ANSSI-BP-028 (minimal)

$ sudo zypper install dnf-automatic

gpgcheck=1

gpgcheck=0

$ sudo zypper refresh && sudo zypper list-patches -g security

$ sudo systemctl enable dnf-automatic.timer

$ sudo chage -M 180 -m 7 -W 7 USER

$ sudo chmod +t DIR

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nogroup 2>/dev/null

$ findmnt -n -l -k -it $(awk '/nodev/ { print $2 }' /proc/filesystems | paste -sd,)

$ sudo find MOUNTPOINT -xdev -nouser 2>/dev/null

$ sudo zypper remove dhcp-server

$ sudo zypper remove xinetd

$ sudo zypper remove ypserv

$ sudo zypper remove rsh-server

 $ sudo zypper remove talk-server

$ sudo zypper remove talk

$ sudo zypper remove telnet-server

 $ sudo zypper remove tftp-server