Skip to content

Commit 89d9e6b

Browse files
fidpafidpa
committed
v1.1.0
1 parent eb1cffe commit 89d9e6b

29 files changed

+850
-2
lines changed

‎CHANGELOG.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [Unreleased]
9+
10+
### Added
11+
- CONTRIBUTING.md with development guidelines
12+
- CODE_OF_CONDUCT.md (Contributor Covenant v2.1)
13+
- SECURITY.md with vulnerability reporting process
14+
- This CHANGELOG.md
15+
16+
## [1.0.0] - 2026-01-20
17+
18+
### Added
19+
20+
#### Core Components
21+
- **fail2ban/**: Intrusion prevention with 15+ jail configurations
22+
- **ssh-hardening/**: SSH hardening with secure sshd_config templates
23+
- **nftables/**: Modern firewall with modular rule sets
24+
- **ufw/**: Simplified firewall alternative
25+
- **aide/**: File integrity monitoring with systemd integration
26+
- **lynis/**: Security auditing with automation scripts
27+
- **rkhunter/**: Rootkit detection and prevention
28+
- **auditd/**: Kernel-level audit logging
29+
- **apparmor/**: Mandatory access control profiles
30+
31+
#### Advanced Security
32+
- **kernel-hardening/**: sysctl security configurations
33+
- **boot-security/**: GRUB password protection
34+
- **usb-defense/**: USB device access control
35+
- **vaultwarden/**: Credential management integration
36+
- **security-monitoring/**: Prometheus exporters and Grafana dashboards
37+
38+
#### Documentation
39+
- Comprehensive README with Quick Start guide
40+
- CIS Benchmark alignment documentation
41+
- Troubleshooting guide
42+
- Best practices documentation
43+
- Prometheus/Grafana integration guide
44+
45+
### Security
46+
- All configurations aligned with CIS Ubuntu Benchmark
47+
- Defense-in-depth approach with 14 security layers
48+
- Secure defaults for all components
49+
50+
---
51+
52+
## Version History
53+
54+
| Version | Date | Highlights |
55+
|---------|------|------------|
56+
| 1.0.0 | 2026-01-20 | Initial release with 14 security components |
57+
58+
[Unreleased]: https://github.com/fidpa/ubuntu-server-security/compare/v1.0.0...HEAD
59+
[1.0.0]: https://github.com/fidpa/ubuntu-server-security/releases/tag/v1.0.0

‎CODE_OF_CONDUCT.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, caste, color, religion, or sexual
10+
identity and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behavior that contributes to a positive environment:
18+
19+
* Demonstrating empathy and kindness toward other people
20+
* Being respectful of differing opinions, viewpoints, and experiences
21+
* Giving and gracefully accepting constructive feedback
22+
* Accepting responsibility and apologizing to those affected by our mistakes
23+
* Focusing on what is best not just for us as individuals, but for the community
24+
25+
Examples of unacceptable behavior:
26+
27+
* The use of sexualized language or imagery, and sexual attention of any kind
28+
* Trolling, insulting or derogatory comments, and personal or political attacks
29+
* Public or private harassment
30+
* Publishing others' private information without explicit permission
31+
* Other conduct which could reasonably be considered inappropriate
32+
33+
## Enforcement Responsibilities
34+
35+
Community leaders are responsible for clarifying and enforcing our standards
36+
of acceptable behavior and will take appropriate and fair corrective action
37+
in response to any behavior that they deem inappropriate, threatening,
38+
offensive, or harmful.
39+
40+
## Scope
41+
42+
This Code of Conduct applies within all community spaces, and also applies
43+
when an individual is officially representing the community in public spaces.
44+
45+
## Enforcement
46+
47+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
48+
reported to the community leaders responsible for enforcement at
49+
**security@fidpa.dev** or via GitHub Issues.
50+
51+
All complaints will be reviewed and investigated promptly and fairly.
52+
53+
## Attribution
54+
55+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
56+
version 2.1, available at
57+
[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
58+
59+
[homepage]: https://www.contributor-covenant.org
60+
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html

‎CONTRIBUTING.md‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# Contributing to Ubuntu Server Security
2+
3+
First off, thank you for considering contributing to Ubuntu Server Security!
4+
5+
## Table of Contents
6+
7+
- [Code of Conduct](#code-of-conduct)
8+
- [Getting Started](#getting-started)
9+
- [How to Contribute](#how-to-contribute)
10+
- [Development Setup](#development-setup)
11+
- [Style Guidelines](#style-guidelines)
12+
- [Commit Messages](#commit-messages)
13+
- [Pull Request Process](#pull-request-process)
14+
15+
## Code of Conduct
16+
17+
This project adheres to the [Contributor Covenant Code of Conduct](CODE_OF_CONDUCT.md).
18+
By participating, you are expected to uphold this code.
19+
20+
## Getting Started
21+
22+
- Make sure you have a [GitHub account](https://github.com/signup)
23+
- Check existing [issues](https://github.com/fidpa/ubuntu-server-security/issues) before creating new ones
24+
- Fork the repository on GitHub
25+
26+
## How to Contribute
27+
28+
### Reporting Bugs
29+
30+
Before creating bug reports, please check existing issues.
31+
32+
**Great bug reports include:**
33+
- A clear, descriptive title
34+
- Steps to reproduce the issue
35+
- Expected vs actual behavior
36+
- System information (Ubuntu version, shell version)
37+
- Relevant logs or error messages
38+
39+
### Suggesting Features
40+
41+
Feature suggestions are welcome! Please:
42+
- Check if the feature was already requested
43+
- Describe the use case clearly
44+
- Explain why this would benefit users
45+
46+
### Security Vulnerabilities
47+
48+
**DO NOT** open public issues for security vulnerabilities.
49+
50+
See [SECURITY.md](SECURITY.md) for responsible disclosure.
51+
52+
### Pull Requests
53+
54+
1. Fork the repo and create your branch from `main`
55+
2. Make your changes
56+
3. Test on Ubuntu 22.04 or 24.04
57+
4. Ensure all scripts pass `shellcheck`
58+
5. Update documentation if needed
59+
6. Submit a pull request
60+
61+
## Development Setup
62+
63+
```bash
64+
# Clone your fork
65+
git clone https://github.com/YOUR_USERNAME/ubuntu-server-security.git
66+
cd ubuntu-server-security
67+
68+
# Verify shellcheck is installed
69+
shellcheck --version
70+
71+
# Run shellcheck on all scripts
72+
find . -name "*.sh" -exec shellcheck {} \;
73+
```
74+
75+
### Testing Environment
76+
77+
Recommended: Use a VM or container for testing security configurations.
78+
79+
```bash
80+
# Example with LXD
81+
lxc launch ubuntu:22.04 security-test
82+
lxc exec security-test -- bash
83+
```
84+
85+
## Style Guidelines
86+
87+
### Bash Scripts
88+
89+
- Use `shellcheck` for linting
90+
- Follow `set -uo pipefail` pattern
91+
- Use lowercase for variables, UPPERCASE for constants
92+
- Quote variables: `"$var"` not `$var`
93+
- Add comments for complex logic
94+
95+
### Configuration Files
96+
97+
- Include comments explaining each setting
98+
- Provide safe defaults
99+
- Document security implications
100+
101+
### Documentation
102+
103+
- Use Markdown
104+
- Include code examples
105+
- Keep lines under 100 characters
106+
- Add TL;DR for long documents
107+
108+
## Commit Messages
109+
110+
Follow conventional format:
111+
```
112+
type: short description
113+
114+
Longer explanation if needed.
115+
116+
Fixes #123
117+
```
118+
119+
Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`
120+
121+
**Examples:**
122+
- `feat: add fail2ban jail for postfix`
123+
- `fix: correct sshd_config permissions`
124+
- `docs: update nftables examples`
125+
126+
## Pull Request Process
127+
128+
1. Update README.md if needed
129+
2. Update CHANGELOG.md with your changes
130+
3. PRs require one maintainer approval
131+
4. Squash commits before merging
132+
133+
### PR Checklist
134+
135+
- [ ] Code follows style guidelines
136+
- [ ] Shellcheck passes without errors
137+
- [ ] Tested on Ubuntu 22.04 or 24.04
138+
- [ ] Documentation updated
139+
- [ ] CHANGELOG.md updated
140+
141+
## Questions?
142+
143+
- Open a [Discussion](https://github.com/fidpa/ubuntu-server-security/discussions)
144+
- Check existing documentation
145+
146+
---
147+
148+
Thank you for contributing to Ubuntu Server Security!

‎SECURITY.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
| ------- | ------------------ |
7+
| 1.x.x | :white_check_mark: |
8+
| < 1.0 | :x: |
9+
10+
## Reporting a Vulnerability
11+
12+
We take security vulnerabilities seriously. If you discover a security issue,
13+
please report it responsibly.
14+
15+
### DO NOT
16+
17+
- Open a public GitHub issue for security vulnerabilities
18+
- Disclose the vulnerability publicly before it's fixed
19+
- Exploit the vulnerability beyond what's necessary to demonstrate it
20+
21+
### How to Report
22+
23+
1. **Email**: Send details to **security@fidpa.dev**
24+
2. **GitHub**: Use [Private Vulnerability Reporting](https://github.com/fidpa/ubuntu-server-security/security/advisories/new)
25+
26+
### What to Include
27+
28+
- Description of the vulnerability
29+
- Steps to reproduce
30+
- Potential impact
31+
- Suggested fix (if any)
32+
33+
### What to Expect
34+
35+
- **Acknowledgment**: Within 48 hours
36+
- **Initial Assessment**: Within 7 days
37+
- **Resolution Timeline**: Depends on severity
38+
- Critical: 24-72 hours
39+
- High: 1-2 weeks
40+
- Medium: 2-4 weeks
41+
- Low: Next release
42+
43+
### After Resolution
44+
45+
- You will be credited in the release notes (unless you prefer anonymity)
46+
- A security advisory will be published
47+
- Fixed versions will be clearly documented
48+
49+
## Security Best Practices
50+
51+
When using this repository:
52+
53+
1. **Always test in a non-production environment first**
54+
2. **Review all configurations before applying**
55+
3. **Keep your system updated**
56+
4. **Monitor logs after applying security configurations**
57+
5. **Have a rollback plan**
58+
59+
## Scope
60+
61+
This security policy covers:
62+
63+
- All configuration files in this repository
64+
- All scripts and automation tools
65+
- Documentation that could lead to misconfigurations
66+
67+
## Out of Scope
68+
69+
- Vulnerabilities in Ubuntu itself (report to [Ubuntu Security](https://ubuntu.com/security))
70+
- Third-party tools (fail2ban, nftables, etc.) - report to respective projects
71+
- Issues caused by user modifications
72+
73+
---
74+
75+
Thank you for helping keep Ubuntu Server Security safe!

‎aide/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,10 @@ sudo aideinit
5454
- ✅ **Database Servers** - Track PostgreSQL configuration changes
5555
- ✅ **Compliance** - Generate file integrity audit reports
5656
- ✅ **Defense-in-Depth** - Complement rkhunter and auditd monitoring
57+
58+
## See Also
59+
60+
- [← Back to Repository Root](../README.md)
61+
- [rkhunter](../rkhunter/) - Rootkit detection (complementary tool)
62+
- [auditd](../auditd/) - Kernel-level audit logging
63+
- [security-monitoring](../security-monitoring/) - Unified security event monitoring

‎apparmor/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,10 @@ sudo aa-enforce /etc/apparmor.d/usr.lib.postgresql.16.bin.postgres
6262
- [Ubuntu AppArmor Wiki](https://wiki.ubuntu.com/AppArmor)
6363
- [CIS Ubuntu Linux Benchmark](https://www.cisecurity.org/benchmark/ubuntu_linux)
6464
- [PostgreSQL AppArmor Wiki](https://wiki.postgresql.org/wiki/AppArmor)
65+
66+
## See Also
67+
68+
- [← Back to Repository Root](../README.md)
69+
- [kernel-hardening](../kernel-hardening/) - Kernel security parameters
70+
- [auditd](../auditd/) - Audit AppArmor denials
71+
- [lynis](../lynis/) - Validates AppArmor configuration

‎auditd/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,10 @@ sudo systemctl restart auditd
6363
- [Linux Audit Documentation](https://github.com/linux-audit/audit-documentation)
6464
- [CIS Ubuntu Linux Benchmark](https://www.cisecurity.org/benchmark/ubuntu_linux)
6565
- [Red Hat auditd Guide](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing)
66+
67+
## See Also
68+
69+
- [← Back to Repository Root](../README.md)
70+
- [aide](../aide/) - File integrity monitoring
71+
- [rkhunter](../rkhunter/) - Rootkit detection
72+
- [lynis](../lynis/) - Security auditing and compliance

‎boot-security/README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,10 @@ sudo ./scripts/setup-grub-password.sh
6060
- [GRUB Manual - Security](https://www.gnu.org/software/grub/manual/grub/html_node/Security.html)
6161
- [CIS Ubuntu Linux Benchmark](https://www.cisecurity.org/benchmark/ubuntu_linux)
6262
- [Ubuntu GRUB2 Documentation](https://help.ubuntu.com/community/Grub2)
63+
64+
## See Also
65+
66+
- [← Back to Repository Root](../README.md)
67+
- [usb-defense](../usb-defense/) - USB attack prevention
68+
- [kernel-hardening](../kernel-hardening/) - Kernel security parameters
69+
- [vaultwarden](../vaultwarden/) - Secure GRUB password storage

‎docs/BEST_PRACTICES.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# AIDE Best Practices
22

3+
> **TL;DR**: Never auto-update AIDE database (review changes first), keep offsite backups, test updates in staging, and use `_aide` group for non-root monitoring access.
4+
35
Production recommendations based on servers with 100% CIS Benchmark compliance.
46

57
## Database Management

0 commit comments

Comments
 (0)