os-hardening

This cookbook provides numerous security-related configurations, providing all-around base protection.

It configures:

It will not:

['os-hardening']['components'][COMPONENT_NAME] – allows the fine control over which components should be executed via default recipe. See below for more details
['os-hardening']['desktop']['enable'] = false true if this is a desktop system, ie Xorg, KDE/GNOME/Unity/etc
['os-hardening']['network']['forwarding'] = false true if this system requires packet forwarding (eg Router), false otherwise
['os-hardening']['network']['ipv6']['enable'] = false
['os-hardening']['network']['arp']['restricted'] = true true if you want the behavior of announcing and replying to ARP to be restricted, false otherwise
['os-hardening']['env']['extra_user_paths'] = [] add additional paths to the user’s PATH variable (default is empty).
['os-hardening']['env']['umask'] = "027"
['os-hardening']['env']['root_path'] = "/" where root is mounted
['os-hardening']['auth']['pw_max_age'] = 60 maximum password age
['os-hardening']['auth']['pw_min_age'] = 7 minimum password age (before allowing any other password change)
['os-hardening']['auth']['pw_warn_age'] = 7 number of days before maximum password age occurs to warn of impending change
More…

Tags: os-hardening