
         

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin

$ sudo chmod go-w DIR
         

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chmod go-w DIR
         

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin

$ sudo chown root FILE
         

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chown root FILE
         

/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin

$ sudo chmod go-w FILE
         

/lib
/lib64
/usr/lib
/usr/lib64

$ sudo chmod go-w FILE
         

$ sudo chgrp root /etc/sysctl.d

$ sudo chown root /etc/sysctl.d 

$ sudo chmod 0755 /etc/sysctl.d

/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin

$ sudo chgrp root FILE