DRAFT - ANSSI-BP-028 (intermediary)

PASS_MAX_DAYS 

PASS_MIN_LEN 

$ sudo echo > /etc/securetty

-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged

$ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0

net.ipv6.conf.all.accept_redirects = 0

$ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0

net.ipv6.conf.all.accept_source_route = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0

net.ipv6.conf.default.accept_redirects = 0

$ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0

net.ipv6.conf.default.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_local=0

net.ipv4.conf.all.accept_local = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0

net.ipv4.conf.all.accept_redirects = 0

$ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0

net.ipv4.conf.all.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.all.arp_filter=

net.ipv4.conf.all.arp_filter = 

$ sudo sysctl -w net.ipv4.conf.all.arp_ignore=

net.ipv4.conf.all.arp_ignore = 

$ sudo sysctl -w net.ipv4.conf.all.route_localnet=0

net.ipv4.conf.all.route_localnet = 0

$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1

net.ipv4.conf.all.rp_filter = 1

$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0

net.ipv4.conf.all.secure_redirects = 0

$ sudo sysctl -w net.ipv4.conf.all.shared_media=

net.ipv4.conf.all.shared_media = 

$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0

net.ipv4.conf.default.accept_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0

net.ipv4.conf.default.accept_source_route = 0

$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1

net.ipv4.conf.default.rp_filter = 1

$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0

net.ipv4.conf.default.secure_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.shared_media=

net.ipv4.conf.default.shared_media = 

$ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1

net.ipv4.icmp_ignore_bogus_error_responses = 1

$ sudo sysctl -w net.ipv4.tcp_syncookies=1

net.ipv4.tcp_syncookies = 1

$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0

net.ipv4.conf.all.send_redirects = 0

$ sudo sysctl -w net.ipv4.conf.default.send_redirects=0

net.ipv4.conf.default.send_redirects = 0

$ sudo sysctl -w net.ipv4.ip_forward=0

net.ipv4.ip_forward = 0

$ sudo chown root /etc/gshadow 

$ sudo chown root /etc/shadow 

$ sudo chmod 0644 /etc/group

$ sudo chmod 0000 /etc/gshadow

$ sudo chmod 0644 /etc/passwd

$ sudo chmod 0000 /etc/shadow

$ sudo sysctl -w fs.suid_dumpable=0

fs.suid_dumpable = 0

$ sudo sysctl -w kernel.kptr_restrict=

kernel.kptr_restrict = 

$ sudo sysctl -w kernel.randomize_va_space=2

kernel.randomize_va_space = 2