mirror of
https://github.com/trailofbits/algo
synced 2024-11-12 01:10:35 +00:00
33 lines
2.2 KiB
Markdown
33 lines
2.2 KiB
Markdown
|
# Ansible Roles
|
||
|
|
|
||
|
|
## Required Roles
|
||
|
|
|
||
|
|
* **Common**
|
||
|
|
* Installs several required packages and software updates, then reboots if necessary
|
||
|
|
* Configures network interfaces and enables packet forwarding on them
|
||
|
|
* **VPN**
|
||
|
|
* Installs [StrongSwan](https://www.strongswan.org/), enables AppArmor, limits CPU and memory access, and drops user privileges
|
||
|
|
* Builds a Certificate Authority (CA) with [easy-rsa-ipsec](https://github.com/ValdikSS/easy-rsa-ipsec) and creates one client certificate per user
|
||
|
|
* Bundles the appropriate certificates into Apple mobileconfig profiles for each user
|
||
|
|
* Configures IPtables to block traffic that might pose a risk to VPN users, such as [SMB/CIFS](https://medium.com/@ValdikSS/deanonymizing-windows-users-and-capturing-microsoft-and-vpn-accounts-f7e53fe73834)
|
||
|
|
|
||
|
|
## Optional Roles
|
||
|
|
|
||
|
|
* **Security Enhancements (Reccommended)**
|
||
|
|
* Enables [unattended-upgrades](https://help.ubuntu.com/community/AutomaticSecurityUpdates) to ensure available patches are always applied
|
||
|
|
* Modify features like core dumps, kernel parameters, and SUID binaries to limit possible attacks
|
||
|
|
* Enhances SSH with modern ciphers and seccomp, and restricts access to older, unwanted features like X11 forwarding and SFTP
|
||
|
|
* **Ad Blocking and Compression HTTP Proxy**
|
||
|
|
* Installs [Privoxy](https://www.privoxy.org/) with an ad blocking ruleset
|
||
|
|
* Installs Apache with [mod_pagespeed](http://modpagespeed.com/) as an HTTP proxy
|
||
|
|
* Constrains Privoxy and Apache with AppArmor and cgroups CPU and memory limitations
|
||
|
|
* **DNS Ad Blocking**
|
||
|
|
* Install the [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/doc.html) local resolver with a blacklist for advertising domains
|
||
|
|
* Constrains dnsmasq with AppArmor and cgroups CPU and memory limitations
|
||
|
|
* **Security Monitoring and Logging**
|
||
|
|
* Configures [auditd](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-system_auditing.html) and rsyslog to log data useful for investigating security incidents
|
||
|
|
* Sends logs to a configured email address on a regular basis
|
||
|
|
* **SSH Tunneling**
|
||
|
|
* Adds a restricted `algo` group with no shell access and limited SSH forwarding options
|
||
|
|
* Creates one limited, local account per user and an SSH public key for each
|