Skip to content

fix: pass-2 hardening polish #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
neohiro merged 1 commit into from
Oct 9, 2026
Merged

fix: pass-2 hardening polish #28

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions linuxinstall.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3681,12 +3681,12 @@ EOF
TMOUT=900; readonly TMOUT; export TMOUT
EOF
run sudo chmod 644 /etc/profile.d/99-tmout.sh
ok "Password/lockout policy set. Note: 'core 0' in /etc/security/limits.conf is recommended."
ok "Password/lockout policy set. Core dumps are disabled by the attack-surface step."
}

harden_attack_surface() {
msg "Attack surface reduction (built-in: filesystems, SSH crypto, login policy)"
if ! prompt_yn "Apply additional built-in ASR hardening (filesystem blacklist, SSH crypto, login.defs)?" "y"; then
msg "Attack surface reduction (built-in: filesystems, SSH crypto, login policy, core dumps)"
if ! prompt_yn "Apply additional built-in ASR hardening (filesystem blacklist, SSH crypto, login.defs, core dumps)?" "y"; then
return 0
fi

Expand Down Expand Up @@ -3777,8 +3777,13 @@ harden_attack_surface() {
)
for k in "${!login_vals[@]}"; do
local v="${login_vals[$k]}"
if grep -qE "^${k}[[:space:]]" "$login_defs" 2>/dev/null; then
run sudo sed -i -E "s/^${k}[[:space:]]+.*/${k} ${v}/" "$login_defs"
# Never downgrade an existing password hash method (e.g. yescrypt/bcrypt).
if [ "$k" = "ENCRYPT_METHOD" ] && grep -qE "^[[:space:]]*ENCRYPT_METHOD[[:space:]]+" "$login_defs" 2>/dev/null; then
info "Keeping existing ENCRYPT_METHOD (no downgrade to ${v})."
continue
fi
if grep -qE "^[[:space:]]*${k}[[:space:]]+" "$login_defs" 2>/dev/null; then
run sudo sed -i -E "s/^[[:space:]]*${k}[[:space:]]+.*/${k} ${v}/" "$login_defs"
else
printf '%s %s\n' "$k" "$v" | run sudo tee -a "$login_defs" >/dev/null
fi
Expand Down
Loading