Signed package validation
Validating a signed package against the public key doesn’t guarantee that you’re 100% safe. Both the package and the key could have been compromised. Also validate the key fingerprint against the key itself.
Packages, public signing key, and the key fingerprint should come from different channels. Options include passing the key and fingerprint manually, including them in documentation, or hosting them on different machines. If one machine gets compromised, the others might still be safe.
nginx autoindex off
Disables directory listing. Fortunately, the default value is off.
/etc/nginx/conf.d/default.conf
autoindex off;
Restrict HTTP methods with nginx limit_except
/etc/nginx/conf.d/default.conf
location / {
limit_except GET HEAD {
deny all;
}
root /var/www;
try_files $uri $uri/ =404;
}
Linux user can have passwordless sudo access restricted to specific commands
Example on Debian
useradd --create-home --shell /bin/bash <user> echo '<user> ALL=(root) NOPASSWD: /usr/bin/apt-get update' >> /etc/sudoers.d/<user> echo '<user> ALL=(root) NOPASSWD: /usr/bin/apt-get install -y <program>' >> /etc/sudoers.d/<user>
Restrict SSH key authentication algorithm
/etc/ssh/sshd_config
PubkeyAcceptedAlgorithms ssh-ed25519
SSH key authentication StrictModes
With StrictModes enabled, SSH verifies ownership and permissions of user home directory, .ssh directory, authorized_keys file.
/etc/ssh/sshd_config
StrictModes yes
ansible.posix.synchronize Ansible module does not verify host key by default
The verify_host parameter is false by default.
playbook.yml
- name: Upload
ansible.posix.synchronize:
src: "<src>/"
dest: "<user>@<host>:."
archive: true
perms: false
verify_host: true
Force execution of a specific command with SSH
Specify a command the user can run with a specific SSH key.
~/.ssh/authorized_keys
command="/usr/bin/<command> /allowed_path",<other options> ssh-ed25519 <public key>
Verify server host keys against generated known_hosts
You can pre-generate known_hosts file based on allowed SSH keys (you should know the source of the key.). So that future access does not require user interaction.
Either with ssh-keyscan or in other custom ways.
~/.ssh/known_hosts
<allowed-host> ssh-ed25519 <public key>
~/.ssh/config
Host host HostName <hostname> User <user> UserKnownHostsFile ~/.ssh/known_hosts StrictHostKeyChecking yes
Scan OCI images for vulnerabilities and bad configurations
I used Trivy.
OCI images can be signed
I used Cosign.
Access to external networks can be restricted in Docker (and Compose)
Use an internal network.
docker-compose.yml
networks:
<name>:
internal: true
Container-to-container traffic can be restricted in Docker (and Compose)
Use com.docker.network.bridge.enable_icc.
docker-compose.yml
networks:
<name>:
driver_opts:
com.docker.network.bridge.enable_icc: "false"