<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Hardening Baselines Reference

Deep reference for CIS benchmarks, SSH hardening, kernel sysctl, PAM configuration,
file permissions, AIDE, and logging architecture.
Parent skill: [../SKILL.md](../SKILL.md)

---

## CIS Benchmark Hardening — Ubuntu 22.04

Based on ansible-cis-ubuntu-2204 values.

### SSH Hardening (`/etc/ssh/sshd_config`, CIS Section 5.1)

```
PermitRootLogin no
MaxAuthTries 4
MaxSessions 10
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
TCPKeepAlive no
LoginGraceTime 60
LogLevel VERBOSE
ClientAliveInterval 15
ClientAliveCountMax 3
AddressFamily inet
AuthenticationMethods publickey
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512,hmac-sha2-256
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
# File permissions: /etc/ssh/sshd_config = root:root 0600
# Private host keys = 0600, public = 0644
```

---

## Kernel Sysctl Hardening (`/etc/sysctl.d/99-sysctl.conf`)

```ini
# Network hardening
net.ipv4.ip_forward = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_rfc1337 = 1
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_ra = 0
# Kernel hardening
kernel.randomize_va_space = 2
kernel.kptr_restrict = 2
kernel.kexec_load_disabled = 1
kernel.yama.ptrace_scope = 1
kernel.sysrq = 0
# Filesystem protection
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_fifos = 1
fs.protected_regular = 2
fs.suid_dumpable = 0
```

---

## PAM Configuration

### Privileged Access Management Hardening

**Faillock config — `/etc/security/faillock.conf` (CIS 5.3.1):**
```
deny = 5                # lockout after 5 failures
unlock_time = 900       # 900s = 15min lockout
fail_interval = 900     # failures counted within 900s window
even_deny_root = yes    # root account also subject to lockout
```

**Password quality — `/etc/security/pwquality.conf` (CIS 5.3.2):**
```
minlen = 14
minclass = 3
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3
maxsequence = 3
difok = 2
```

**Password history — `/etc/pam.d/common-password`:**
```
password required pam_pwhistory.so remember=24 enforce_for_root use_authtok
```

**Password aging — `/etc/login.defs`:**
```
PASS_MAX_DAYS 365
PASS_MIN_DAYS 1
PASS_WARN_AGE 7
INACTIVE = 45   # days after expiry before account disabled
```

---

## UMASK and Session Timeout

### UMASK Enforcement (CIS 5.4.2.6)

```bash
# /etc/profile.d/umask.sh
umask 027   # default: new files = 640, new dirs = 750
# /etc/login.defs
UMASK 027
```

### Session Timeout (CIS 5.4.3.2)

```bash
TMOUT=900   # auto-logout after 15min of inactivity
readonly TMOUT
export TMOUT
```

---

## File Permission Targets

```bash
chmod 0600 /etc/shadow /etc/gshadow
chmod 0644 /etc/passwd /etc/group
chmod 0700 /root /home/*
chmod 0600 /etc/ssh/sshd_config
chmod 0400 /etc/sudoers
chmod 0600 /etc/cron.{daily,weekly,monthly,d,hourly}/*
chmod 0700 /etc/cron.{daily,weekly,monthly,d,hourly}
```

---

## Disable Unnecessary Kernel Modules (CIS 1.1.1)

```bash
# /etc/modprobe.d/blacklist-cis.conf
install cramfs /bin/false
install freevxfs /bin/false
install hfs /bin/false
install hfsplus /bin/false
install jffs2 /bin/false
install usb-storage /bin/false
```

---

## AIDE File Integrity Monitoring

```bash
# Initialize: aideinit; cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
# Daily cron check (CIS 6.3.2):
0 5 * * * root /usr/bin/aide --config /etc/aide/aide.conf --check
```

---

## Logging Architecture

Collect → Forward → Retain.

### Journald

- `SystemMaxUse=4G`
- `MaxFileSec=1month`
- `SystemKeepFree=8G`

### Auditd Backlog

- `max_log_file = 8` (MB)
- `max_log_file_action = keep_logs`
- `disk_full_action = halt`

### Remote Forwarding

rsyslog/journald-remote → centralized SIEM.
Rotation at source; retain 90d online, 1yr cold.

### Anti-Pattern

Sending all logs to SIEM without pre-filtering — a noisy Windows domain controller generates 50GB/day of 4624 logon events. Pre-filter at source (Winlogbeat processors), normalize, then forward only high-signal events.

---
v1.1 | Validated: 2026-03-13
