Skip to content

Commit 6703da8

Browse files
fidpaclaude
fidpa
and
claude
committed
v1.0.0
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
0 parents  commit 6703da8

File tree

195 files changed

+40715
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

195 files changed

+40715
-0
lines changed

‎COMPONENT_README_TEMPLATE.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Component Name
2+
3+
One-line description (what it does + key differentiator).
4+
5+
## Features
6+
7+
- ✅ **Key Feature 1** - Brief explanation
8+
- ✅ **Key Feature 2** - Brief explanation
9+
- ✅ **Key Feature 3** - Brief explanation
10+
- ✅ **Key Feature 4** - Brief explanation
11+
- ✅ **Key Feature 5** - Brief explanation
12+
13+
## Quick Start
14+
15+
```bash
16+
# 1. Install
17+
sudo apt install package-name
18+
19+
# 2. Basic configuration
20+
sudo cp component/config.template /etc/component/config
21+
22+
# 3. Enable
23+
sudo systemctl enable --now component.service
24+
```
25+
26+
**Full guide**: See [docs/SETUP.md](docs/SETUP.md)
27+
28+
## Documentation
29+
30+
| Document | Description |
31+
|----------|-------------|
32+
| [SETUP.md](docs/SETUP.md) | Installation and configuration guide |
33+
| [KEY_DOC_1.md](docs/KEY_DOC_1.md) | Specific topic documentation |
34+
| [KEY_DOC_2.md](docs/KEY_DOC_2.md) | Another important topic |
35+
| [TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) | Common issues and solutions |
36+
37+
## Requirements
38+
39+
- Ubuntu 22.04+ / Debian 11+
40+
- systemd (for service management)
41+
- Optional: Additional dependencies if needed
42+
43+
## Use Cases
44+
45+
- ✅ **Use Case 1** - When to use this component
46+
- ✅ **Use Case 2** - Another scenario
47+
- ✅ **Use Case 3** - Additional use case
48+
49+
---
50+
51+
## Template Usage Guidelines
52+
53+
**Keep**:
54+
- One-line description (scannable)
55+
- Features with ✅ checkmarks (5-7 max)
56+
- Quick Start minimal (3-5 commands + link)
57+
- Documentation table (4-6 key docs)
58+
59+
**Avoid**:
60+
- Long "Overview" or "What It Does" sections (move to docs/OVERVIEW.md)
61+
- Inline bash code >10 lines (move to docs/SETUP.md)
62+
- Copyright headers (MIT license covers it)
63+
- Redundant info already in main README.md
64+
65+
**Structure Priority**:
66+
1. Features (what you get)
67+
2. Quick Start (how to start)
68+
3. Documentation (where to learn more)
69+
4. Requirements (what you need)
70+
5. Use Cases (when to use)

‎LICENSE‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
MIT License
2+
3+
Copyright (c) 2025-2026 Marc Allgeier (fidpa)
4+
https://github.com/fidpa/ubuntu-server-security
5+
6+
Permission is hereby granted, free of charge, to any person obtaining a copy
7+
of this software and associated documentation files (the "Software"), to deal
8+
in the Software without restriction, including without limitation the rights
9+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
copies of the Software, and to permit persons to whom the Software is
11+
furnished to do so, subject to the following conditions:
12+
13+
The above copyright notice and this permission notice shall be included in all
14+
copies or substantial portions of the Software.
15+
16+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
SOFTWARE.

‎LINKEDIN_POST.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
🐧 Eigenentwicklung: 14 Ubuntu Server Security Komponenten (MIT Lizenz)
2+
3+
Nach wochenlangem Hardening von Ubuntu-Servern (von 60% zu 100% CIS Compliance) habe ich 14 production-ready Security-Komponenten mit modularem Drop-in Pattern als Open-Source veröffentlicht.
4+
5+
**Das Problem**: Standard Ubuntu Server Security ist unzureichend für Production Workloads. Fehlende Boot Protection, tausende AIDE False-Positives, unsichere Kernel-Parameter, USB-Angriffsvektoren, schwaches SSH, keine Rootkit Detection, Plaintext-Credentials, ungesicherte Firewall, Brute-Force-anfällig, fehlendes Auditing.
6+
7+
**Die Lösung**: 14 Production-getestete Komponenten für Defense-in-Depth Security:
8+
9+
🔐 **Boot Security** - GRUB + UEFI Password (PBKDF2-SHA512)
10+
⚙️ **Kernel Hardening** - sysctl parameters + /tmp noexec (production-safe)
11+
🔌 **USB Defense** - 3-layer protection (kernel blacklist + real-time detection + auditd)
12+
🔑 **SSH Hardening** - 15+ CIS controls, key-only auth
13+
🧱 **UFW** - Simple firewall (CIS-compliant, Docker-aware)
14+
🔥 **nftables** - Advanced firewall (NAT, WireGuard VPN, rate-limiting)
15+
🔍 **AIDE** - File Integrity Monitoring (production-tuned excludes)
16+
🛡️ **rkhunter** - Rootkit detection (false-positive whitelisting)
17+
📝 **auditd** - Kernel-level audit logging (CIS 4.1.x, SIEM-ready)
18+
🔒 **AppArmor** - Mandatory Access Control (database profiles)
19+
🔐 **Vaultwarden** - Credential management (Bitwarden CLI, .env replacement)
20+
🚫 **fail2ban** - Brute-force protection (GeoIP filtering, Telegram alerts)
21+
📡 **Security Monitoring** - Unified event monitoring (smart deduplication)
22+
📊 **Lynis** - Security auditing (Hardening Index, compliance validation)
23+
24+
**Architektur**: Modulare Drop-in Configs + Prometheus Integration für monitoring-ready, wartbare Deployments.
25+
26+
📊 14 Komponenten, 39 Skripte, 94 Docs, ~13.000 Zeilen Code
27+
🔧 Stack: Ubuntu, Debian | CIS Controls: 40+
28+
🔗 github.com/fidpa/ubuntu-server-security
29+
30+
Marc | IT · Datenschutz · Psychologie
31+
32+
#Cybersecurity #DevSecOps #Linux #Ubuntu #OpenSource #Infrastructure #CISBenchmark #ComplianceAutomation

‎README.md‎

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
# Ubuntu Server Security
2+
3+
![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)
4+
![Ubuntu](https://img.shields.io/badge/Ubuntu-22.04%20%7C%2024.04-orange?logo=ubuntu)
5+
![CIS Benchmark](https://img.shields.io/badge/CIS%20Benchmark-100%25-blue)
6+
7+
Production-ready security configurations for Ubuntu servers.
8+
9+
**The Problem**: Security tools are powerful but complex to configure. Default settings generate noise, integrations are missing, and credentials are stored in plaintext. After weeks of hardening production servers to 100% CIS Benchmark compliance, I've extracted 14 battle-tested security components.
10+
11+
## Components
12+
13+
| Component | Description |
14+
|-----------|-------------|
15+
| **[boot-security/](boot-security/)** | GRUB + UEFI password protection (defense-in-depth) |
16+
| **[kernel-hardening/](kernel-hardening/)** | Kernel security via sysctl parameters + /tmp hardening |
17+
| **[usb-defense/](usb-defense/)** | 3-layer USB defense system (kernel blacklist + real-time detection + auditd) |
18+
| **[ssh-hardening/](ssh-hardening/)** | SSH hardening with 15+ CIS Benchmark controls |
19+
| **[ufw/](ufw/)** | UFW Firewall baseline (CIS-compliant, Docker-aware) |
20+
| **[nftables/](nftables/)** | Advanced firewall (NAT, Docker, WireGuard VPN, rate-limiting) |
21+
| **[aide/](aide/)** | Intrusion Detection with 99.7% false-positive reduction |
22+
| **[rkhunter/](rkhunter/)** | Rootkit detection with automated scanning |
23+
| **[auditd/](auditd/)** | Kernel-level audit logging (CIS 4.1.x, SIEM-ready) |
24+
| **[apparmor/](apparmor/)** | Mandatory Access Control profiles (PostgreSQL, Docker) |
25+
| **[vaultwarden/](vaultwarden/)** | Credential management via Bitwarden CLI (no plaintext secrets) |
26+
| **[fail2ban/](fail2ban/)** | Brute-force protection (GeoIP filtering, Telegram alerts) |
27+
| **[security-monitoring/](security-monitoring/)** | Unified security event monitoring with smart deduplication |
28+
| **[lynis/](lynis/)** | Security auditing & hardening recommendations (CIS compliance) |
29+
30+
## Features
31+
32+
- ✅ **Defense-in-Depth** - 14 complementary security layers (boot → kernel → hardware → network → detection → logging → audit → monitoring)
33+
- ✅ **CIS Benchmark Compliance** - 40+ controls across all components
34+
- ✅ **Drop-in Configuration Pattern** - Modular configs for all components
35+
- ✅ **Docker-Compatible** - All hardening tested with containerized workloads
36+
- ✅ **Prometheus Integration** - Metrics exporters for monitoring
37+
- ✅ **systemd Automation** - Daily checks with configurable schedules
38+
- ✅ **Production-Proven** - Running on multiple Ubuntu servers with 100% CIS compliance
39+
40+
## Quick Start
41+
42+
Each component has its own README with detailed setup instructions. Here's a quick overview:
43+
44+
```bash
45+
# Clone the repository
46+
git clone https://github.com/fidpa/ubuntu-server-security.git
47+
cd ubuntu-server-security
48+
49+
# Choose components based on your needs:
50+
51+
# 1. Boot Security (prevents unauthorized boot modifications)
52+
sudo ./boot-security/scripts/setup-grub-password.sh
53+
54+
# 2. Kernel Hardening (sysctl + /tmp hardening)
55+
sudo ./kernel-hardening/scripts/setup-kernel-hardening.sh
56+
57+
# 3. USB Defense (3-layer protection against USB attacks)
58+
sudo ./usb-defense/scripts/deploy-usb-defense.sh
59+
60+
# 4. SSH Hardening (key-only auth, modern crypto)
61+
sudo cp ssh-hardening/sshd_config.template /etc/ssh/sshd_config
62+
./ssh-hardening/scripts/validate-sshd-config.sh
63+
sudo systemctl restart sshd
64+
65+
# 4. UFW Firewall (simple servers)
66+
sudo apt install ufw
67+
sudo ufw default deny incoming
68+
sudo ufw default allow outgoing
69+
sudo ufw limit 22/tcp
70+
sudo ufw enable
71+
72+
# 6. nftables Firewall (gateways, advanced setups)
73+
sudo cp nftables/drop-ins/20-server.nft.template /etc/nftables.conf
74+
sudo nftables/scripts/validate-nftables.sh /etc/nftables.conf
75+
sudo nftables/scripts/deploy-nftables.sh /etc/nftables.conf
76+
77+
# 7. AIDE (intrusion detection)
78+
sudo apt install aide aide-common
79+
sudo cp aide/aide.conf.template /etc/aide/aide.conf
80+
sudo cp aide/drop-ins/*.conf /etc/aide/aide.conf.d/
81+
sudo aideinit
82+
83+
# 8. rkhunter (rootkit detection)
84+
sudo apt install rkhunter
85+
sudo rkhunter --propupd
86+
```
87+
88+
**Full guides**: See each component's `README.md` and `docs/SETUP.md`.
89+
90+
## Component Overview
91+
92+
### Security Layers
93+
94+
| Layer | Component | Purpose |
95+
|-------|-----------|---------|
96+
| **Boot** | boot-security | Prevent unauthorized boot modifications |
97+
| **Kernel** | kernel-hardening | Harden kernel parameters, /tmp isolation |
98+
| **Hardware** | usb-defense | Block USB-based attacks (3-layer defense) |
99+
| **Network** | ssh-hardening | Secure remote access |
100+
| **Firewall** | ufw / nftables | Control network traffic |
101+
| **Detection** | aide, rkhunter, fail2ban | Detect intrusions and rootkits |
102+
| **Logging** | auditd | Kernel-level event logging |
103+
| **Access Control** | apparmor | Mandatory Access Control |
104+
| **Credentials** | vaultwarden | Eliminate plaintext secrets |
105+
| **Monitoring** | security-monitoring | Unified security event monitoring |
106+
| **Audit** | lynis | Comprehensive security auditing |
107+
108+
### Firewall Selection Guide
109+
110+
| Use Case | Component | Why |
111+
|----------|-----------|-----|
112+
| Simple server (web, database, NAS) | **UFW** | Easy syntax, CIS-compliant |
113+
| Gateway / Router | **nftables** | NAT, routing, Multi-WAN |
114+
| WireGuard VPN server | **nftables** | Native VPN integration |
115+
| Docker host (simple) | **UFW** | With Docker-aware patterns |
116+
| Docker host (advanced) | **nftables** | Chain preservation, custom rules |
117+
118+
### Detection & Monitoring Components
119+
120+
| Component | Method | Best For |
121+
|-----------|--------|----------|
122+
| **AIDE** | Integrity-based | Detecting file changes |
123+
| **rkhunter** | Signature-based | Detecting known rootkits |
124+
| **auditd** | Event-based | Real-time "who did what when" |
125+
| **fail2ban** | Pattern-based | Blocking brute-force attacks |
126+
| **security-monitoring** | Aggregation-based | Unified event monitoring with smart deduplication |
127+
| **Lynis** | Audit-based | Comprehensive security posture assessment |
128+
129+
**Recommendation**: Use all six for defense-in-depth.
130+
131+
## Key Concepts
132+
133+
### Drop-in Configuration Pattern
134+
135+
All components use modular drop-in configurations instead of monolithic files:
136+
137+
```
138+
# AIDE drop-ins
139+
/etc/aide/aide.conf.d/
140+
├── 10-docker-excludes.conf
141+
├── 20-postgresql-excludes.conf
142+
└── 99-custom.conf
143+
144+
# nftables drop-ins
145+
nftables/drop-ins/
146+
├── 10-gateway.nft.template
147+
├── 20-server.nft.template
148+
└── 40-docker.nft.template
149+
150+
# UFW drop-ins
151+
ufw/drop-ins/
152+
├── 10-webserver.rules
153+
├── 20-database.rules
154+
└── 30-monitoring.rules
155+
```
156+
157+
**Benefits**: Easier maintenance, service-specific configs, no merge conflicts.
158+
159+
### CIS Benchmark Alignment
160+
161+
| Component | CIS Controls |
162+
|-----------|--------------|
163+
| boot-security | 1.4.x (Boot settings) |
164+
| kernel-hardening | 1.5.x, 3.2.x (Kernel params) |
165+
| usb-defense | Physical security (not in CIS, but defense-in-depth) |
166+
| ssh-hardening | 5.2.x (SSH configuration) |
167+
| ufw | 3.5.1.x (UFW firewall) |
168+
| nftables | 3.5.3.x (nftables firewall) |
169+
| aide | 1.3.x (File integrity) |
170+
| auditd | 4.1.x (System accounting) |
171+
| apparmor | 1.6.x (MAC) |
172+
| lynis | Various (audit all controls) |
173+
174+
## Requirements
175+
176+
**Minimum**:
177+
- Ubuntu 22.04 LTS or 24.04 LTS (or compatible distro)
178+
- systemd (for timer automation)
179+
- Root/sudo access
180+
181+
**Component-specific**:
182+
- nftables 1.0+ (for advanced firewall features)
183+
- AIDE v0.18.6+ (for modern hash algorithms)
184+
- UFW (included in Ubuntu/Debian by default)
185+
186+
**Optional**:
187+
- Prometheus + node_exporter (for metrics)
188+
- Vaultwarden/Bitwarden server (for credential management)
189+
190+
## Compatibility
191+
192+
**Fully supported**:
193+
- Ubuntu 22.04 LTS, 24.04 LTS
194+
- Debian 11 (Bullseye), 12 (Bookworm)
195+
- Raspberry Pi OS (Debian-based)
196+
197+
**Partial support** (no AppArmor/UFW components):
198+
- RHEL / Fedora / Rocky Linux (use SELinux + firewalld instead)
199+
- Other systemd-based distros (boot-security, kernel-hardening, ssh-hardening, nftables, aide, rkhunter work)
200+
201+
## Use Cases
202+
203+
- ✅ **Enterprise Infrastructure** - Servers, container hosts, network gateways
204+
- ✅ **Production Servers** - CIS Benchmark compliance with 40+ controls
205+
- ✅ **Container Hosts** - Docker-compatible hardening (kernel, firewall, AIDE)
206+
- ✅ **Network Gateways** - nftables with NAT, WireGuard VPN, Multi-WAN
207+
- ✅ **Compliance** - Generate audit trails and change reports
208+
209+
## Documentation
210+
211+
Each component has its own documentation:
212+
213+
| Component | Key Docs |
214+
|-----------|----------|
215+
| boot-security | [GRUB_PASSWORD.md](boot-security/docs/GRUB_PASSWORD.md), [UEFI_PASSWORD.md](boot-security/docs/UEFI_PASSWORD.md) |
216+
| usb-defense | [THREE_LAYER_DEFENSE.md](usb-defense/docs/THREE_LAYER_DEFENSE.md), [SETUP.md](usb-defense/docs/SETUP.md) |
217+
| ssh-hardening | [CIS_CONTROLS.md](ssh-hardening/docs/CIS_CONTROLS.md), [SETUP.md](ssh-hardening/docs/SETUP.md) |
218+
| ufw | [SETUP.md](ufw/docs/SETUP.md), [DOCKER_NETWORKING.md](ufw/docs/DOCKER_NETWORKING.md) |
219+
| nftables | [SETUP.md](nftables/docs/SETUP.md), [WIREGUARD_INTEGRATION.md](nftables/docs/WIREGUARD_INTEGRATION.md) |
220+
| aide | [FALSE_POSITIVE_REDUCTION.md](aide/docs/FALSE_POSITIVE_REDUCTION.md) |
221+
| rkhunter | [FALSE_POSITIVES.md](rkhunter/docs/FALSE_POSITIVES.md) |
222+
| auditd | [CIS_CONTROLS.md](auditd/docs/CIS_CONTROLS.md), [SETUP.md](auditd/docs/SETUP.md) |
223+
| lynis | [HARDENING_GUIDE.md](lynis/docs/HARDENING_GUIDE.md), [SETUP.md](lynis/docs/SETUP.md) |
224+
225+
**Repository-level docs**:
226+
227+
| Document | Description |
228+
|----------|-------------|
229+
| [docs/SETUP.md](docs/SETUP.md) | General installation guide |
230+
| [docs/BEST_PRACTICES.md](docs/BEST_PRACTICES.md) | Production lessons |
231+
| [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) | Common issues |
232+
| [docs/PROMETHEUS_INTEGRATION.md](docs/PROMETHEUS_INTEGRATION.md) | Metrics setup |
233+
234+
## See Also
235+
236+
- [ubuntu-server-security-ansible](https://github.com/fidpa/ubuntu-server-security-ansible) - Ansible automation
237+
- [monitoring-templates](https://github.com/fidpa/monitoring-templates) - Bash/Python monitoring templates
238+
- [bash-production-toolkit](https://github.com/fidpa/bash-production-toolkit) - Production-ready Bash libraries
239+
240+
## License
241+
242+
MIT License - see [LICENSE](LICENSE) for details.
243+
244+
## Author
245+
246+
Marc Allgeier ([@fidpa](https://github.com/fidpa))
247+
248+
**Why I Built This**: After spending weeks hardening production servers to 100% CIS Benchmark compliance, I wished I could find everything in one place. This repo consolidates 14 production-tested security components so you don't have to piece together scattered documentation.
249+
250+
## Contributing
251+
252+
Contributions welcome! Please open an issue or pull request.
253+
254+
**Areas where help is appreciated**:
255+
- Additional drop-in configs for services (MySQL, Redis, Nginx, etc.)
256+
- Firewall templates for specific use cases
257+
- Grafana dashboard examples
258+
- Testing on other Ubuntu/Debian versions

0 commit comments

Comments
 (0)