Notes

letws try these one chunk at the time


etc fstab
LABEL=/boot /boot ext4 defaults,ro 1 2

u can try if this breaks or not
NOT THIS this breaks






also do
chown root:root /etc/fstab


#chown root:root /etc/default/grub
#chmod og-rwx /etc/default/grub


/etc/ssh and open the “sshd_config”



Change the default port number 22 to something else e.g. 99.
Make sure that root cannot login remotely through SSH:
PermitRootLogin no
Allow some specific users:
AllowUsers [username]



“sshd_config” file:

Protocol2
IgnoreRhosts to yes
HostbasedAuthentication no
PermitEmptyPasswords no
X11Forwarding no
MaxAuthTries 5
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
ClientAliveInterval 900
ClientAliveCountMax 0
UsePAM yes



#chown root:root /etc/ssh/sshd_config
#chmod 600 /etc/ssh/sshd_config



“/etc/pam.d/su”:

auth required pam_wheel.so use_uid




try this script

#!/bin/bash
for user in `awk -F: '($3 < 500) {print $1 }' /etc/passwd`; do
if [ $user != "root" ]
then
/usr/sbin/usermod -L $user
if [ $user != "sync" ] && [ $user != "shutdown" ] && [ $user != "halt" ]
then /usr/sbin/usermod -s /sbin/nologin $user
fi
fi
done




these also






howeve rmaybe not the password ones



Adding hard core 0 to the “/etc/security/limits.conf” file

Adding fs.suid_dumpable = 0 to the “/etc/sysctl.conf” file

kernel.exec-shield = 1 only this one isnt i ignored it fo now


kernel.randomize_va_space = 2
checking sysctl these options are already there

that shield command is old
grep -Fw nx /proc/cpuinfo
i noticed the RED NX flag there
so its possible to do it


]#
[lablucy-control sysctl.d]# dmesg | grep -Fw NX
[ 0.905719] PPR NX GT IA GA PC GA_vAPIC

its against bufferoverlfow

thats the kernel ring but it should say active

u shoul dse eit here
# dmesg | grep NX.*protection

the flag agian # grep nx /proc/cpuinfo

"noexec=off" does not appear in /boot/grub/grub.conf shouldnt be there in grub

dmesg |grep NX

try this
For GRUB this can be accomplished by adding "noexec=on" to the GRUB_CMDLINE_LINUX_DEFAULT variable in /etc/default/grub

update-grub
reboot and try again








file one


#!/bin/bash
for user in `awk -F: '($3 < 500) {print $1 }' /etc/passwd`; do
if [ $user != "root" ]
then
/usr/sbin/usermod -L $user
if [ $user != "sync" ] && [ $user != "shutdown" ] && [ $user != "halt" ]
then /usr/sbin/usermod -s /sbin/nologin $user
fi
fi
done



file two




echo securing
read -p "enter to go on"
chown root:root /etc/anacrontab
chmod og-rwx /etc/anacrontab
chown root:root /usr/bin/crontab
chmod og-rwx /usr/bin/crontab
chown root:root /etc/cron.hourly
chmod og-rwx /etc/cron.hourly
chown root:root /etc/cron.daily
chmod og-rwx /etc/cron.daily
chown root:root /etc/cron.weekly
chmod og-rwx /etc/cron.weekly
chown root:root /etc/cron.monthly
chmod og-rwx /etc/cron.monthly
chown root:root /etc/cron.d
chmod og-rwx /etc/cron.d

echo calculating....checking crontab............
chown root:root /usr/bin/crontab
chmod og-rwx /usr/bin/crontab


chmod 644 /etc/group
chown root:root /etc/group
echo secured group
echo securing shadow
chmod 600 /etc/shadow
chown root:root /etc/shadow


chmod 600 /etc/gshadow
chown root:root /etc/gshadow


echo done........