sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Tightening Stig hardening

Browse Source
This commit is contained in:
Audiobuzz
2026-06-20 00:05:19 +00:00
parent b9258e7490
commit b67a23e718
8 changed files with 847 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/audit-collector/README.md
+36
View File
@@ -44,6 +44,42 @@ logger -n 127.0.0.1 -P 514 -T -t audispd "test audit record"
ls audit-collector/logs/ # a 127.0.0.1/ dir appears
```
## Serving-host firewall — open 514/tcp (easy to miss)
This container uses **host networking**, so the **serving host's own firewall
governs port 514** — Docker does *not* manage iptables for host-net containers
(the usual "Docker bypasses the host firewall" behaviour only applies to
*published* bridge ports, which insert rules into the `DOCKER` chain ahead of the
host firewall). The symptom when it's closed is deceptive: the container is
healthy, `ss -tlnp` shows `0.0.0.0:514` listening, DNS/DHCP from the same host
work, but booted hosts sit in `SYN-SENT` and rsyslog logs `cannot connect to
audit.fleet.lab:514 ... Connection timed out` (timed out = **dropped**, not
refused). The logs aren't lost — the sender's `action.resumeRetryCount="-1"`
buffers them and drains once the port opens.
Open 514/tcp **scoped to the boot LAN** (don't expose it globally):
```bash
# ufw (Debian/Ubuntu serving host):
sudo ufw allow from 192.168.50.0/24 to any port 514 proto tcp
sudo ufw reload && sudo ufw status numbered
# firewalld (RHEL/Rocky serving host):
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.50.0/24 port port=514 protocol=tcp accept'
sudo firewall-cmd --reload
```
Verify SYNs now complete (SYN → SYN-ACK) and a sender dir appears:
```bash
sudo tcpdump -ni any 'tcp port 514 and host <sender-ip>' # SYN-ACK now returns
ls -R audit-collector/logs/ # <sender-ip>/ appears within ~1 min
```
> If you ever move the collector from host networking to **published ports**
> (`514:514`), this firewall rule stops applying — published Docker ports bypass
> ufw/firewalld and must be controlled via Docker (`DOCKER-USER` chain) instead.
## What's still needed (the sender — in the image)
This container only **receives**. To make hosts actually send, the hardened