konstruktoid / hardened-images Goto Github PK

View Code? Open in Web Editor NEW

68.0 4.0 19.0 393 KB

Packer templates to create hardened Ubuntu server images.

License: Apache License 2.0

Shell 64.00% HCL 36.00%

ubuntu vagrant compliance hardening packer-template packer security ovf ansible virtualbox

hardened-images's Introduction

Hardened Ubuntu server templates

This is a repository containing Packer templates to create a hardened Ubuntu server.

There are templates available for creating a

20.04 LTS (Focal Fossa) and 22.04 LTS (Jammy Jellyfish) are supported.

The Ansible role used to make the server a bit more secure is available in the konstruktoid/ansible-role-hardening repository.

The role is installed and configured using config/local.yml.

See https://www.packer.io/docs/builders and https://www.packer.io/docs/post-processors on how to rewrite the template if you want to use it for another platforms.

Usage

Amazon Web Services

Requires Packer and a Amazon Web Services account.

Ensure that the correct values are set in ubuntu-aws-vars.json before validating the configuration and building the Amazon Machine Image.

{
  "aws_region": "eu-west-3",
  "instance_type": "t3.medium",
  "release": "22.04"
}

packer init -upgrade -var-file ubuntu-aws-vars.json ubuntu-hardened-aws.pkr.hcl
packer validate -var-file ubuntu-aws-vars.json ubuntu-hardened-aws.pkr.hcl
packer build -timestamp-ui -var-file ubuntu-aws-vars.json ubuntu-hardened-aws.pkr.hcl

Azure

Requires Packer and a Microsoft Azure account.

Ensure the correct values are set in ubuntu-azure-vars.json before validating the configuration and building the image.

azure_vars_export is a script that will create or reset the service principal, and export the necessary environment variables to authenticate with Azure.

{
  "image_offer": "0001-com-ubuntu-minimal-jammy",
  "image_sku": "minimal-22_04-lts-gen2",
  "principal_name": "PackerPrincipal",
  "resource_group": "PackerGroup",
  "vm_size": "Standard_D2s_v3"
}

packer init -upgrade -var-file ubuntu-azure-vars.json ubuntu-hardened-azure.pkr.hcl
packer validate -var-file ubuntu-azure-vars.json ubuntu-hardened-azure.pkr.hcl
packer build -timestamp-ui -var-file ubuntu-azure-vars.json ubuntu-hardened-azure.pkr.hcl

Local files

Requires Packer, Vagrant and VirtualBox.

To build the Vagrant boxes, run bash build_box.sh. The script will git clone https://github.com/chef/bento.git to a temporary directory and apply a .diff to add the Ansible role.

The generated boxes will be stored in the output directory and the temporary directory removed.

Verification

There's a SLSA artifact present under the slsa action workflow.

Using the box in a Vagrantfile

Vagrant.configure("2") do |config|
  config.vbguest.installer_options = { allow_kernel_upgrade: true }
  config.vm.provider "virtualbox" do |vb|
    vb.memory = 2048
    vb.customize ["modifyvm", :id, "--uart1", "0x3F8", "4"]
    vb.customize ["modifyvm", :id, "--uartmode1", "file", File::NULL]
  end

  config.vm.define "noble" do |noble|
    noble.vm.hostname = "hardened-noble"
    noble.vm.box = "ubuntu-noble/20.04"
    noble.vm.box_url = "file://output/ubuntu-24.04-x86_64.bento-hardened.box"
  end
end

Repository structure

.
├── azure_vars_export
├── build_box.sh
├── config
│   ├── ansible.cfg
│   ├── bento.diff
│   └── local.yml
├── LICENSE
├── README.md
├── renovate.json
├── scripts
│   ├── aws.sh
│   ├── azure.sh
│   ├── cleanup.sh
│   ├── hardening.sh
│   ├── minimize.sh
│   ├── postproc.sh
│   └── vagrant.sh
├── SECURITY.md
├── ubuntu-aws-vars.json
├── ubuntu-azure-vars.json
├── ubuntu-hardened-aws.pkr.hcl
├── ubuntu-hardened-azure.pkr.hcl
└── Vagrantfile

2 directories, 21 files

Contributing

Do you want to contribute? Great! Contributions are always welcome, no matter how large or small. If you found something odd, feel free to submit a issue, improve the code by creating a pull request, or by sponsoring this project.

License

Apache License Version 2.0

Author Information

https://github.com/konstruktoid

hardened-images's People

Contributors

Stargazers

Watchers

Forkers

simeononsecurity swipswaps codeshane deepanshumarwah automatecompliance rivhan64 hasssammalik iulmit scupperscupper ahmedelshafaie asasar imanimanyara kostyan6812 eamesh step-security-bot smana mvandermeulen sprinklingthatdevops

hardened-images's Issues

Can't configure a second NIC

Hi,

I created a VM with the new vagrant box and cloned it. Then I added a second NIC to the clone, but when I want to configure it, I can't find the correct /etc/netplan configuration file.

Any idea on how to add a second NIC to this VM?

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

github-actions

.github/workflows/dependency-review.yml

step-security/harden-runner v2.8.0@f086349bfa2bd1361f7909c78558e816508cdc10

actions/checkout v4.1.6@a5ac7e51b41094c92402da3b24376905380afc29

actions/dependency-review-action v4.3.2@0c155c5e8556a497adf53f2c18edabf945ed8e70

.github/workflows/issues.yml

step-security/harden-runner v2.8.0@f086349bfa2bd1361f7909c78558e816508cdc10

pozil/auto-assign-issue v2.0.0@c5bca5027e680b9e8411b826d16947afd8c76b32

.github/workflows/scorecards.yml

step-security/harden-runner v2.8.0@f086349bfa2bd1361f7909c78558e816508cdc10

actions/checkout v4.1.6@a5ac7e51b41094c92402da3b24376905380afc29

ossf/scorecard-action v2.3.3@dc50aa9510b46c811795eb24b2f1ba02a914e534

actions/upload-artifact v4.3.3@65462800fd760344b1a7b4382951275a0abb4808

github/codeql-action v3.25.6@9fdb3e49720b44c48891d036bb502feb25684276

.github/workflows/slsa.yml

step-security/harden-runner v2.8.0@f086349bfa2bd1361f7909c78558e816508cdc10

actions/checkout v4.1.6@a5ac7e51b41094c92402da3b24376905380afc29

actions/upload-artifact v4.3.3@65462800fd760344b1a7b4382951275a0abb4808

slsa-framework/slsa-github-generator v2.0.0

actions/download-artifact v4.1.7@65a9edc5881444af0b9093a5e628f2fe47ea3b2e

softprops/action-gh-release v2.0.5@69320dbe05506a9a39fc8ae11030b214ec2d1f87

Check this box to trigger a request for Renovate to run again on this repository

Just to let you know (not an issue per se, but quite interesting)

Hi Thomas,

(as I don't know how to let you know otherwise, I'm using the project issues)

When you start the newly created vagrant box with your Vagrant file, the plugin vagrant-vbguest kicks in and installs or re-installs quite a few packages (including the linux-headers, etc.) but also removes some hardening. This happens regardless of your "config.vbguest" line in the Vagrantfile.

For instance, I noticed that the changes in $ADDUSER and $USERADD were reverted. So for this project, I'm not sure what the best way to proceed is. Either to uninstall the plugin, or to re-run the hardening script within the vagrant box.

P.S. you can close this issue afterwards