Security Hardening

Security Hardening

Purpose

Proactive reduction of attack surface across infrastructure layers through systematic configuration hardening, least-privilege enforcement, and automated security controls. Applies industry-standard CIS Benchmarks and zero-trust principles to operating systems, containers, cloud configurations, networks, and databases.

When to Use This Skill

Invoke this skill when:

• Hardening production infrastructure before deployment
• Meeting compliance requirements (SOC 2, PCI-DSS, HIPAA, FedRAMP)
• Implementing zero-trust security architecture
• Reducing container or cloud misconfiguration risks
• Preparing for security audits or penetration tests
• Automating security baseline enforcement
• Responding to vulnerability scan findings

Hardening Layers

Security hardening applies across five infrastructure layers:

Layer 1: Operating System (Linux)

• Kernel parameter tuning (sysctl)
• SSH configuration hardening
• User and group management
• File system permissions and mount options
• Service minimization
• SELinux/AppArmor enforcement

Layer 2: Container

• Minimal base images (Chainguard, Distroless, Alpine)
• Non-root container execution
• Read-only root filesystems
• Seccomp and AppArmor profiles
• Resource limits and capabilities dropping
• Pod Security Standards enforcement

Layer 3: Cloud Configuration

• IAM least privilege and MFA enforcement
• Network security groups and NACL configuration
• Encryption at rest and in transit
• Public access blocking
• Logging and monitoring enablement
• CSPM (Cloud Security Posture Management) integration

Layer 4: Network

• Default-deny network policies
• Network segmentation and micro-segmentation
• TLS/mTLS enforcement
• Firewall rule minimization
• DNS security (DNSSEC, DNS filtering)

Layer 5: Database

• Authentication and authorization hardening
• Connection encryption (SSL/TLS)
• Audit logging enablement
• Network isolation and access control
• Role-based permissions with least privilege

Core Hardening Principles

1. Default Deny, Explicit Allow

Start with all access denied, explicitly permit only required operations. Apply default-deny firewall rules and network policies, then allow specific traffic.

2. Least Privilege Access

Grant minimum permissions required for operation. Use RBAC, IAM policies with specific resources, and database roles with limited permissions (no DELETE or DDL unless required).

3. Defense in Depth

Implement multiple overlapping security controls: network firewalls, authentication, authorization, audit logging, and encryption working together.

4. Minimal Attack Surface

Remove unnecessary components, services, and permissions. Use minimal container base images, disable unused services, and drop all Linux capabilities unless required.

5. Fail Securely

On error or misconfiguration, default to secure state. Authentication failures deny access, missing configurations use restrictive defaults, and monitoring failures trigger immediate alerts.

Hardening Priority Framework

Prioritize hardening efforts based on exposure and data sensitivity:

Critical Priority: Internet-Facing Systems

Apply immediately:

• Container hardening (minimal images, non-root, read-only)
• Network segmentation (DMZ, WAF, DDoS protection)
• TLS termination and certificate management
• Rate limiting and authentication
• Real-time monitoring and alerting

Tools: Trivy, Falco, ModSecurity, Cloudflare

High Priority: Systems with Sensitive Data

Apply before production:

• Encryption at rest (AES-256, KMS-managed keys)
• Strict access controls (RBAC, least privilege)
• Comprehensive audit logging
• Database connection encryption
• Regular vulnerability scanning

Tools: Checkov, Prowler, Lynis, OpenSCAP

Standard Priority: Internal Systems

Apply systematically:

• OS hardening (CIS Benchmarks)
• Service minimization
• Patch management automation
• Configuration management
• Basic monitoring

Tools: Ansible, Puppet, kube-bench, docker-bench-security

CIS Benchmark Integration

CIS (Center for Internet Security) Benchmarks provide industry-standard hardening guidance.

Automated CIS Scanning

Docker CIS Benchmark:

docker run --rm -it \
  --net host \
  --pid host \
  --cap-add audit_control \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /etc:/etc:ro \
  docker/docker-bench-security

Kubernetes CIS Benchmark:

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

Linux CIS Benchmark:

# Using Lynis
lynis audit system --quick

# Using OpenSCAP
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml

Key CIS Controls Mapping

For detailed CIS control mapping, see references/cis-benchmark-mapping.md.

Container Base Image Selection

Choose base images based on security requirements and compatibility needs:

Production recommendation: Chainguard Images or Distroless for production, Alpine for development.

Verification and Auditing

Hardening must be verified continuously, not just at implementation.

Automated Security Scanning

Container vulnerability scanning:

# Trivy: Comprehensive vulnerability and misconfiguration scanner
trivy image --severity HIGH,CRITICAL myapp:latest

# Grype: Fast vulnerability scanner
grype myapp:latest

Infrastructure as Code scanning:

# Checkov: Multi-cloud IaC scanner
checkov -d terraform/ --framework terraform

# Terrascan: Policy-as-code scanner
terrascan scan -t terraform -d terraform/

Kubernetes security scanning:

# Kubesec: Security risk analysis
kubesec scan k8s/deployment.yaml

# Polaris: Configuration validation
polaris audit --format=pretty

# Trivy K8s scanning
trivy k8s --report summary cluster

Cloud security posture:

# Prowler: AWS security assessment
prowler aws --services s3 iam ec2

# ScoutSuite: Multi-cloud security audit
scout aws --services s3 iam ec2

Continuous Verification Pipeline

Integrate security scanning into CI/CD:

# GitHub Actions example
name: Security Hardening Verification

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 0 * * *'  # Daily scan

jobs:
  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:test .

      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:test'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Fail on findings

  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Scan IaC with Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          soft_fail: false

Compliance Reporting

Generate compliance reports from scan results:

# Generate CIS compliance report
kube-bench run --json > cis-report.json

# Generate vulnerability report
trivy image --format json --output vuln-report.json myapp:latest

# Aggregate reports for compliance dashboard
python scripts/generate-compliance-report.py \
  --cis cis-report.json \
  --vulns vuln-report.json \
  --output compliance-dashboard.html

Automation Tools

Hardening Automation

• Ansible/Puppet/Chef: Configuration management for OS hardening
• Terraform/Pulumi: Infrastructure as Code with security modules
• Cloud Custodian: Cloud resource policy enforcement
• OPA/Gatekeeper: Kubernetes policy enforcement
• Kyverno: Kubernetes-native policy management

Scanning Tools

• Trivy: Universal vulnerability and misconfiguration scanner
• Checkov: IaC security and compliance scanner
• Falco: Runtime security monitoring
• Prowler: AWS security assessment tool
• ScoutSuite: Multi-cloud security auditing
• Lynis: Linux security auditing
• docker-bench-security: Docker CIS benchmark scanner
• kube-bench: Kubernetes CIS benchmark scanner

Monitoring Tools

• Falco: Runtime threat detection for containers
• Sysdig: Container security and monitoring
• Wazuh: Host and endpoint security monitoring
• OSSEC: Host-based intrusion detection

Quick Reference: Common Hardening Tasks

Harden SSH Access

# Edit /etc/ssh/sshd_config.d/hardening.conf
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
MaxAuthTries 3
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2

# Restart SSH
systemctl restart sshd

Harden Container Image

# Use minimal base
FROM cgr.dev/chainguard/python:latest

# Non-root user
USER nonroot

# Read-only filesystem
COPY --chown=nonroot:nonroot app /app
WORKDIR /app

# Drop all capabilities
ENTRYPOINT ["python", "-m", "app"]

Harden Kubernetes Pod

securityContext:
  runAsNonRoot: true
  runAsUser: 65534
  seccompProfile:
    type: RuntimeDefault
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

Harden AWS S3 Bucket

resource "aws_s3_bucket_public_access_block" "secure" {
  bucket = aws_s3_bucket.data.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "secure" {
  bucket = aws_s3_bucket.data.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
  }
}

Harden Network with Default Deny

# Kubernetes NetworkPolicy: deny all ingress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Harden Database Access

-- PostgreSQL hardening
REVOKE ALL ON DATABASE app FROM PUBLIC;
REVOKE ALL ON SCHEMA public FROM PUBLIC;

CREATE ROLE app_user WITH LOGIN;
GRANT CONNECT ON DATABASE app TO app_user;
GRANT SELECT, INSERT, UPDATE ON app.orders TO app_user;

-- Force SSL connections
ALTER SYSTEM SET ssl = on;
-- In pg_hba.conf: hostssl all all 0.0.0.0/0 scram-sha-256

Detailed Hardening Guides

For layer-specific hardening guidance:

• OS hardening: See references/linux-hardening.md
• Container hardening: See references/container-hardening.md
• Cloud hardening: See references/cloud-hardening.md
• Network hardening: See references/network-hardening.md
• Database hardening: See references/database-hardening.md

For automation scripts:

• Python automation: See scripts/harden-linux.py
• Container host setup: See scripts/harden-container-host.sh
• Compliance reporting: See scripts/generate-compliance-report.py
• Infrastructure scanning: See scripts/scan-infrastructure.sh

For working examples:

• Linux configurations: See examples/linux/
• Kubernetes manifests: See examples/kubernetes/
• Terraform modules: See examples/terraform/

Integration with Related Skills

• auth-security: Authentication and authorization patterns complement hardening
• secret-management: Secure secrets handling is essential for hardening
• kubernetes-operations: Pod security and RBAC hardening
• infrastructure-as-code: Security scanning in IaC pipelines
• building-ci-pipelines: Automated security scanning integration
• observability: Security monitoring and alerting
• compliance-frameworks: Mapping hardening to compliance requirements

Anti-Patterns to Avoid

❌ Hardening only at deployment

• Hardening is continuous; scan and verify regularly

❌ Applying all controls blindly

• Prioritize based on risk and exposure

❌ No verification

• Always verify hardening is applied and effective

❌ Security through obscurity

• Obscurity is not security; use proven controls

❌ Hardening without testing

• Test hardening changes don't break functionality

❌ Manual hardening at scale

• Automate hardening for consistency and repeatability

Getting Started

1. Assess current posture: Run CIS benchmark scans 2. Prioritize: Internet-facing → sensitive data → internal 3. Apply baseline hardening: OS, container, cloud basics 4. Automate: Use scripts and IaC for consistency 5. Verify continuously: Integrate scanning into CI/CD 6. Monitor: Deploy runtime security monitoring 7. Iterate: Review and improve hardening regularly

For step-by-step implementation, start with references/linux-hardening.md or references/container-hardening.md based on infrastructure type.

CIS Benchmark Mapping Reference

Mapping of CIS (Center for Internet Security) Benchmarks to hardening actions across all infrastructure layers.

Table of Contents

1. CIS Controls v8 Overview 2. Linux CIS Benchmark Mapping 3. Docker CIS Benchmark Mapping 4. Kubernetes CIS Benchmark Mapping 5. Cloud Provider CIS Benchmarks 6. Automated CIS Scanning

---

CIS Controls v8 Overview

The 18 CIS Controls provide a prioritized framework for cybersecurity:

Focus for Hardening: Controls 3, 4, 5, 6, 7, 8, 10, 12, 13, 16

---

Linux CIS Benchmark Mapping

Initial Setup (Section 1)

Services (Section 2)

Network Configuration (Section 3)

Logging and Auditing (Section 4)

Access Control (Section 5)

System Maintenance (Section 6)

---

Docker CIS Benchmark Mapping

Host Configuration (Section 1)

Docker Daemon Configuration (Section 2)

Docker Daemon Files (Section 3)

Container Images (Section 4)

Container Runtime (Section 5)

---

Kubernetes CIS Benchmark Mapping

Control Plane Components (Section 1)

Etcd (Section 2)

Control Plane Configuration (Section 3)

Worker Nodes (Section 4)

Policies (Section 5)

---

Cloud Provider CIS Benchmarks

AWS Foundations Benchmark

Key sections:

• 1.x: Identity and Access Management (IAM)
• 2.x: Storage (S3 encryption, access controls)
• 3.x: Logging (CloudTrail, VPC Flow Logs)
• 4.x: Monitoring (CloudWatch, GuardDuty)
• 5.x: Networking (Security Groups, NACLs)

Automated scanning:

prowler aws --compliance cis_2.0_aws

GCP CIS Benchmark

Key sections:

• 1.x: Identity and Access Management
• 2.x: Logging and Monitoring (Cloud Logging, Monitoring)
• 3.x: Networking (VPC, Firewall Rules)
• 4.x: Virtual Machines (Compute Engine)
• 5.x: Storage (Cloud Storage, encryption)
• 6.x: Cloud SQL Database Services

Automated scanning:

scout gcp --project-id my-project

Azure CIS Benchmark

Key sections:

• 1.x: Identity and Access Management (Azure AD)
• 2.x: Microsoft Defender for Cloud
• 3.x: Storage Accounts
• 4.x: Database Services
• 5.x: Logging and Monitoring (Log Analytics)
• 6.x: Networking (NSGs, Virtual Networks)
• 7.x: Virtual Machines
• 8.x: Key Vault

Automated scanning:

scout azure

---

Automated CIS Scanning

Docker Bench Security

# Run Docker CIS benchmark
docker run --rm -it \
  --net host \
  --pid host \
  --userns host \
  --cap-add audit_control \
  -v /var/lib:/var/lib:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /etc:/etc:ro \
  docker/docker-bench-security

# Output includes:
# [PASS] 1.1.1 - Ensure a separate partition for containers
# [WARN] 1.2.1 - Ensure the container host has been Hardened
# [FAIL] 2.1 - Ensure network traffic is restricted between containers

kube-bench (Kubernetes)

# Run as Kubernetes Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

# View results
kubectl logs job/kube-bench

# Run on master node
kube-bench run --targets master

# Run on worker node
kube-bench run --targets node

# Output to JSON
kube-bench run --json --outputfile results.json

Lynis (Linux)

# Install Lynis
apt-get install lynis

# Run full audit
lynis audit system

# Check specific category
lynis audit system --tests-from-category security

# Generate report
lynis audit system --quick --report-file /tmp/lynis-report.txt

OpenSCAP (Linux)

# Install OpenSCAP
apt-get install libopenscap8 ssg-base ssg-debderived ssg-debian ssg-nondebian

# Run Ubuntu 20.04 CIS scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results scan-results.xml \
  --report scan-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml

Prowler (AWS)

# Install
pip install prowler

# Run full CIS scan
prowler aws --compliance cis_2.0_aws

# Specific services only
prowler aws --services s3 iam ec2

# Output to JSON
prowler aws --output-modes json html csv --output-directory ./reports/

---

Compliance Mapping

SOC 2 to CIS Mapping

PCI DSS to CIS Mapping

HIPAA to CIS Mapping

---

Additional Resources

• CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
• CIS Controls v8: https://www.cisecurity.org/controls/v8
• Docker Bench Security: https://github.com/docker/docker-bench-security
• kube-bench: https://github.com/aquasecurity/kube-bench
• Lynis: https://cisofy.com/lynis/
• OpenSCAP: https://www.open-scap.org/
• Prowler: https://github.com/prowler-cloud/prowler

Cloud Hardening Reference

Comprehensive guide to hardening AWS, GCP, and Azure cloud configurations using least privilege, encryption, and CSPM tools.

Table of Contents

1. AWS Hardening 2. GCP Hardening 3. Azure Hardening 4. Multi-Cloud Patterns 5. Cloud Security Posture Management

---

AWS Hardening

IAM Hardening

Principle: Least Privilege with MFA

# terraform/aws/iam-hardening.tf

# Deny all actions without MFA
resource "aws_iam_policy" "mfa_required" {
  name        = "mfa-required-sensitive"
  description = "Require MFA for sensitive operations"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyWithoutMFA"
        Effect = "Deny"
        Action = [
          "iam:*",
          "organizations:*",
          "account:*",
          "ec2:TerminateInstances",
          "rds:DeleteDBInstance",
          "s3:DeleteBucket"
        ]
        Resource = "*"
        Condition = {
          BoolIfExists = {
            "aws:MultiFactorAuthPresent" = "false"
          }
        }
      }
    ]
  })
}

# Least privilege application role
resource "aws_iam_role" "app_role" {
  name = "app-least-privilege"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Service = "ec2.amazonaws.com"
      }
      Action = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_policy" "app_policy" {
  name = "app-specific-permissions"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "S3ReadOnly"
        Effect = "Allow"
        Action = [
          "s3:GetObject",
          "s3:ListBucket"
        ]
        Resource = [
          aws_s3_bucket.app_data.arn,
          "${aws_s3_bucket.app_data.arn}/*"
        ]
      },
      {
        Sid    = "SecretsManagerRead"
        Effect = "Allow"
        Action = [
          "secretsmanager:GetSecretValue"
        ]
        Resource = aws_secretsmanager_secret.app_secrets.arn
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "app_attach" {
  role       = aws_iam_role.app_role.name
  policy_arn = aws_iam_policy.app_policy.arn
}

IAM Best Practices:

• Enable MFA for all human users
• Use roles instead of access keys
• Rotate access keys regularly (90 days)
• Use SCPs (Service Control Policies) for organization-wide controls
• Enable CloudTrail for IAM action logging

S3 Bucket Hardening

# terraform/aws/s3-hardening.tf

resource "aws_s3_bucket" "secure" {
  bucket = "company-secure-bucket"
}

# Block all public access
resource "aws_s3_bucket_public_access_block" "secure" {
  bucket = aws_s3_bucket.secure.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Enable versioning (protects against accidental deletion)
resource "aws_s3_bucket_versioning" "secure" {
  bucket = aws_s3_bucket.secure.id

  versioning_configuration {
    status = "Enabled"
  }
}

# Enable encryption at rest
resource "aws_s3_bucket_server_side_encryption_configuration" "secure" {
  bucket = aws_s3_bucket.secure.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3.arn
    }
    bucket_key_enabled = true
  }
}

# Enable access logging
resource "aws_s3_bucket_logging" "secure" {
  bucket = aws_s3_bucket.secure.id

  target_bucket = aws_s3_bucket.logs.id
  target_prefix = "s3-access-logs/"
}

# Enforce TLS for data in transit
resource "aws_s3_bucket_policy" "enforce_tls" {
  bucket = aws_s3_bucket.secure.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid    = "DenyInsecureTransport"
      Effect = "Deny"
      Principal = "*"
      Action = "s3:*"
      Resource = [
        aws_s3_bucket.secure.arn,
        "${aws_s3_bucket.secure.arn}/*"
      ]
      Condition = {
        Bool = {
          "aws:SecureTransport" = "false"
        }
      }
    }]
  })
}

# Lifecycle policy (optional: delete old versions)
resource "aws_s3_bucket_lifecycle_configuration" "secure" {
  bucket = aws_s3_bucket.secure.id

  rule {
    id     = "expire-old-versions"
    status = "Enabled"

    noncurrent_version_expiration {
      noncurrent_days = 90
    }
  }
}

VPC and Network Hardening

# terraform/aws/vpc-hardening.tf

# VPC with private subnets
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "secure-vpc"
  }
}

# Enable VPC Flow Logs
resource "aws_flow_log" "main" {
  vpc_id          = aws_vpc.main.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_logs.arn
  log_destination = aws_cloudwatch_log_group.flow_logs.arn
}

# Security group: default deny
resource "aws_security_group" "app" {
  name        = "app-hardened"
  description = "Hardened application security group"
  vpc_id      = aws_vpc.main.id

  # No ingress rules (add explicitly as needed)

  # Egress: only HTTPS
  egress {
    description = "HTTPS outbound"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Egress: Database access
  egress {
    description     = "Database access"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.db.id]
  }

  tags = {
    Name = "app-hardened"
  }
}

# Enable GuardDuty
resource "aws_guardduty_detector" "main" {
  enable = true

  datasources {
    s3_logs {
      enable = true
    }
    kubernetes {
      audit_logs {
        enable = true
      }
    }
  }
}

RDS Database Hardening

# terraform/aws/rds-hardening.tf

resource "aws_db_instance" "hardened" {
  identifier = "hardened-postgres"

  engine         = "postgres"
  engine_version = "15.4"
  instance_class = "db.t3.medium"

  # Storage
  allocated_storage     = 100
  storage_encrypted     = true
  kms_key_id            = aws_kms_key.rds.arn
  storage_type          = "gp3"

  # Network isolation
  publicly_accessible    = false
  db_subnet_group_name   = aws_db_subnet_group.private.name
  vpc_security_group_ids = [aws_security_group.db.id]

  # Authentication
  username                            = "dbadmin"
  manage_master_user_password         = true  # AWS Secrets Manager
  iam_database_authentication_enabled = true

  # Backup and recovery
  backup_retention_period = 30
  backup_window          = "03:00-04:00"
  copy_tags_to_snapshot  = true
  skip_final_snapshot    = false
  final_snapshot_identifier = "hardened-postgres-final"

  # Maintenance
  auto_minor_version_upgrade = true
  maintenance_window         = "Mon:04:00-Mon:05:00"

  # Logging
  enabled_cloudwatch_logs_exports = [
    "postgresql",
    "upgrade"
  ]

  # Deletion protection
  deletion_protection = true

  # Performance Insights
  performance_insights_enabled    = true
  performance_insights_kms_key_id = aws_kms_key.rds.arn

  tags = {
    Name = "hardened-postgres"
  }
}

# Database parameter group hardening
resource "aws_db_parameter_group" "hardened" {
  name   = "postgres-hardened"
  family = "postgres15"

  parameter {
    name  = "log_statement"
    value = "all"  # Log all SQL statements
  }

  parameter {
    name  = "log_connections"
    value = "1"  # Log connection attempts
  }

  parameter {
    name  = "log_disconnections"
    value = "1"  # Log disconnections
  }

  parameter {
    name  = "rds.force_ssl"
    value = "1"  # Require SSL connections
  }
}

AWS Config Rules

# terraform/aws/config-hardening.tf

resource "aws_config_configuration_recorder" "main" {
  name     = "config-recorder"
  role_arn = aws_iam_role.config.arn

  recording_group {
    all_supported                 = true
    include_global_resource_types = true
  }
}

# Check S3 bucket public access
resource "aws_config_config_rule" "s3_bucket_public_read_prohibited" {
  name = "s3-bucket-public-read-prohibited"

  source {
    owner             = "AWS"
    source_identifier = "S3_BUCKET_PUBLIC_READ_PROHIBITED"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

# Check S3 bucket encryption
resource "aws_config_config_rule" "s3_bucket_server_side_encryption_enabled" {
  name = "s3-bucket-server-side-encryption-enabled"

  source {
    owner             = "AWS"
    source_identifier = "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

# Check RDS encryption
resource "aws_config_config_rule" "rds_storage_encrypted" {
  name = "rds-storage-encrypted"

  source {
    owner             = "AWS"
    source_identifier = "RDS_STORAGE_ENCRYPTED"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

# Check MFA for root account
resource "aws_config_config_rule" "root_account_mfa_enabled" {
  name = "root-account-mfa-enabled"

  source {
    owner             = "AWS"
    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

---

GCP Hardening

IAM and Service Accounts

# terraform/gcp/iam-hardening.tf

# Service account with minimal permissions
resource "google_service_account" "app" {
  account_id   = "app-service-account"
  display_name = "Application Service Account"
  project      = var.project_id
}

# Grant minimal permissions
resource "google_project_iam_member" "app_storage_reader" {
  project = var.project_id
  role    = "roles/storage.objectViewer"
  member  = "serviceAccount:${google_service_account.app.email}"

  condition {
    title       = "access_specific_bucket"
    description = "Access only to app-data bucket"
    expression  = "resource.name.startsWith('projects/_/buckets/app-data')"
  }
}

# Workload Identity for GKE
resource "google_service_account_iam_member" "workload_identity" {
  service_account_id = google_service_account.app.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "serviceAccount:${var.project_id}.svc.id.goog[${var.namespace}/${var.ksa_name}]"
}

Cloud Storage Hardening

# terraform/gcp/storage-hardening.tf

resource "google_storage_bucket" "secure" {
  name     = "company-secure-bucket"
  location = "US"
  project  = var.project_id

  # Prevent public access
  public_access_prevention = "enforced"

  # Enable uniform bucket-level access
  uniform_bucket_level_access {
    enabled = true
  }

  # Enable versioning
  versioning {
    enabled = true
  }

  # Encryption
  encryption {
    default_kms_key_name = google_kms_crypto_key.bucket.id
  }

  # Lifecycle rules
  lifecycle_rule {
    condition {
      num_newer_versions = 3
    }
    action {
      type = "Delete"
    }
  }

  # Logging
  logging {
    log_bucket        = google_storage_bucket.logs.name
    log_object_prefix = "storage-logs/"
  }

  # Labels
  labels = {
    environment = "production"
    compliance  = "required"
  }
}

# Bucket IAM: deny public access
resource "google_storage_bucket_iam_member" "no_public_access" {
  bucket = google_storage_bucket.secure.name
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${google_service_account.app.email}"
}

VPC and Firewall Hardening

# terraform/gcp/vpc-hardening.tf

# VPC with private IP ranges
resource "google_compute_network" "secure" {
  name                    = "secure-vpc"
  auto_create_subnetworks = false
  project                 = var.project_id
}

resource "google_compute_subnetwork" "private" {
  name          = "private-subnet"
  ip_cidr_range = "10.0.1.0/24"
  region        = "us-central1"
  network       = google_compute_network.secure.id
  project       = var.project_id

  # Enable VPC Flow Logs
  log_config {
    aggregation_interval = "INTERVAL_10_MIN"
    flow_sampling        = 0.5
    metadata             = "INCLUDE_ALL_METADATA"
  }

  # Private Google Access
  private_ip_google_access = true
}

# Firewall: default deny
resource "google_compute_firewall" "deny_all" {
  name    = "deny-all"
  network = google_compute_network.secure.name
  project = var.project_id

  deny {
    protocol = "all"
  }

  source_ranges = ["0.0.0.0/0"]
  priority      = 65534
}

# Firewall: allow specific traffic
resource "google_compute_firewall" "allow_app" {
  name    = "allow-app"
  network = google_compute_network.secure.name
  project = var.project_id

  allow {
    protocol = "tcp"
    ports    = ["8080"]
  }

  source_tags = ["frontend"]
  target_tags = ["app"]
  priority    = 1000
}

Cloud SQL Hardening

# terraform/gcp/cloudsql-hardening.tf

resource "google_sql_database_instance" "hardened" {
  name             = "hardened-postgres"
  database_version = "POSTGRES_15"
  region           = "us-central1"
  project          = var.project_id

  settings {
    tier              = "db-custom-2-7680"
    availability_type = "REGIONAL"  # High availability

    # Backup configuration
    backup_configuration {
      enabled                        = true
      start_time                     = "03:00"
      point_in_time_recovery_enabled = true
      backup_retention_settings {
        retained_backups = 30
      }
    }

    # IP configuration
    ip_configuration {
      ipv4_enabled    = false  # No public IP
      private_network = google_compute_network.secure.id
      require_ssl     = true
    }

    # Database flags
    database_flags {
      name  = "log_connections"
      value = "on"
    }

    database_flags {
      name  = "log_disconnections"
      value = "on"
    }

    database_flags {
      name  = "log_statement"
      value = "all"
    }

    # Maintenance window
    maintenance_window {
      day          = 1  # Monday
      hour         = 4
      update_track = "stable"
    }

    # Insights
    insights_config {
      query_insights_enabled  = true
      query_plans_per_minute  = 5
      query_string_length     = 1024
      record_application_tags = true
    }
  }

  deletion_protection = true
}

---

Azure Hardening

Azure AD and RBAC

# terraform/azure/rbac-hardening.tf

# Custom role with minimal permissions
resource "azurerm_role_definition" "app_reader" {
  name        = "App Reader"
  scope       = data.azurerm_subscription.primary.id
  description = "Can read app-specific resources only"

  permissions {
    actions = [
      "Microsoft.Storage/storageAccounts/blobServices/containers/read",
      "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
    ]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id
  ]
}

# Assign role to managed identity
resource "azurerm_role_assignment" "app_reader" {
  scope                = azurerm_storage_account.app.id
  role_definition_name = azurerm_role_definition.app_reader.name
  principal_id         = azurerm_user_assigned_identity.app.principal_id
}

# Managed identity for applications
resource "azurerm_user_assigned_identity" "app" {
  name                = "app-identity"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
}

Storage Account Hardening

# terraform/azure/storage-hardening.tf

resource "azurerm_storage_account" "secure" {
  name                     = "companysecurestorage"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "GRS"

  # Disable public access
  allow_nested_items_to_be_public = false
  public_network_access_enabled   = false

  # Require HTTPS
  enable_https_traffic_only = true
  min_tls_version          = "TLS1_2"

  # Network rules
  network_rules {
    default_action             = "Deny"
    virtual_network_subnet_ids = [azurerm_subnet.app.id]
    bypass                     = ["AzureServices"]
  }

  # Blob properties
  blob_properties {
    versioning_enabled = true

    delete_retention_policy {
      days = 30
    }

    container_delete_retention_policy {
      days = 30
    }
  }

  # Encryption
  infrastructure_encryption_enabled = true

  identity {
    type = "SystemAssigned"
  }

  tags = {
    environment = "production"
  }
}

# Enable encryption with customer-managed key
resource "azurerm_storage_account_customer_managed_key" "secure" {
  storage_account_id = azurerm_storage_account.secure.id
  key_vault_id       = azurerm_key_vault.main.id
  key_name           = azurerm_key_vault_key.storage.name
}

Network Security Groups

# terraform/azure/nsg-hardening.tf

resource "azurerm_network_security_group" "app" {
  name                = "app-nsg"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
}

# Deny all inbound (default)
resource "azurerm_network_security_rule" "deny_all_inbound" {
  name                        = "DenyAllInbound"
  priority                    = 4096
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "*"
  source_port_range           = "*"
  destination_port_range      = "*"
  source_address_prefix       = "*"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.app.name
}

# Allow specific traffic
resource "azurerm_network_security_rule" "allow_app" {
  name                        = "AllowApp"
  priority                    = 1000
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "8080"
  source_address_prefixes     = azurerm_subnet.frontend.address_prefixes
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.main.name
  network_security_group_name = azurerm_network_security_group.app.name
}

---

Multi-Cloud Patterns

Common Hardening Patterns

1. Zero Trust Network Access:

• Authenticate every request
• Verify device posture
• Enforce least privilege
• Log all access

2. Encryption Everywhere:

• At rest: KMS/CMEK for all storage
• In transit: TLS 1.2+ for all connections
• Key rotation: Automated, regular

3. Centralized Logging:

• CloudTrail (AWS), Cloud Logging (GCP), Azure Monitor
• Ship to SIEM (Splunk, ELK, Datadog)
• Retention: 90+ days

4. Automated Compliance:

• AWS Config, GCP Security Command Center, Azure Policy
• Continuous compliance monitoring
• Automated remediation where possible

---

Cloud Security Posture Management

Prowler (AWS)

# Install Prowler
pip install prowler

# Run comprehensive AWS scan
prowler aws --services s3 iam ec2 rds vpc

# Run CIS benchmark
prowler aws --compliance cis_2.0_aws

# Output to JSON
prowler aws --output-modes json --output-directory ./reports/

ScoutSuite (Multi-Cloud)

# Install ScoutSuite
pip install scoutsuite

# Scan AWS
scout aws --report-dir ./reports/aws/

# Scan GCP
scout gcp --project-id my-project --report-dir ./reports/gcp/

# Scan Azure
scout azure --report-dir ./reports/azure/

Checkov (IaC Scanning)

# Install Checkov
pip install checkov

# Scan Terraform
checkov -d terraform/ --framework terraform

# Scan CloudFormation
checkov -f cloudformation-template.yaml --framework cloudformation

# CI/CD integration
checkov -d terraform/ --output json --quiet --compact

---

Additional Resources

• AWS Security Best Practices: https://aws.amazon.com/security/best-practices/
• GCP Security Best Practices: https://cloud.google.com/security/best-practices
• Azure Security Best Practices: https://learn.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns
• CIS AWS Benchmark: https://www.cisecurity.org/benchmark/amazon_web_services
• Prowler: https://github.com/prowler-cloud/prowler
• ScoutSuite: https://github.com/nccgroup/ScoutSuite

Container Hardening Reference

Comprehensive guide to hardening Docker containers and Kubernetes workloads using minimal images, security contexts, and policy enforcement.

Table of Contents

1. Container Image Hardening 2. Dockerfile Best Practices 3. Docker Runtime Security 4. Kubernetes Pod Security 5. Pod Security Standards 6. Network Policies 7. Supply Chain Security 8. Runtime Security Monitoring

---

Container Image Hardening

Base Image Selection

Choose minimal base images to reduce attack surface and vulnerabilities:

Production recommendation:

• First choice: Chainguard Images (cgr.dev/chainguard/*)
• Second choice: Distroless (gcr.io/distroless/*)
• Development: Alpine (for easier debugging)

Multi-Stage Builds

Use multi-stage builds to minimize final image size:

# Build stage
FROM cgr.dev/chainguard/python:latest-dev AS builder

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt --target=/app/deps

# Production stage
FROM cgr.dev/chainguard/python:latest

# Run as non-root user (nonroot user exists in Chainguard images)
USER nonroot

WORKDIR /app
COPY --from=builder --chown=nonroot:nonroot /app/deps /app/deps
COPY --chown=nonroot:nonroot . .

ENV PYTHONPATH=/app/deps

# Read-only filesystem compatible
ENTRYPOINT ["python", "-m", "app"]

Image Scanning

Scan images for vulnerabilities before deployment:

# Trivy: Comprehensive scanner
trivy image --severity HIGH,CRITICAL myapp:latest

# Grype: Fast vulnerability scanner
grype myapp:latest

# Scan in CI/CD
docker build -t myapp:test .
trivy image --exit-code 1 --severity CRITICAL myapp:test

---

Dockerfile Best Practices

Secure Dockerfile Template

# Use minimal base image
FROM cgr.dev/chainguard/node:latest AS builder

# Set working directory
WORKDIR /app

# Copy only dependency files first (layer caching)
COPY package*.json ./

# Install dependencies (no dev dependencies in production)
RUN npm ci --only=production

# Copy application code
COPY . .

# Production image
FROM cgr.dev/chainguard/node:latest

# Security labels
LABEL org.opencontainers.image.source="https://github.com/org/repo"
LABEL org.opencontainers.image.description="Application description"
LABEL org.opencontainers.image.licenses="MIT"

# Run as non-root user
USER nonroot

WORKDIR /app

# Copy from builder
COPY --from=builder --chown=nonroot:nonroot /app /app

# Expose port (documentation only, doesn't actually open port)
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node healthcheck.js || exit 1

# Run application
CMD ["node", "server.js"]

Key Dockerfile Hardening Rules

1. Never run as root:

# Bad
FROM ubuntu
RUN apt-get update && apt-get install -y nginx
CMD ["nginx"]

# Good
FROM ubuntu
RUN apt-get update && apt-get install -y nginx \
  && useradd -r -s /bin/false nginx-user
USER nginx-user
CMD ["nginx"]

2. Use COPY instead of ADD:

# Bad (ADD has implicit tar extraction)
ADD app.tar.gz /app

# Good (explicit, predictable)
COPY app /app

3. Don't include secrets:

# Bad
COPY .env /app/.env
ENV API_KEY=secret123

# Good (use runtime secrets)
# Mount secrets at runtime or use secret management

4. Minimize layers and clean up:

# Bad (multiple layers, leftover files)
RUN apt-get update
RUN apt-get install -y curl
RUN curl -O https://example.com/file
RUN rm -rf /var/lib/apt/lists/*

# Good (single layer, cleanup)
RUN apt-get update \
  && apt-get install -y --no-install-recommends curl \
  && curl -O https://example.com/file \
  && apt-get purge -y curl \
  && rm -rf /var/lib/apt/lists/*

5. Use specific versions:

# Bad (unpredictable)
FROM node:latest

# Good (pinned version)
FROM node:20.10.0-alpine3.19

6. Set read-only filesystem:

# Application must be compatible with read-only filesystem
# No writing to container filesystem
USER nonroot
COPY --chown=nonroot:nonroot app /app

# Use volume mounts for writable directories
VOLUME ["/app/tmp", "/app/logs"]

---

Docker Runtime Security

Docker Daemon Hardening

Configure Docker daemon in /etc/docker/daemon.json:

{
  "icc": false,
  "userns-remap": "default",
  "no-new-privileges": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "live-restore": true,
  "userland-proxy": false,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    }
  }
}

Restart Docker after changes:

systemctl restart docker

Secure Docker Run Options

Run containers with security flags:

# Secure container runtime
docker run \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=100m \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --security-opt=no-new-privileges:true \
  --user 1000:1000 \
  --memory=256m \
  --cpus=0.5 \
  --pids-limit=100 \
  --health-cmd="curl -f http://localhost/health || exit 1" \
  --health-interval=30s \
  --health-timeout=3s \
  --health-retries=3 \
  myapp:latest

Docker security options explained:

• --read-only: Root filesystem is read-only
• --tmpfs: Mount writable tmpfs for temporary files
• --cap-drop=ALL: Drop all Linux capabilities
• --cap-add: Add only required capabilities
• --security-opt=no-new-privileges: Prevent privilege escalation
• --user: Run as non-root user (UID:GID)
• --memory, --cpus: Resource limits
• --pids-limit: Limit number of processes

Docker Compose Security

version: '3.9'

services:
  app:
    image: myapp:latest
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    user: "1000:1000"
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=100m
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.25'
          memory: 128M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s

---

Kubernetes Pod Security

Pod Security Context

Apply security context to pods:

apiVersion: v1
kind: Pod
metadata:
  name: hardened-app
spec:
  # Pod-level security context
  securityContext:
    runAsNonRoot: true
    runAsUser: 65534        # nobody user
    runAsGroup: 65534       # nobody group
    fsGroup: 65534          # filesystem group
    seccompProfile:
      type: RuntimeDefault  # Apply default seccomp profile
    supplementalGroups: [1000]

  containers:
  - name: app
    image: myapp:latest

    # Container-level security context
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 65534
      capabilities:
        drop:
          - ALL                    # Drop all capabilities
        add:
          - NET_BIND_SERVICE       # Only if needed

    # Resource limits
    resources:
      limits:
        memory: "256Mi"
        cpu: "500m"
        ephemeral-storage: "1Gi"
      requests:
        memory: "128Mi"
        cpu: "100m"
        ephemeral-storage: "500Mi"

    # Writable volumes for read-only filesystem
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /app/.cache

  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}

Deployment with Security

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: secure-app
  template:
    metadata:
      labels:
        app: secure-app
    spec:
      # Service account (not default)
      serviceAccountName: secure-app-sa
      automountServiceAccountToken: false  # Don't mount unless needed

      # Security context
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        fsGroup: 65534
        seccompProfile:
          type: RuntimeDefault

      containers:
      - name: app
        image: myapp:latest
        imagePullPolicy: Always

        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          capabilities:
            drop: ["ALL"]

        resources:
          limits:
            memory: "256Mi"
            cpu: "500m"
          requests:
            memory: "128Mi"
            cpu: "100m"

        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10

        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5

        volumeMounts:
        - name: tmp
          mountPath: /tmp

      volumes:
      - name: tmp
        emptyDir: {}

---

Pod Security Standards

Kubernetes defines three Pod Security Standards:

1. Privileged (No restrictions)

For system-level workloads only. Avoid in production applications.

2. Baseline (Minimally restrictive)

Prevents known privilege escalations:

• Disallows privileged containers
• Restricts host namespaces
• Restricts capabilities
• Limits volume types

3. Restricted (Heavily restricted)

Production best practice:

• Everything in Baseline, plus:
• Requires non-root user
• Drops all capabilities
• Restricts volume types further

Enforce Pod Security Standards

# Namespace-level enforcement
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    # Enforce restricted standard
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

    # Audit mode (log violations)
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest

    # Warn mode (show warnings)
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest

Using Policy Engines

OPA Gatekeeper:

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8spspallowprivilegeescalationcontainer
spec:
  crd:
    spec:
      names:
        kind: K8sPSPAllowPrivilegeEscalationContainer
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8spspallowprivilegeescalationcontainer

        violation[{"msg": msg}] {
          c := input.review.object.spec.containers[_]
          c.securityContext.allowPrivilegeEscalation == true
          msg := sprintf("Privilege escalation container is not allowed: %v", [c.name])
        }

Kyverno:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privilege-escalation
spec:
  validationFailureAction: enforce
  background: true
  rules:
  - name: disallow-privilege-escalation
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Privilege escalation is not allowed"
      pattern:
        spec:
          containers:
          - securityContext:
              allowPrivilegeEscalation: false

---

Network Policies

Default Deny All Traffic

Start with default deny, then explicitly allow:

# Deny all ingress traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress

---
# Deny all egress traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress

Allow Specific Traffic

# Allow frontend to access API
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: database
    ports:
    - protocol: TCP
      port: 5432
  # Allow DNS
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53

---

Supply Chain Security

Image Signing with Sigstore

Sign container images to verify authenticity:

# Install cosign
go install github.com/sigstore/cosign/v2/cmd/cosign@latest

# Generate key pair
cosign generate-key-pair

# Sign image
cosign sign --key cosign.key myregistry.io/myapp:v1.0.0

# Verify signature
cosign verify --key cosign.pub myregistry.io/myapp:v1.0.0

Verify Signatures in Kubernetes

# Kyverno policy to verify image signatures
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: verify-signature
    match:
      any:
      - resources:
          kinds:
          - Pod
    verifyImages:
    - imageReferences:
      - "myregistry.io/*"
      attestors:
      - count: 1
        entries:
        - keys:
            publicKeys: |-
              -----BEGIN PUBLIC KEY-----
              ...
              -----END PUBLIC KEY-----

Software Bill of Materials (SBOM)

Generate SBOM for container images:

# Generate SBOM with syft
syft myapp:latest -o json > sbom.json

# Attach SBOM to image
cosign attach sbom --sbom sbom.json myregistry.io/myapp:v1.0.0

# Verify SBOM
cosign verify-attestation --key cosign.pub \
  --type https://spdx.dev/Document \
  myregistry.io/myapp:v1.0.0

---

Runtime Security Monitoring

Falco Rules

Deploy Falco for runtime threat detection:

# Falco DaemonSet (simplified)
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: falco
spec:
  selector:
    matchLabels:
      app: falco
  template:
    metadata:
      labels:
        app: falco
    spec:
      serviceAccountName: falco
      hostNetwork: true
      hostPID: true
      containers:
      - name: falco
        image: falcosecurity/falco:latest
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /host/var/run/docker.sock
          name: docker-socket
        - mountPath: /host/dev
          name: dev-fs
        - mountPath: /host/proc
          name: proc-fs
          readOnly: true
      volumes:
      - name: docker-socket
        hostPath:
          path: /var/run/docker.sock
      - name: dev-fs
        hostPath:
          path: /dev
      - name: proc-fs
        hostPath:
          path: /proc

Custom Falco rules:

# /etc/falco/falco_rules.local.yaml
- rule: Unexpected outbound connection
  desc: Detect unexpected outbound network connections
  condition: >
    outbound and
    not container.image.repository in (allowed_images) and
    not fd.sip in (allowed_ips)
  output: >
    Unexpected outbound connection
    (command=%proc.cmdline connection=%fd.name user=%user.name
    container=%container.info)
  priority: WARNING

- list: allowed_images
  items: [myregistry.io/myapp, myregistry.io/sidecar]

- list: allowed_ips
  items: [10.0.0.0/8, 172.16.0.0/12]

Automated Response

Integrate Falco with incident response:

# Falcosidekick for alert routing
apiVersion: v1
kind: ConfigMap
metadata:
  name: falcosidekick
  namespace: falco
data:
  config.yaml: |
    slack:
      webhookurl: "https://hooks.slack.com/services/XXX"
      minimumpriority: "warning"
    pagerduty:
      integrationkey: "XXX"
      minimumpriority: "critical"

---

Verification Checklist

Run these checks to verify container hardening:

#!/bin/bash
# verify-container-hardening.sh

echo "=== Container Hardening Verification ==="

# Check image vulnerabilities
echo -e "\n[Image Scanning]"
trivy image --severity HIGH,CRITICAL myapp:latest

# Check Dockerfile best practices
echo -e "\n[Dockerfile Linting]"
docker run --rm -i hadolint/hadolint < Dockerfile

# Check Kubernetes manifests
echo -e "\n[Kubernetes Security]"
kubesec scan k8s/deployment.yaml

# Check running containers (Docker)
echo -e "\n[Running Container Security]"
docker ps --format "table {{.Names}}\t{{.Image}}" | while read name image; do
  [ "$name" = "NAMES" ] && continue
  echo "Checking $name..."
  docker inspect "$name" --format '{{.HostConfig.Privileged}}' | grep -q false && echo "  ✓ Not privileged" || echo "  ✗ Running privileged"
  docker inspect "$name" --format '{{.HostConfig.ReadonlyRootfs}}' | grep -q true && echo "  ✓ Read-only root" || echo "  ✗ Writable root"
done

echo -e "\n=== Verification Complete ==="

---

Additional Resources

• CIS Docker Benchmark: https://www.cisecurity.org/benchmark/docker
• CIS Kubernetes Benchmark: https://www.cisecurity.org/benchmark/kubernetes
• Kubernetes Pod Security Standards: https://kubernetes.io/docs/concepts/security/pod-security-standards/
• Chainguard Images: https://www.chainguard.dev/chainguard-images
• Distroless Images: https://github.com/GoogleContainerTools/distroless
• Trivy Scanner: https://github.com/aquasecurity/trivy
• Falco Runtime Security: https://falco.org/
• Sigstore: https://www.sigstore.dev/

Database Hardening Reference

Comprehensive guide to hardening PostgreSQL, MySQL, MongoDB, and Redis databases.

Table of Contents

1. PostgreSQL Hardening 2. MySQL Hardening 3. MongoDB Hardening 4. Redis Hardening 5. General Database Security

---

PostgreSQL Hardening

Authentication and Authorization

-- Revoke public schema permissions
REVOKE ALL ON DATABASE mydb FROM PUBLIC;
REVOKE ALL ON SCHEMA public FROM PUBLIC;

-- Create application role with minimal permissions
CREATE ROLE app_user WITH LOGIN PASSWORD 'use_vault_for_this';
GRANT CONNECT ON DATABASE mydb TO app_user;
GRANT USAGE ON SCHEMA app TO app_user;

-- Grant specific table permissions
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA app TO app_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO app_user;

-- Read-only user
CREATE ROLE readonly WITH LOGIN PASSWORD 'secure_password';
GRANT CONNECT ON DATABASE mydb TO readonly;
GRANT USAGE ON SCHEMA app TO readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA app TO readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT ON TABLES TO readonly;

-- Revoke dangerous privileges
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE ALL ON pg_catalog.pg_authid FROM PUBLIC;

Connection Security (pg_hba.conf)

# /var/lib/postgresql/data/pg_hba.conf

# Local connections
local   all   postgres   peer
local   all   all        scram-sha-256

# Remote connections: require SSL
hostssl all   all   0.0.0.0/0   scram-sha-256
hostnossl all   all   0.0.0.0/0   reject

# Specific networks only
hostssl mydb   app_user   10.0.0.0/8   scram-sha-256

# Reject all other connections
host    all   all   0.0.0.0/0   reject

postgresql.conf Hardening

# /var/lib/postgresql/data/postgresql.conf

# Connection settings
listen_addresses = '10.0.1.10'  # Specific IP, not '*'
port = 5432
max_connections = 100
superuser_reserved_connections = 3

# SSL/TLS
ssl = on
ssl_cert_file = '/var/lib/postgresql/data/server.crt'
ssl_key_file = '/var/lib/postgresql/data/server.key'
ssl_ca_file = '/var/lib/postgresql/data/root.crt'
ssl_min_protocol_version = 'TLSv1.2'
ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
ssl_prefer_server_ciphers = on

# Logging
logging_collector = on
log_destination = 'stderr'
log_directory = 'log'
log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
log_rotation_age = 1d
log_rotation_size = 100MB
log_min_duration_statement = 1000  # Log slow queries (1s+)
log_connections = on
log_disconnections = on
log_duration = off
log_line_prefix = '%t [%p]: [%l-1] user=%u,db=%d,app=%a,client=%h '
log_statement = 'ddl'  # Log DDL statements
log_timezone = 'UTC'

# Security settings
password_encryption = scram-sha-256
row_security = on

# Statement timeout (prevent runaway queries)
statement_timeout = 300000  # 5 minutes

# Lock timeout
lock_timeout = 30000  # 30 seconds

# Disable trust authentication (enforce password)
# (configured in pg_hba.conf)

Encryption at Rest

# Using LUKS for filesystem encryption
cryptsetup luksFormat /dev/sdb
cryptsetup luksOpen /dev/sdb pgdata
mkfs.ext4 /dev/mapper/pgdata
mount /dev/mapper/pgdata /var/lib/postgresql

# Or use PostgreSQL's pgcrypto extension
psql -d mydb -c "CREATE EXTENSION pgcrypto;"

# Encrypt specific columns
CREATE TABLE users (
    id SERIAL PRIMARY KEY,
    username TEXT NOT NULL,
    email TEXT NOT NULL,
    ssn BYTEA  -- Encrypted column
);

INSERT INTO users (username, email, ssn)
VALUES ('john', 'john@example.com', pgp_sym_encrypt('123-45-6789', 'encryption_key'));

-- Retrieve decrypted data
SELECT username, pgp_sym_decrypt(ssn, 'encryption_key') as ssn FROM users;

Backup Security

#!/bin/bash
# /usr/local/bin/secure-pg-backup.sh

BACKUP_DIR="/backup/postgresql"
BACKUP_DATE=$(date +%Y%m%d_%H%M%S)
ENCRYPTION_KEY="/secure/backup.key"

# Dump database
pg_dump -U postgres mydb | \
  gzip | \
  openssl enc -aes-256-cbc -salt -pbkdf2 -pass file:$ENCRYPTION_KEY \
  > "$BACKUP_DIR/mydb_$BACKUP_DATE.sql.gz.enc"

# Set secure permissions
chmod 600 "$BACKUP_DIR/mydb_$BACKUP_DATE.sql.gz.enc"

# Remove backups older than 30 days
find "$BACKUP_DIR" -name "*.enc" -mtime +30 -delete

---

MySQL Hardening

User Management

-- Remove anonymous users
DELETE FROM mysql.user WHERE User='';

-- Remove remote root access
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');

-- Create application user
CREATE USER 'app_user'@'10.0.0.%' IDENTIFIED BY 'strong_password';
GRANT SELECT, INSERT, UPDATE, DELETE ON mydb.* TO 'app_user'@'10.0.0.%';

-- Require SSL
ALTER USER 'app_user'@'10.0.0.%' REQUIRE SSL;

-- Set password expiration
ALTER USER 'app_user'@'10.0.0.%' PASSWORD EXPIRE INTERVAL 90 DAY;

-- Flush privileges
FLUSH PRIVILEGES;

my.cnf Hardening

# /etc/mysql/my.cnf

[mysqld]
# Network
bind-address = 10.0.1.10  # Specific IP, not 0.0.0.0
port = 3306
skip-networking = 0
skip-name-resolve = 1

# SSL/TLS
require_secure_transport = ON
ssl-ca = /etc/mysql/ssl/ca.pem
ssl-cert = /etc/mysql/ssl/server-cert.pem
ssl-key = /etc/mysql/ssl/server-key.pem
tls_version = TLSv1.2,TLSv1.3

# Security
local-infile = 0  # Disable LOAD DATA LOCAL INFILE
secure-file-priv = /var/lib/mysql-files/  # Restrict file operations
symbolic-links = 0  # Disable symbolic links

# Logging
log-error = /var/log/mysql/error.log
general_log = 1
general_log_file = /var/log/mysql/general.log
slow_query_log = 1
slow_query_log_file = /var/log/mysql/slow.log
long_query_time = 2

# Performance and limits
max_connections = 100
max_connect_errors = 10
connect_timeout = 10
wait_timeout = 600
max_allowed_packet = 64M

Remove Test Database

-- Remove test database
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
FLUSH PRIVILEGES;

---

MongoDB Hardening

Enable Authentication

// Create admin user
use admin
db.createUser({
  user: "admin",
  pwd: "strongAdminPassword",
  roles: [ { role: "userAdminAnyDatabase", db: "admin" }, "readWriteAnyDatabase" ]
})

// Create application user
use mydb
db.createUser({
  user: "app_user",
  pwd: "strongAppPassword",
  roles: [ { role: "readWrite", db: "mydb" } ]
})

// Create read-only user
use mydb
db.createUser({
  user: "readonly",
  pwd: "strongReadPassword",
  roles: [ { role: "read", db: "mydb" } ]
})

mongod.conf Hardening

# /etc/mongod.conf

# Network interfaces
net:
  port: 27017
  bindIp: 10.0.1.10  # Specific IP, not 0.0.0.0
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/ca.pem
    allowConnectionsWithoutCertificates: false

# Security
security:
  authorization: enabled
  clusterAuthMode: x509

# Auditing
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.log

# Storage
storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true
  engine: wiredTiger
  wiredTiger:
    engineConfig:
      cacheSizeGB: 2
    collectionConfig:
      blockCompressor: snappy

# Encryption at rest
security:
  enableEncryption: true
  encryptionCipherMode: AES256-CBC
  encryptionKeyFile: /etc/mongodb-keyfile

# Logging
systemLog:
  destination: file
  path: /var/log/mongodb/mongod.log
  logAppend: true
  verbosity: 1

# Operations profiling
operationProfiling:
  mode: slowOp
  slowOpThresholdMs: 100

Disable HTTP Interface

# mongod.conf
net:
  http:
    enabled: false
    JSONPEnabled: false
    RESTInterfaceEnabled: false

---

Redis Hardening

redis.conf Hardening

# /etc/redis/redis.conf

# Network
bind 127.0.0.1 10.0.1.10  # Specific IPs
port 6379
protected-mode yes
tcp-backlog 511

# TLS/SSL
tls-port 6380
tls-cert-file /etc/redis/ssl/redis.crt
tls-key-file /etc/redis/ssl/redis.key
tls-ca-cert-file /etc/redis/ssl/ca.crt
tls-protocols "TLSv1.2 TLSv1.3"
tls-ciphers HIGH:!aNULL:!MD5
tls-prefer-server-ciphers yes

# Authentication
requirepass veryStrongPasswordHere
masterauth veryStrongPasswordHere

# ACL (Redis 6+)
aclfile /etc/redis/users.acl

# Disable dangerous commands
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command KEYS ""
rename-command CONFIG "CONFIG_SECRET_NAME"
rename-command SHUTDOWN ""
rename-command DEBUG ""

# Limits
maxclients 10000
maxmemory 2gb
maxmemory-policy allkeys-lru

# Persistence
save 900 1
save 300 10
save 60 10000
stop-writes-on-bgsave-error yes
rdbcompression yes
rdbchecksum yes
dbfilename dump.rdb
dir /var/lib/redis

# Logging
loglevel notice
logfile /var/log/redis/redis-server.log
syslog-enabled no

# Security
supervised systemd
user redis

Redis ACL (Access Control Lists)

# /etc/redis/users.acl

# Admin user (full access)
user admin on >strongAdminPassword ~* &* +@all

# Application user (limited commands)
user app_user on >strongAppPassword ~myapp:* &* +get +set +del +expire

# Read-only user
user readonly on >strongReadPassword ~* &* +get +scan +keys

# Default user (disabled)
user default off

---

General Database Security

1. Network Isolation

# Docker Compose example
version: '3.9'
services:
  db:
    image: postgres:15
    networks:
      - db-network
    # No ports exposed to host

  app:
    image: myapp:latest
    networks:
      - db-network
    depends_on:
      - db

networks:
  db-network:
    driver: bridge
    internal: true  # No external access

2. Least Privilege Principle

-- PostgreSQL: Grant only required permissions
CREATE ROLE app_user WITH LOGIN;
GRANT CONNECT ON DATABASE mydb TO app_user;
GRANT USAGE ON SCHEMA app TO app_user;
GRANT SELECT, INSERT, UPDATE ON specific_tables TO app_user;
-- NO DELETE, NO DDL permissions

3. Regular Backups with Encryption

#!/bin/bash
# Automated encrypted backup

# PostgreSQL
pg_dump mydb | gzip | openssl enc -aes-256-cbc -salt -pbkdf2 -pass file:/secure/key > backup.sql.gz.enc

# MySQL
mysqldump mydb | gzip | openssl enc -aes-256-cbc -salt -pbkdf2 -pass file:/secure/key > backup.sql.gz.enc

# MongoDB
mongodump --archive | gzip | openssl enc -aes-256-cbc -salt -pbkdf2 -pass file:/secure/key > backup.archive.gz.enc

4. Audit Logging

Enable comprehensive logging for all database access:

PostgreSQL: log_statement = 'all' MySQL: general_log = 1 MongoDB: Enable auditing Redis: slowlog and command logging

5. Connection Pooling

Use connection pooling to limit database connections:

# Python with psycopg2 and connection pooling
from psycopg2 import pool

db_pool = pool.SimpleConnectionPool(
    1,  # minconn
    10,  # maxconn
    user='app_user',
    password='from_vault',
    host='db.internal',
    port='5432',
    database='mydb',
    sslmode='require'
)

# Get connection from pool
conn = db_pool.getconn()
# ... use connection ...
db_pool.putconn(conn)

6. Parameterized Queries

Prevent SQL injection:

# Bad: Vulnerable to SQL injection
query = f"SELECT * FROM users WHERE username = '{username}'"

# Good: Parameterized query
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))

7. Rate Limiting

Implement rate limiting for database access:

from redis import Redis
from ratelimit import limits, RateLimitException

redis_client = Redis(host='localhost', port=6379)

@limits(calls=10, period=60)  # 10 calls per minute
def query_database(user_id):
    # Database query
    pass

---

Additional Resources

• PostgreSQL Security: https://www.postgresql.org/docs/current/security.html
• MySQL Security Guide: https://dev.mysql.com/doc/refman/8.0/en/security.html
• MongoDB Security Checklist: https://www.mongodb.com/docs/manual/administration/security-checklist/
• Redis Security: https://redis.io/docs/management/security/
• CIS Database Benchmarks: https://www.cisecurity.org/cis-benchmarks

Linux Hardening Reference

Comprehensive guide to hardening Linux operating systems using kernel parameters, SSH configuration, user management, and file system controls.

Table of Contents

1. Kernel Hardening (sysctl) 2. SSH Hardening 3. User and Group Management 4. File System Hardening 5. Service Minimization 6. SELinux/AppArmor Configuration 7. Automated Hardening

---

Kernel Hardening (sysctl)

Configure kernel parameters in /etc/sysctl.d/99-hardening.conf:

# Network Security
# ----------------

# Disable IP forwarding (unless this is a router)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Ignore ICMP redirects (prevents MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable sending ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable TCP SYN cookies (SYN flood protection)
net.ipv4.tcp_syncookies = 1

# Disable source routing (prevents IP spoofing)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Enable reverse path filtering (anti-spoofing)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Log suspicious packets (Martian packets)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Ignore ICMP ping requests (optional, may break monitoring)
# net.ipv4.icmp_echo_ignore_all = 1

# Ignore broadcast ICMP requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Kernel Security
# ---------------

# Enable Address Space Layout Randomization (ASLR)
kernel.randomize_va_space = 2

# Restrict kernel pointer exposure
kernel.kptr_restrict = 2

# Restrict dmesg access to root only
kernel.dmesg_restrict = 1

# Restrict access to kernel logs
kernel.dmesg_restrict = 1

# Enable ExecShield (if available)
kernel.exec-shield = 1

# Restrict ptrace (prevents debugging of other processes)
# 0 = classic ptrace, 1 = restricted, 2 = admin only, 3 = no ptrace
kernel.yama.ptrace_scope = 2

# Restrict core dumps
fs.suid_dumpable = 0

# File System Security
# --------------------

# Increase inotify limits for monitoring
fs.inotify.max_user_watches = 524288

# Protect hard links (prevents privilege escalation)
fs.protected_hardlinks = 1

# Protect symbolic links (prevents symlink attacks)
fs.protected_symlinks = 1

# Prevent FIFO attacks
fs.protected_fifos = 2

# Prevent regular file attacks
fs.protected_regular = 2

Apply sysctl settings:

# Load settings
sysctl --system

# Verify specific setting
sysctl kernel.randomize_va_space

---

SSH Hardening

Configure SSH in /etc/ssh/sshd_config.d/hardening.conf:

# Authentication
# --------------

# Disable root login
PermitRootLogin no

# Disable password authentication (use keys only)
PasswordAuthentication no
PermitEmptyPasswords no

# Disable challenge-response authentication
ChallengeResponseAuthentication no

# Disable Kerberos and GSSAPI
KerberosAuthentication no
GSSAPIAuthentication no

# Enable public key authentication
PubkeyAuthentication yes

# Limit authentication attempts
MaxAuthTries 3
MaxSessions 2

# Set login grace time (time to complete authentication)
LoginGraceTime 30

# Protocol and Encryption
# -----------------------

# Use only SSH Protocol 2
Protocol 2

# Specify strong key exchange algorithms
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

# Specify strong ciphers
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

# Specify strong MACs
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

# Access Control
# --------------

# Limit users and groups
AllowUsers deploy admin
# OR
AllowGroups ssh-users

# Deny specific users
DenyUsers root guest

# Session Security
# ----------------

# Disable X11 forwarding
X11Forwarding no

# Disable TCP forwarding
AllowTcpForwarding no

# Disable agent forwarding
AllowAgentForwarding no

# Disable SFTP subsystem (if not needed)
# Subsystem sftp /usr/lib/openssh/sftp-server

# Set idle timeout (5 minutes)
ClientAliveInterval 300
ClientAliveCountMax 2

# Limit concurrent unauthenticated connections
MaxStartups 10:30:60

# Banner and Logging
# ------------------

# Display legal banner
Banner /etc/issue.net

# Logging level
LogLevel VERBOSE

# Use privilege separation
UsePrivilegeSeparation sandbox

# Disable host-based authentication
HostbasedAuthentication no
IgnoreRhosts yes

Restart SSH after changes:

# Test configuration first
sshd -t

# Restart SSH service
systemctl restart sshd

# Verify SSH is running
systemctl status sshd

Generate strong SSH keys:

# ED25519 (recommended)
ssh-keygen -t ed25519 -a 100 -C "user@host"

# RSA 4096-bit (if ED25519 not supported)
ssh-keygen -t rsa -b 4096 -a 100 -C "user@host"

---

User and Group Management

Password Policies

Configure in /etc/login.defs:

# Password aging
PASS_MAX_DAYS 90        # Maximum password age
PASS_MIN_DAYS 7         # Minimum days between password changes
PASS_MIN_LEN 14         # Minimum password length
PASS_WARN_AGE 14        # Days warning before password expires

# User ID ranges
UID_MIN 1000
UID_MAX 60000
GID_MIN 1000
GID_MAX 60000

# Home directory permissions
UMASK 027               # Default umask for new files

# Login retry and timeout
LOGIN_RETRIES 3
LOGIN_TIMEOUT 60

# Enable SHA512 password hashing
ENCRYPT_METHOD SHA512

PAM Password Quality

Configure in /etc/security/pwquality.conf:

# Minimum password length
minlen = 14

# Require at least one lowercase character
lcredit = -1

# Require at least one uppercase character
ucredit = -1

# Require at least one digit
dcredit = -1

# Require at least one special character
ocredit = -1

# Maximum consecutive characters
maxrepeat = 3

# Check against dictionary
dictcheck = 1

# Enforce for root
enforce_for_root

Lock System Accounts

System accounts should not allow interactive login:

#!/bin/bash
# Lock all system accounts

SYSTEM_ACCOUNTS=(
  bin daemon adm lp sync shutdown halt mail news uucp operator
  games gopher ftp nobody systemd-network systemd-resolve
)

for user in "${SYSTEM_ACCOUNTS[@]}"; do
  # Lock password
  passwd -l "$user" 2>/dev/null

  # Set nologin shell
  usermod -s /sbin/nologin "$user" 2>/dev/null
done

Sudo Hardening

Configure in /etc/sudoers.d/hardening:

# Require password for sudo
Defaults timestamp_timeout=5

# Log all sudo commands
Defaults log_output
Defaults logfile="/var/log/sudo.log"

# Use secure path
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Require TTY
Defaults requiretty

# Disable root login via su
# auth required pam_wheel.so use_uid

Set Default Umask

Create /etc/profile.d/umask.sh:

# Set restrictive umask
umask 027

# For root
if [ $UID -eq 0 ]; then
  umask 022
fi

---

File System Hardening

Secure Mount Options

Configure in /etc/fstab:

# /tmp with noexec, nosuid, nodev
tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev,size=2G 0 0

# /var/tmp bind mount to /tmp
/tmp /var/tmp none bind 0 0

# /home with nosuid, nodev
/dev/mapper/vg-home /home ext4 defaults,nosuid,nodev 0 2

# /var with nosuid, nodev (if separate partition)
/dev/mapper/vg-var /var ext4 defaults,nosuid,nodev 0 2

# /boot with nodev, nosuid, noexec (after boot complete)
/dev/sda1 /boot ext4 defaults,nodev,nosuid,noexec 0 2

# Shared memory with noexec, nosuid, nodev
tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev,size=1G 0 0

Mount options explained:

• noexec: Prevent execution of binaries
• nosuid: Ignore SUID/SGID bits
• nodev: Prevent device files
• ro: Read-only (for specific use cases)

Apply mount options:

# Remount /tmp with new options
mount -o remount /tmp

# Verify mount options
mount | grep "/tmp"

File Permissions

Set secure permissions on critical files:

#!/bin/bash
# Set secure file permissions

# SSH configuration
chmod 600 /etc/ssh/sshd_config
chmod 600 /etc/ssh/sshd_config.d/*
chown root:root /etc/ssh/sshd_config

# Shadow files
chmod 600 /etc/shadow
chmod 600 /etc/gshadow
chown root:root /etc/shadow /etc/gshadow

# Cron directories
chmod 600 /etc/crontab
chmod 700 /etc/cron.d
chmod 700 /etc/cron.daily
chmod 700 /etc/cron.hourly
chmod 700 /etc/cron.monthly
chmod 700 /etc/cron.weekly

# Grub configuration
chmod 600 /boot/grub/grub.cfg
chown root:root /boot/grub/grub.cfg

# System logs
chmod 640 /var/log/wtmp
chmod 640 /var/log/btmp
chown root:utmp /var/log/wtmp /var/log/btmp

Disable Core Dumps

Prevent core dumps from containing sensitive information:

# In /etc/security/limits.conf
* hard core 0

# In /etc/sysctl.d/99-hardening.conf
fs.suid_dumpable = 0

# Disable core dumps for systemd
mkdir -p /etc/systemd/coredump.conf.d/
cat > /etc/systemd/coredump.conf.d/disable.conf <<EOF
[Coredump]
Storage=none
EOF

---

Service Minimization

Disable unnecessary services to reduce attack surface:

#!/bin/bash
# Disable unnecessary services

SERVICES_TO_DISABLE=(
  bluetooth.service
  cups.service
  cups-browsed.service
  avahi-daemon.service
  ModemManager.service
  wpa_supplicant.service
  iscsid.service
  rpcbind.service
  nfs-client.target
)

for service in "${SERVICES_TO_DISABLE[@]}"; do
  if systemctl is-enabled "$service" 2>/dev/null | grep -q enabled; then
    echo "Disabling $service"
    systemctl disable "$service"
    systemctl stop "$service"
  fi
done

# List enabled services
systemctl list-unit-files --state=enabled --no-pager

Services to keep enabled:

• sshd.service (if remote access needed)
• systemd-* (system services)
• networking.service / NetworkManager.service
• cron.service / cronie.service
• rsyslog.service / journald

---

SELinux/AppArmor Configuration

SELinux (Red Hat, CentOS, Fedora)

Enable SELinux:

# Check SELinux status
sestatus

# Set enforcing mode in /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

# Set enforcing mode immediately
setenforce 1

# Verify
getenforce

Common SELinux operations:

# Check context of file
ls -Z /path/to/file

# Restore default context
restorecon -Rv /path/to/directory

# Check SELinux denials
ausearch -m avc -ts recent

# Generate policy from denials
audit2allow -a -M mymodule
semodule -i mymodule.pp

# List boolean settings
getsebool -a

# Set boolean
setsebool -P httpd_can_network_connect on

AppArmor (Ubuntu, Debian, SUSE)

Enable AppArmor:

# Check AppArmor status
aa-status

# Enable AppArmor at boot
systemctl enable apparmor

# Start AppArmor
systemctl start apparmor

# Verify
aa-enabled

Common AppArmor operations:

# Put profile in complain mode (log only)
aa-complain /etc/apparmor.d/usr.bin.firefox

# Put profile in enforce mode
aa-enforce /etc/apparmor.d/usr.bin.firefox

# Reload all profiles
systemctl reload apparmor

# Generate profile from logs
aa-logprof

# Edit profile
aa-genprof /usr/bin/myapp

---

Automated Hardening

Using Ansible

# playbook/harden-linux.yml
---
- name: Harden Linux System
  hosts: all
  become: yes
  tasks:
    - name: Apply sysctl hardening
      sysctl:
        name: "{{ item.name }}"
        value: "{{ item.value }}"
        state: present
        reload: yes
      loop:
        - { name: 'kernel.randomize_va_space', value: '2' }
        - { name: 'net.ipv4.ip_forward', value: '0' }
        - { name: 'net.ipv4.conf.all.accept_redirects', value: '0' }
        - { name: 'net.ipv4.tcp_syncookies', value: '1' }

    - name: Harden SSH configuration
      lineinfile:
        path: /etc/ssh/sshd_config.d/hardening.conf
        line: "{{ item }}"
        create: yes
      loop:
        - "PermitRootLogin no"
        - "PasswordAuthentication no"
        - "X11Forwarding no"
        - "MaxAuthTries 3"
      notify: restart sshd

    - name: Disable unnecessary services
      systemd:
        name: "{{ item }}"
        state: stopped
        enabled: no
      loop:
        - bluetooth.service
        - cups.service
        - avahi-daemon.service
      ignore_errors: yes

  handlers:
    - name: restart sshd
      systemd:
        name: sshd
        state: restarted

Verification Script

#!/bin/bash
# verify-hardening.sh

echo "=== Linux Hardening Verification ==="

# Check sysctl settings
echo -e "\n[Kernel Parameters]"
sysctl kernel.randomize_va_space | grep -q "2" && echo "✓ ASLR enabled" || echo "✗ ASLR disabled"
sysctl net.ipv4.ip_forward | grep -q "0" && echo "✓ IP forwarding disabled" || echo "✗ IP forwarding enabled"
sysctl net.ipv4.tcp_syncookies | grep -q "1" && echo "✓ SYN cookies enabled" || echo "✗ SYN cookies disabled"

# Check SSH configuration
echo -e "\n[SSH Configuration]"
sshd -T | grep -q "^permitrootlogin no" && echo "✓ Root login disabled" || echo "✗ Root login enabled"
sshd -T | grep -q "^passwordauthentication no" && echo "✓ Password auth disabled" || echo "✗ Password auth enabled"
sshd -T | grep -q "^x11forwarding no" && echo "✓ X11 forwarding disabled" || echo "✗ X11 forwarding enabled"

# Check file permissions
echo -e "\n[File Permissions]"
[ "$(stat -c %a /etc/shadow)" = "600" ] && echo "✓ /etc/shadow permissions correct" || echo "✗ /etc/shadow permissions incorrect"
[ "$(stat -c %a /etc/ssh/sshd_config)" = "600" ] && echo "✓ sshd_config permissions correct" || echo "✗ sshd_config permissions incorrect"

# Check disabled services
echo -e "\n[Disabled Services]"
systemctl is-enabled bluetooth.service 2>/dev/null | grep -q disabled && echo "✓ Bluetooth disabled" || echo "✗ Bluetooth not disabled"
systemctl is-enabled cups.service 2>/dev/null | grep -q disabled && echo "✓ CUPS disabled" || echo "✗ CUPS not disabled"

# Check SELinux/AppArmor
echo -e "\n[Mandatory Access Control]"
if command -v getenforce &>/dev/null; then
  getenforce | grep -q "Enforcing" && echo "✓ SELinux enforcing" || echo "✗ SELinux not enforcing"
elif command -v aa-enabled &>/dev/null; then
  aa-enabled && echo "✓ AppArmor enabled" || echo "✗ AppArmor not enabled"
fi

echo -e "\n=== Verification Complete ==="

Run verification:

chmod +x verify-hardening.sh
./verify-hardening.sh

---

Additional Resources

• CIS Benchmark for Linux: https://www.cisecurity.org/benchmark/distribution_independent_linux
• NIST Security Configuration Checklist: https://ncp.nist.gov/
• STIG (Security Technical Implementation Guide): https://public.cyber.mil/stigs/
• Lynis Security Auditing: https://cisofy.com/lynis/
• OpenSCAP Security Guide: https://www.open-scap.org/

Network Hardening Reference

Comprehensive guide to hardening network configurations using firewalls, segmentation, TLS, and DNS security.

Table of Contents

1. Firewall Configuration 2. Network Segmentation 3. TLS/mTLS Configuration 4. DNS Security 5. Network Monitoring

---

Firewall Configuration

iptables (Linux)

#!/bin/bash
# /etc/scripts/firewall-hardening.sh

# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Default policies: DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from specific network
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -m state --state NEW -j ACCEPT

# Allow HTTPS outbound
iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

# Allow DNS outbound
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT

# Log dropped packets
iptables -A INPUT -j LOG --log-prefix "iptables-INPUT-dropped: "
iptables -A OUTPUT -j LOG --log-prefix "iptables-OUTPUT-dropped: "

# Save rules
iptables-save > /etc/iptables/rules.v4

firewalld (Red Hat/CentOS)

# Set default zone to drop
firewall-cmd --set-default-zone=drop

# Create custom zone for trusted networks
firewall-cmd --permanent --new-zone=trusted-internal
firewall-cmd --permanent --zone=trusted-internal --add-source=10.0.0.0/8
firewall-cmd --permanent --zone=trusted-internal --add-service=ssh
firewall-cmd --permanent --zone=trusted-internal --add-service=http
firewall-cmd --permanent --zone=trusted-internal --add-service=https

# Allow specific ports
firewall-cmd --permanent --zone=public --add-port=8080/tcp

# Enable logging for denied packets
firewall-cmd --set-log-denied=all

# Reload
firewall-cmd --reload

nftables (Modern replacement for iptables)

# /etc/nftables.conf
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    # Allow loopback
    iif lo accept

    # Allow established connections
    ct state established,related accept

    # Allow SSH from trusted network
    ip saddr 10.0.0.0/8 tcp dport 22 ct state new accept

    # Log dropped
    log prefix "nftables-input-dropped: " drop
  }

  chain forward {
    type filter hook forward priority 0; policy drop;
  }

  chain output {
    type filter hook output priority 0; policy drop;

    # Allow loopback
    oif lo accept

    # Allow established
    ct state established,related accept

    # Allow HTTPS outbound
    tcp dport 443 ct state new accept

    # Allow DNS
    udp dport 53 ct state new accept

    # Log dropped
    log prefix "nftables-output-dropped: " drop
  }
}

---

Network Segmentation

VLAN Segmentation

Network Architecture:
┌─────────────────────────────────────────┐
│             Internet                     │
└────────────────┬────────────────────────┘
                 │
         ┌───────▼────────┐
         │   Firewall     │
         └───────┬────────┘
                 │
     ┌───────────┴────────────┐
     │  Core Switch (VLANs)   │
     └─────┬──────┬──────┬────┘
           │      │      │
    VLAN 10│ VLAN 20│ VLAN 30
    DMZ    │ App   │ DB
    ───────┴───────┴─────────
    Public │ Internal│ Data
    Web    │ Apps   │ Storage

Segmentation principles:

• DMZ for internet-facing services
• Application tier (internal only)
• Database tier (most restricted)
• Management network (separate)

Kubernetes NetworkPolicy

# Default deny all traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# Allow frontend -> API
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      tier: api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          tier: database
    ports:
    - protocol: TCP
      port: 5432
  # Allow DNS
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53

---
# Allow database -> nowhere (only ingress)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      tier: database
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: api
    ports:
    - protocol: TCP
      port: 5432
  egress: []  # No outbound allowed

Service Mesh (Istio)

# Strict mTLS for all workloads
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

---
# Authorization policy: deny all by default
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  {}

---
# Allow frontend to API
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-allow-frontend
  namespace: production
spec:
  selector:
    matchLabels:
      app: api
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/*"]

---

TLS/mTLS Configuration

NGINX TLS Hardening

# /etc/nginx/conf.d/ssl-hardening.conf

server {
    listen 443 ssl http2;
    server_name example.com;

    # Certificates
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;

    # Protocols: TLS 1.2 and 1.3 only
    ssl_protocols TLSv1.2 TLSv1.3;

    # Strong cipher suites (ordered by preference)
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    ssl_prefer_server_ciphers on;

    # HSTS (force HTTPS for 1 year)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Session cache
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    # DH parameters (generate with: openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096)
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;

    location / {
        proxy_pass http://backend;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

Certificate Generation (Let's Encrypt)

# Install certbot
apt-get install certbot python3-certbot-nginx

# Generate certificate
certbot --nginx -d example.com -d www.example.com

# Auto-renewal (cron job)
0 0 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

mTLS with Client Certificates

server {
    listen 443 ssl http2;
    server_name api.example.com;

    ssl_certificate /etc/nginx/ssl/server.pem;
    ssl_certificate_key /etc/nginx/ssl/server-key.pem;

    # Require client certificate
    ssl_verify_client on;
    ssl_client_certificate /etc/nginx/ssl/ca.pem;
    ssl_verify_depth 2;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

    location / {
        # Pass client certificate info to backend
        proxy_set_header X-Client-Cert $ssl_client_cert;
        proxy_set_header X-Client-Verify $ssl_client_verify;
        proxy_set_header X-Client-DN $ssl_client_s_dn;
        proxy_pass http://backend;
    }
}

---

DNS Security

DNSSEC Configuration

# Install BIND9 with DNSSEC support
apt-get install bind9 bind9utils

# Generate DNSSEC keys
cd /etc/bind/keys
dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com
dnssec-keygen -f KSK -a ECDSAP256SHA256 -n ZONE example.com

# Sign zone
dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) \
  -N INCREMENT -o example.com -t /var/cache/bind/db.example.com

# Update named.conf
zone "example.com" {
    type master;
    file "/var/cache/bind/db.example.com.signed";
    allow-transfer { none; };
};

DNS Filtering (Pi-hole style)

# Block malicious domains
# /etc/dnsmasq.d/blocklist.conf

# Block tracking
address=/doubleclick.net/0.0.0.0
address=/googleadservices.com/0.0.0.0

# Block malware
address=/malware-site.com/0.0.0.0

# Use upstream DNS with DoT (DNS over TLS)
server=1.1.1.1@853#cloudflare-dns.com
server=8.8.8.8@853#dns.google

DNS over HTTPS (DoH) Client

# dnscrypt-proxy.toml
server_names = ['cloudflare', 'google']

[sources]
  [sources.'public-resolvers']
  urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md']
  cache_file = 'public-resolvers.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 72

[static]
  [static.'cloudflare']
  stamp = 'sdns://AgcAAAAAAAAABzEuMS4xLjEgPhoaD2xT8-l6SS1XCEtbmAcFnuBXqxUFh2_YP9o9uDgKZG5zLmNsb3VkZmxhcmUuY29tCi9kbnMtcXVlcnk'

---

Network Monitoring

Enable Flow Logging

AWS VPC Flow Logs:

resource "aws_flow_log" "vpc" {
  vpc_id          = aws_vpc.main.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_logs.arn
  log_destination = aws_cloudwatch_log_group.flow_logs.arn
}

GCP VPC Flow Logs:

resource "google_compute_subnetwork" "main" {
  name          = "main-subnet"
  ip_cidr_range = "10.0.0.0/24"
  network       = google_compute_network.main.id

  log_config {
    aggregation_interval = "INTERVAL_5_SEC"
    flow_sampling        = 1.0
    metadata             = "INCLUDE_ALL_METADATA"
  }
}

Intrusion Detection (Suricata)

# Install Suricata
apt-get install suricata

# Configure /etc/suricata/suricata.yaml
af-packet:
  - interface: eth0
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow

# Update rules
suricata-update

# Start Suricata
systemctl enable suricata
systemctl start suricata

# Monitor alerts
tail -f /var/log/suricata/fast.log

Network Scanning Detection

# Configure fail2ban to block port scans
# /etc/fail2ban/filter.d/portscan.conf

[Definition]
failregex = ^.*kernel:.*IN=.* SRC=<HOST> DST=.* PROTO=(TCP|UDP).*$
ignoreregex =

# /etc/fail2ban/jail.local
[portscan]
enabled = true
filter = portscan
logpath = /var/log/kern.log
maxretry = 5
findtime = 300
bantime = 86400

---

Additional Resources

• NIST Firewall Guide: https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/
• Kubernetes Network Policies: https://kubernetes.io/docs/concepts/services-networking/network-policies/
• Istio Security: https://istio.io/latest/docs/concepts/security/
• DNSSEC Guide: https://www.dnssec.net/