Deploy GRUB hardening #137

timstoop · 2018-06-26T08:45:14Z

This patch adds the option to harden GRUB. For this to work, it requires a password created with grub-mkpasswd-pbkdf2 provided to it. Optionally, but enabled by default, this also modifies the Grub config to allow for unattended booting of these servers.

This was created to fulfil CIS DIL Benchmark 1.4.1 and 1.4.2. It was only tested on Debian Stretch, so I'd welcome someone to test on something else as well and let me know what I need to change to make it work on other OSes as well. Also, I'm not sure if I should wrap the exec that enables unattended booting in a case statement to select the operating system.

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Now only a password is required when someone wants to change the boot parameters. Normal boot is allowed without password. HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

artem-sidorenko · 2018-06-28T05:54:31Z

@timstoop great! Thanks!

I have a similar implementation in chef:) I'll review the grub part in the next days

mcgege · 2018-07-09T07:34:38Z

manifests/grub.pp

+
+  if $boot_without_password {
+    # This sets up Grub on Debian Stretch so you can still boot the system without a password
+    exec { 'Keep system bootable without credentials':


You should better use file_line to make changes / substitutions in files

I don't think it's possible to do back references with file_line? As I want to leave all other options there without touching them. The docs do not seem to discuss back references either.

mcgege · 2018-07-09T07:37:33Z

manifests/grub.pp

+    notify  => Exec['Grub configuration recreate for os_hardening::grub'],
+  }
+
+  if $boot_without_password {


What if you switch from boot_without_password = true to boot_without_password = false? --> undo the change in the file

mcgege · 2018-07-09T07:39:37Z

manifests/grub.pp

+    refreshonly => true,
+  }
+
+  file { '/boot/grub/grub.cfg':


On CentOS / RedHat + OpenSUSE / SLES this file is located here: /boot/grub2/grub.cfg

What's the value for $::operatingsystem on OpenSUSE/SLES? So I can fix the case statement correctly :)

That is the value for $::operatingsystem - OpenSUSE for the free distro, SLES for the commercial one
You could also refer to $::osfamily, here we have Suse for both

Or I default to /boot/grub2/grub.cfg and make debian/ubuntu the exception...

mcgege · 2018-07-09T07:44:33Z

manifests/grub.pp

+  }
+
+  exec { 'Grub configuration recreate for os_hardening::grub':
+    command     => '/usr/sbin/update-grub',


As there is no such helper script in CentOS / RedHat or OpenSUSE / SLES you should better use this:
grub-mkconfig -o /boot/grub/grub.cfg (Ubuntu / Debian) or grub2-mkconfig -o /boot/grub2/grub.cfg

Can I assume that grub2-mkconfig is in /usr/sbin or is it somewhere else?

mcgege · 2018-07-09T07:46:19Z

manifests/init.pp

@@ -180,4 +185,12 @@
    }
  }

+  if $enable_grub_hardening {


On switching back enable_grub_hardening -> cleanup changes on grub

Done, but I'd slightly worried that this may actually cause problem for people who make these kind of changes with other modules? There's no way to check if the change was done by this module or by something else.

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

artem-sidorenko

@timstoop grub things look good to me, even the sed expression is the same like I got :)

@mcgege I did not deeply check the puppet part, however it looks good to me on the first view

artem-sidorenko · 2018-07-31T07:23:18Z

manifests/grub.pp

+
+  case $::operatingsystem {
+    debian, ubuntu: {
+      $grub_cfg = '/boot/grub/grub.cfg'


is it a better way to call update-grub on ubuntu/debian?

I wouldn't bother:

~$ cat /usr/sbin/update-grub #!/bin/sh set -e exec grub-mkconfig -o /boot/grub/grub.cfg "$@"

This is more consistent, imho.

:D I did not check the file itself, but I saw it in all possible man pages :)
Fine for me as is now

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

mcgege · 2018-08-03T10:05:12Z

README.md

+  set to true to enable some grub hardening rules
+* `grub_user = 'root'`
+  the grub username that needs to be provided when changing config on the grub prompt
+* `grub_password_hash = false`


The default value for grub_password_hash must be set to '' (String, not Boolean), otherwise I get an error here ...

I honestly hadn't tested it with the default settings... 😊 Fixing!

mcgege · 2018-08-03T10:05:38Z

manifests/grub.pp

+class os_hardening::grub (
+  Boolean $enable                = false,
+  String  $user                  = 'root',
+  String  $password_hash         = false,


default to ''

mcgege · 2018-08-03T10:06:08Z

manifests/init.pp

+
+  Boolean           $enable_grub_hardening    = false,
+  String            $grub_user                = 'root',
+  String            $grub_password_hash       = false,


default to ''

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

mcgege · 2018-08-11T11:12:43Z

@timstoop Ok, the code compiles now, but ... I have configured it for one of my test systems (Ubuntu 16.04) like this:

class { 'os_hardening':
    allow_change_user     => true,
    enable_grub_hardening => true,
    boot_without_password => false,
    grub_user             => 'root',
    grub_password_hash    => 'grub.pbkdf2.sha512.10000.FD97C47AEE086E73BD6B80ECC7879CA7812AF0E5538DC7242DBA2A7BE329507449C7339E16E68C0DD204BD0BC84000E3EE363FC58D1B7F3F882C60C3B0770446.D863FCAE6EF7BDB40C2D3D0777B17EDF7ABD1B31995124D29E584AA243DEEFC8F26BC4FF1AC78E902ED0483B4B2F7C2CA88D8919E6A2A401A6870D3D65735BF1',
    ignore_users          => ['mutuv'],
    passwdqc_enabled      => false,
    password_max_age      => 99999,
    password_min_age      => 0,
    pe_environment        => true,
    usergroups            => false,
  }

... and after a puppet run the grub.cfg is just the same as before (and of course on reboot there is no password prompt). If I change boot_without_password to true, the menuentry get the --unrestricted flag, but still no password prompt.

Am I missing something?

timstoop · 2018-08-14T10:09:43Z

Can you check if the file /etc/grub.d/01_hardening is created? And if running update-grub solves the issue? That would give me some clues as to what is going wrong. Maybe the grub scripts work a bit different on Ubuntu, I sort of assumed that it would be the same as Debian.

mcgege · 2018-08-15T06:33:32Z

If have tested this now also on CentOS 7.5 and OpenSUSE 15.0, it's the same ... the file /etc/grub.d/01_hardening is correctly created and the new grub.cfg is written (via update-grub), but there's no password prompt.
What should differ in grub.cfg if this feature is active?

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

timstoop · 2018-08-15T09:22:06Z

I have too many branches locally :(
Please try again with this very small change...
The output of that script should be added to the grub.cfg.

mcgege · 2018-08-15T10:37:57Z

Hah! That did it ... thanks!

timstoop added 7 commits June 24, 2018 16:19

Harden the grub prompt.

a30934a

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Add code to allow the system to boot without password.

756230c

Now only a password is required when someone wants to change the boot parameters. Normal boot is allowed without password. HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Add docs and ability to set the variable.

1788c4e

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Merge branch 'upstream' into cis-dil-bechmark-1

de7a10d

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Fix the unless condition.

58b512b

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Fix template (was using a different branch to test...).

db41696

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

More fixes to template.

1661c68

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

artem-sidorenko self-assigned this Jun 28, 2018

mcgege requested changes Jul 9, 2018

View reviewed changes

Work on the comments that were given.

0fde60f

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

artem-sidorenko approved these changes Jul 31, 2018

View reviewed changes

artem-sidorenko mentioned this pull request Jul 31, 2018

Grub hardening and password protection dev-sec/chef-os-hardening#224

Open

artem-sidorenko removed their assignment Jul 31, 2018

Make everything not-Debian the default.

b8dcd68

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

mcgege requested changes Aug 3, 2018

View reviewed changes

timstoop added 2 commits August 8, 2018 13:26

Fix default case.

d671674

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Merge branch 'upstream' into cis-dil-bechmark-1

467f1fd

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

Set mode of the new snippet.

2de45fb

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <[email protected]> (github: timstoop)

mcgege merged commit f1bb999 into dev-sec:master Aug 15, 2018

mcgege added the enhancement label Aug 15, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deploy GRUB hardening #137

Deploy GRUB hardening #137

timstoop commented Jun 26, 2018

artem-sidorenko commented Jun 28, 2018

mcgege Jul 9, 2018

timstoop Jul 30, 2018

mcgege Jul 9, 2018

mcgege Jul 9, 2018

timstoop Jul 30, 2018

mcgege Aug 1, 2018

timstoop Aug 1, 2018

mcgege Jul 9, 2018

timstoop Jul 30, 2018

mcgege Aug 1, 2018

mcgege Jul 9, 2018

timstoop Jul 30, 2018

artem-sidorenko left a comment

artem-sidorenko Jul 31, 2018

timstoop Jul 31, 2018

artem-sidorenko Jul 31, 2018

mcgege Aug 3, 2018

timstoop Aug 8, 2018

mcgege Aug 3, 2018

mcgege Aug 3, 2018

mcgege commented Aug 11, 2018

timstoop commented Aug 14, 2018

mcgege commented Aug 15, 2018

timstoop commented Aug 15, 2018

mcgege commented Aug 15, 2018

Deploy GRUB hardening #137

Deploy GRUB hardening #137

Conversation

timstoop commented Jun 26, 2018

artem-sidorenko commented Jun 28, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

artem-sidorenko left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mcgege commented Aug 11, 2018

timstoop commented Aug 14, 2018

mcgege commented Aug 15, 2018

timstoop commented Aug 15, 2018

mcgege commented Aug 15, 2018