Skip to content

Commit 5cd80f6

Browse files
Sumit Mishrawarp-agent
authored and
Sumit Mishra
committed
feat: Add Ubuntu 20.04 compatibility for CIS hardening
- Use pam_tally2 instead of pam_faillock on Ubuntu 20.04 - Use SHA512 encryption instead of yescrypt on Ubuntu 20.04 - Update README with generic CIS hardening description - Add version detection for Ubuntu-specific PAM modules Co-Authored-By: Warp <[email protected]>
1 parent 74a82dd commit 5cd80f6

File tree

2 files changed

+63
-19
lines changed

2 files changed

+63
-19
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ cp .arg.template .arg
237237
| NO_PROXY | URLS that should be excluded from proxying (Optional) | string | |
238238
| UPDATE_KERNEL | Determines whether to upgrade the Kernel version to the latest from the upstream OS provider | boolean | `false` |
239239
| DISABLE_SELINUX | Disable selinux in the operating system. Some applications (like Kubevirt) do not like selinux | boolean | `true` |
240-
| CIS_HARDENING | Enable CIS Benchmark hardening for the image. When set to `true`, applies CIS Ubuntu 22.04 LTS Benchmark security controls during the build. Only supported for Ubuntu 22.04. **Note: Should be used for Palette appliance builds only.** | boolean | `false` |
240+
| CIS_HARDENING | Enable CIS Benchmark hardening for the image. When set to `true`, applies CIS Benchmark security controls during the build. | boolean | `false` |
241241
| CLUSTERCONFIG | Path of the cluster config | string | |
242242
| IS_UKI | Build UKI(Trusted boot) images | boolean | `false` |
243243
| UKI_BRING_YOUR_OWN_KEYS | Bring your own public/private key pairs if this is set to true. Otherwise, CanvOS will generate the key pair. | boolean | `false` |

‎cis-harden/harden.sh‎

Lines changed: 62 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,17 @@
22

33
#
44
# This script is to harden Kairos, use in the CanvOS Dockerfile
5-
# Benchmark targeted: CIS Ubuntu Linux 22.04 LTS Benchmark Level 2 - Server
5+
# Benchmark targeted: CIS Ubuntu Linux 22.04 LTS Benchmark - Server
6+
# Also supports: Ubuntu 20.04 LTS with appropriate fallbacks
67
# Based on CIS Benchmark v2.0.0, released 2024-03-28
78
#
89
# This script is designed to run during ISO build (not on a live system)
910
# It writes configuration files that will be applied at boot time
1011
#
12+
# Key version differences:
13+
# - Ubuntu 22.04+: Uses pam_faillock.so and yescrypt encryption
14+
# - Ubuntu 20.04: Uses pam_tally2.so and SHA512 encryption
15+
#
1116

1217

1318
root_dir="$( cd "$( dirname "$0" )" && pwd )"
@@ -976,22 +981,49 @@ harden_auth() {
976981

977982
##############Password lockout policies##################
978983
if [[ ${OS_FLAVOUR} == "ubuntu" ]]; then
979-
# Ubuntu/Debian uses common-auth, common-account, common-password
980-
if [[ -f /etc/pam.d/common-auth ]]; then
981-
cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bak
982-
{
983-
echo "auth required pam_faillock.so preauth audit silent deny=4 fail_interval=900 unlock_time=600"
984-
echo "auth [success=1 default=ignore] pam_unix.so nullok"
985-
echo "auth [default=die] pam_faillock.so authfail audit deny=4 fail_interval=900 unlock_time=600"
986-
echo "auth sufficient pam_faillock.so authsucc audit deny=4 fail_interval=900 unlock_time=600"
987-
echo "auth requisite pam_deny.so"
988-
echo "auth required pam_permit.so"
989-
} >> /etc/pam.d/common-auth
984+
# Get Ubuntu version for compatibility checks
985+
ubuntu_version="22"
986+
if [[ -f /etc/os-release ]]; then
987+
. /etc/os-release
988+
ubuntu_version=$(echo "$VERSION_ID" | cut -d. -f1)
990989
fi
991990

992-
if [[ -f /etc/pam.d/common-account ]]; then
993-
cp /etc/pam.d/common-account /etc/pam.d/common-account.bak
994-
echo "account required pam_faillock.so" >> /etc/pam.d/common-account
991+
# Ubuntu/Debian uses common-auth, common-account, common-password
992+
# pam_faillock.so is only available in Ubuntu 22.04+
993+
if [[ "$ubuntu_version" -ge 22 ]]; then
994+
if [[ -f /etc/pam.d/common-auth ]]; then
995+
cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bak
996+
{
997+
echo "auth required pam_faillock.so preauth audit silent deny=4 fail_interval=900 unlock_time=600"
998+
echo "auth [success=1 default=ignore] pam_unix.so nullok"
999+
echo "auth [default=die] pam_faillock.so authfail audit deny=4 fail_interval=900 unlock_time=600"
1000+
echo "auth sufficient pam_faillock.so authsucc audit deny=4 fail_interval=900 unlock_time=600"
1001+
echo "auth requisite pam_deny.so"
1002+
echo "auth required pam_permit.so"
1003+
} >> /etc/pam.d/common-auth
1004+
fi
1005+
1006+
if [[ -f /etc/pam.d/common-account ]]; then
1007+
cp /etc/pam.d/common-account /etc/pam.d/common-account.bak
1008+
echo "account required pam_faillock.so" >> /etc/pam.d/common-account
1009+
fi
1010+
echo "Ubuntu 22.04+ PAM faillock configuration applied"
1011+
else
1012+
# Ubuntu 20.04 uses pam_tally2 instead of pam_faillock
1013+
echo "Ubuntu $ubuntu_version detected - using pam_tally2 for account lockout"
1014+
if [[ -f /etc/pam.d/common-auth ]]; then
1015+
cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bak
1016+
# Only add if not already present
1017+
if ! grep -q "pam_tally2" /etc/pam.d/common-auth; then
1018+
sed -i '/^auth.*pam_unix.so/i auth required pam_tally2.so deny=4 onerr=fail unlock_time=600' /etc/pam.d/common-auth
1019+
fi
1020+
fi
1021+
if [[ -f /etc/pam.d/common-account ]]; then
1022+
cp /etc/pam.d/common-account /etc/pam.d/common-account.bak
1023+
if ! grep -q "pam_tally2" /etc/pam.d/common-account; then
1024+
echo "account required pam_tally2.so" >> /etc/pam.d/common-account
1025+
fi
1026+
fi
9951027
fi
9961028

9971029
##############Password reuse policy##################
@@ -1091,9 +1123,21 @@ harden_auth() {
10911123
config_file='/etc/login.defs'
10921124

10931125
if [[ ${OS_FLAVOUR} == "ubuntu" ]]; then
1094-
# Ubuntu 22.04+ supports yescrypt
1095-
update_config_files 'ENCRYPT_METHOD' 'ENCRYPT_METHOD yescrypt' ${config_file}
1096-
echo "Password encryption method set to yescrypt"
1126+
# Check Ubuntu version for encryption method support
1127+
ubuntu_version="22"
1128+
if [[ -f /etc/os-release ]]; then
1129+
. /etc/os-release
1130+
ubuntu_version=$(echo "$VERSION_ID" | cut -d. -f1)
1131+
fi
1132+
if [[ "$ubuntu_version" -ge 22 ]]; then
1133+
# Ubuntu 22.04+ supports yescrypt
1134+
update_config_files 'ENCRYPT_METHOD' 'ENCRYPT_METHOD yescrypt' ${config_file}
1135+
echo "Password encryption method set to yescrypt"
1136+
else
1137+
# Ubuntu 20.04 and earlier use SHA512
1138+
update_config_files 'ENCRYPT_METHOD' 'ENCRYPT_METHOD SHA512' ${config_file}
1139+
echo "Password encryption method set to SHA512 (Ubuntu $ubuntu_version)"
1140+
fi
10971141
elif [[ ${OS_FLAVOUR} == "centos" ]] || [[ ${OS_FLAVOUR} == "rhel" ]]; then
10981142
# Check OS version for encryption method support
10991143
if [[ -f /etc/os-release ]]; then

0 commit comments

Comments
 (0)