Bastion Hardened Debian 13: Hardening extremo con KSPP, Seccomp-BPF y telemetria SIEM

┌─────────────────────────────────────────────────────┐
│              HARDWARE / HIPERVISOR                    │
│  Deshabilitar: clipboard, USB passthrough, audio     │
│  Aplicable a: VMware, Proxmox, Hyper-V, KVM, bare   │
├─────────────────────────────────────────────────────┤
│ CAPA 1: KERNEL (KSPP + lockdown)                    │
│  - lockdown=confidentiality                          │
│  - module.sig_enforce=1, audit=1                     │
│  - init_on_alloc/free, slab_nomerge, pti=on         │
│  - Spectre/MDS/TSX mitigations enforced              │
├─────────────────────────────────────────────────────┤
│ CAPA 2: SYSCTL (60+ parametros)                     │
│  - ptrace_scope=3, kptr_restrict=2                   │
│  - kexec_load_disabled=1, io_uring_disabled=2        │
│  - IPv6 deshabilitado, ICMP bloqueado               │
├─────────────────────────────────────────────────────┤
│ CAPA 3: SECCOMP-BPF (per-service)                   │
│  - SystemCallFilter por servicio via systemd         │
│  - sshd/auditd excluidos (privilege separation)      │
│  - fail2ban, cron, timesyncd: filtrado completo      │
├─────────────────────────────────────────────────────┤
│ CAPA 4: RED (nftables deny-all)                     │
│  - Input: solo SSH desde red gestion                 │
│  - Output: solo DNS + apt + NTP + SIEM              │
│  - Forward: DROP total                               │
│  - Rate-limiting en todas las reglas                 │
├─────────────────────────────────────────────────────┤
│ CAPA 5: FILESYSTEM                                  │
│  - /tmp noexec,nosuid,nodev                          │
│  - /proc hidepid=2                                   │
│  - Modulos kernel blacklisted (USB, BT, wireless)    │
├─────────────────────────────────────────────────────┤
│ CAPA 6: AUDITORIA (auditd inmutable)                │
│  - Reglas MITRE ATT&CK (-e 2 inmutable)             │
│  - AIDE/Wazuh syscheck cada 15 min                  │
│  - Fail2ban + logging centralizado                   │
├─────────────────────────────────────────────────────┤
│ CAPA 7: TELEMETRIA (SIEM + EDR + DFIR)             │
│  - Wazuh Agent (FIM + rootkit + log collection)      │
│  - Velociraptor Client (threat hunting en vivo)      │
│  - Envio a SIEM externo (irrevocable localmente)     │
└─────────────────────────────────────────────────────┘

# Actualizar y limpiar
apt update && apt full-upgrade -y && apt autoremove --purge -y

# Instalar herramientas de hardening
apt install -y \
    apparmor apparmor-utils apparmor-profiles apparmor-profiles-extra \
    libpam-apparmor \
    aide aide-common \
    auditd audispd-plugins \
    fail2ban \
    nftables \
    haveged rng-tools5 \
    lynis \
    unattended-upgrades \
    needrestart \
    debsums \
    systemd-coredump \
    cryptsetup-bin \
    libseccomp-dev libseccomp2 seccomp \
    openssh-server \
    jq curl gnupg2

# Eliminar paquetes innecesarios (minimalismo)
apt purge -y \
    telnet rsh-client xinetd nis tftp \
    avahi-daemon cups 2>/dev/null || true

apt autoremove --purge -y

# Crear grupo y usuario
groupadd bastion-ssh
useradd -m -s /bin/bash -G bastion-ssh,sudo bastion-admin

# Configurar SSH key
mkdir -p /home/bastion-admin/.ssh
chmod 700 /home/bastion-admin/.ssh

# Copiar tu clave publica (desde tu maquina local)
# echo "ssh-ed25519 AAAA..." > /home/bastion-admin/.ssh/authorized_keys
chmod 600 /home/bastion-admin/.ssh/authorized_keys
chown -R bastion-admin:bastion-admin /home/bastion-admin/.ssh

# Bloquear password de root
passwd -l root

# /etc/login.defs - politica de ciclo de vida
PASS_MAX_DAYS   90      # Rotacion cada 90 dias
PASS_MIN_DAYS   7       # Minimo 7 dias entre cambios (evitar bypass de historial)
PASS_WARN_AGE   14      # Aviso 14 dias antes de expiracion
PASS_MIN_LEN    14      # Longitud minima 14 caracteres

# /etc/security/pwquality.conf - complejidad
minlen = 14             # Longitud minima
dcredit = -1            # Al menos 1 digito
ucredit = -1            # Al menos 1 mayuscula
ocredit = -1            # Al menos 1 caracter especial
lcredit = -1            # Al menos 1 minuscula
maxrepeat = 3           # Maximo 3 caracteres consecutivos iguales
maxclassrepeat = 4      # Maximo 4 consecutivos de misma clase
usercheck = 1           # No puede contener el username
dictcheck = 1           # Verificar contra diccionario
minclass = 4            # Minimo 4 clases de caracteres
difok = 8               # Minimo 8 caracteres diferentes al anterior
palindrome = 1          # Rechazar palindromos

# PAM: historial + bloqueo de cuentas
# /etc/pam.d/common-password (añadir remember=12)
password requisite pam_pwquality.so retry=3
password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=12

# Bloqueo tras intentos fallidos (pam_faillock)
# /etc/pam.d/common-auth
auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900 fail_interval=900
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900 fail_interval=900
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900 fail_interval=900

# /etc/sudoers.d/00-security
Defaults    requiretty              # Solo desde terminal real (no scripts remotos)
Defaults    use_pty                 # Forzar pseudo-terminal
Defaults    logfile="/var/log/sudo.log"
Defaults    log_input, log_output   # Grabar TODA la sesion sudo
Defaults    iolog_dir="/var/log/sudo-io"
Defaults    passwd_timeout=1        # 1 minuto para introducir password
Defaults    timestamp_timeout=5     # Cache de 5 min (no indefinido)
Defaults    passwd_tries=3          # Max 3 intentos
Defaults    env_reset               # Limpiar variables de entorno
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults    !visiblepw              # No mostrar password en pantalla
Defaults    always_set_home         # Siempre setear HOME
Defaults    log_denied              # Logear intentos denegados

# /etc/sudoers.d/bastion - permisos granulares (principio de minimo privilegio)
bastion-admin ALL=(root) NOPASSWD: /usr/local/bin/security-test-suite.sh
bastion-admin ALL=(root) NOPASSWD: /usr/local/bin/bastion-emergency.sh audit-mode
bastion-admin ALL=(root) NOPASSWD: /usr/bin/journalctl
bastion-admin ALL=(root) NOPASSWD: /usr/bin/systemctl status *
bastion-admin ALL=(root) NOPASSWD: /usr/sbin/aide --check
bastion-admin ALL=(root) NOPASSWD: /usr/bin/lynis audit system *
bastion-admin ALL=(root) NOPASSWD: /usr/bin/aa-status

# Instalar
apt install -y libpam-google-authenticator

# Configurar para SSH: publickey + TOTP obligatorio
# /etc/ssh/sshd_config.d/hardening.conf (añadir)
AuthenticationMethods publickey,keyboard-interactive

# Configurar PAM para SSH
# /etc/pam.d/sshd (añadir al final)
auth required pam_google_authenticator.so nullok

# Habilitar challenge-response en SSH
# /etc/ssh/sshd_config.d/hardening.conf (añadir)
KbdInteractiveAuthentication yes

# El usuario ejecuta (NO root):
google-authenticator -t -d -f -r 3 -R 30 -w 3 -Q UTF8

# Esto genera:
# - Un QR code para escanear con Google Authenticator/Authy/FreeOTP
# - Codigos de emergencia (guardar offline)
# - Fichero ~/.google_authenticator

# Opciones recomendadas:
# -t  = Time-based (TOTP)
# -d  = No permitir reutilizar token
# -f  = Forzar escritura del fichero
# -r 3 -R 30  = Rate limiting: 3 intentos cada 30 seg
# -w 3  = Window de 3 tokens (90 seg de margen)

# Instalar cliente FreeIPA
apt install -y freeipa-client

# Enrollar el bastion en el dominio
ipa-client-install \
  --server=ipa.example.com \
  --domain=example.com \
  --realm=EXAMPLE.COM \
  --mkhomedir \
  --ssh-trust-dns \
  --force-ntpd

# Configurar SSSD para controlar acceso por grupo
cat >> /etc/sssd/sssd.conf << 'EOF'
[domain/example.com]
access_provider = ipa
ipa_hbac_refresh = 60

# Solo permitir grupo especifico
simple_allow_groups = bastion-admins, security-team
EOF

# HBAC (Host-Based Access Control) en FreeIPA
# Crear regla que solo permita acceso al bastion desde el grupo autorizado
# ipa hbacrule-add bastion-access
# ipa hbacrule-add-host bastion-access --hosts=bastion.example.com
# ipa hbacrule-add-user bastion-access --groups=bastion-admins

# Sudo centralizado via FreeIPA
# ipa sudorule-add bastion-sudo
# ipa sudorule-add-host bastion-sudo --hosts=bastion.example.com
# ipa sudorule-add-user bastion-sudo --groups=bastion-admins
# ipa sudorule-add-runasuser bastion-sudo --users=root
# ipa sudorule-add-allow-command bastion-sudo --sudocmds="/usr/bin/journalctl"

# Para entornos Microsoft, integrar via SSSD + Kerberos
apt install -y sssd sssd-tools sssd-krb5 krb5-user realmd adcli

# Unir al dominio
realm join --user=admin EXAMPLE.ONMICROSOFT.COM

# /etc/sssd/sssd.conf
[sssd]
domains = example.onmicrosoft.com
services = nss, pam, ssh, sudo

[domain/example.onmicrosoft.com]
id_provider = ad
auth_provider = ad
access_provider = ad
ad_access_filter = memberOf=CN=Bastion-Admins,OU=Security,DC=example,DC=com
sudo_provider = ad
ldap_sudo_search_base = OU=Sudoers,DC=example,DC=com

# MFA via Entra ID Conditional Access
# Se gestiona desde Azure Portal:
# - Conditional Access Policy → Require MFA for SSH access
# - Device compliance required
# - Location-based restrictions

# /etc/sssd/sssd.conf para LDAP generico
[domain/ldap.example.com]
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://ldap.example.com
ldap_search_base = dc=example,dc=com
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/ca-ldap.pem
access_provider = simple
simple_allow_groups = bastion-ssh

# En sshd_config:
TrustedUserCAKeys /etc/ssh/ca-user.pub    # CA que firma certificados de usuario
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u

# El usuario obtiene un certificado temporal (via Vault, Teleport, etc.)
# $ vault write ssh/sign/bastion public_key=@~/.ssh/id_ed25519.pub
# Genera un certificado valido por 8 horas con principals especificos

# Ventajas:
# - No hay authorized_keys que gestionar
# - Certificados expiran automaticamente
# - Revocacion inmediata via CRL
# - Auditoria de quien firmo que y cuando

GRUB_CMDLINE_LINUX_DEFAULT="quiet \
  slab_nomerge \
  slub_debug=FZP \
  page_alloc.shuffle=1 \
  page_poison=1 \
  vsyscall=none \
  init_on_alloc=1 \
  init_on_free=1 \
  pti=on \
  randomize_kstack_offset=on \
  spectre_v2=on \
  spec_store_bypass_disable=seccomp \
  l1tf=full,force \
  mds=full,nosmt \
  tsx=off \
  tsx_async_abort=full,nosmt \
  mmio_stale_data=full,nosmt \
  retbleed=auto,nosmt \
  kvm.nx_huge_pages=force \
  lockdown=confidentiality \
  module.sig_enforce=1 \
  oops=panic \
  debugfs=off \
  lsm=landlock,lockdown,yama,integrity,apparmor,bpf \
  extra_latent_entropy \
  iommu=force \
  intel_iommu=on \
  efi=disable_early_pci_dma \
  audit=1 \
  audit_backlog_limit=8192"

# Proteccion de informacion del kernel
kernel.kptr_restrict = 2        # Ocultar punteros kernel completamente
kernel.dmesg_restrict = 1       # Solo root puede leer dmesg
kernel.yama.ptrace_scope = 3    # No ptrace NUNCA (ni root)
kernel.kexec_load_disabled = 1  # Imposible cargar kernel alternativo
kernel.io_uring_disabled = 2    # Deshabilitar io_uring (superficie de ataque enorme)
kernel.sysrq = 0                # Sin magic sysrq

# ASLR maximo
vm.mmap_rnd_bits = 32           # 32 bits de entropia en mmap
vm.mmap_min_addr = 65536        # Prevenir null-pointer exploits

# Core dumps eliminados
fs.suid_dumpable = 0
kernel.core_pattern = |/bin/false

# Red: todo bloqueado por defecto
net.ipv4.icmp_echo_ignore_all = 1     # No responder pings
net.ipv4.tcp_timestamps = 0            # Sin timestamps (fingerprinting)
net.ipv4.tcp_sack = 0                  # Deshabilitar SACK (CVE-2019-11477)
net.ipv6.conf.all.disable_ipv6 = 1    # IPv6 innecesario = deshabilitado

# TTY hardening
dev.tty.ldisc_autoload = 0     # No autocargar line disciplines
user.max_user_namespaces = 0   # Sin user namespaces (escape de containers)

#!/bin/bash
# seccomp-profile-generator.sh <servicio> <nivel>
# Niveles: minimal | standard | network | permissive

# STDIO: operaciones basicas de I/O y memoria
STDIO_SYSCALLS=(
    "brk" "mmap" "mprotect" "munmap" "mremap" "madvise"
    "clone" "exit" "exit_group" "getpid" "gettid"
    "rt_sigaction" "rt_sigprocmask" "rt_sigreturn"
    "futex" "nanosleep" "clock_gettime"
    "close" "read" "write" "lseek" "fstat"
    "arch_prctl" "prctl" "getrandom"
)

# RPATH: lectura de filesystem
RPATH_SYSCALLS=(
    "openat" "access" "faccessat2" "getcwd"
    "readlink" "stat" "getdents64"
)

# INET: operaciones de red
INET_SYSCALLS=(
    "socket" "bind" "connect" "listen" "accept4"
    "sendto" "recvfrom" "epoll_create1" "epoll_ctl" "epoll_wait"
)

# SIEMPRE DENEGADAS (KILL inmediato)
ALWAYS_DENY=(
    "kexec_load" "init_module" "finit_module" "delete_module"
    "bpf" "perf_event_open" "userfaultfd" "ptrace"
    "mount" "umount2" "pivot_root" "chroot"
    "io_uring_setup" "io_uring_enter" "io_uring_register"
)

# /etc/systemd/system/fail2ban.service.d/hardening.conf
# Aplicar tambien a: cron, systemd-timesyncd, y otros servicios no-privilegiados
[Service]
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@mount @swap @reboot @raw-io @debug @obsolete
SystemCallFilter=~io_uring_setup io_uring_enter io_uring_register
SystemCallFilter=~kexec_load kexec_file_load
SystemCallErrorNumber=EPERM
NoNewPrivileges=yes
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
MemoryDenyWriteExecute=true
RestrictNamespaces=true
LockPersonality=true
ProtectClock=true
ProtectHostname=true

# /etc/systemd/system/ssh.service.d/hardening.conf
[Service]
ProtectHome=read-only
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_INET AF_UNIX
NoNewPrivileges=no
LockPersonality=true
ProtectClock=true
ProtectHostname=true
SystemCallArchitectures=native

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iif "lo" accept
        ct state established,related accept
        ct state invalid drop

        # Solo SSH desde red de gestion, rate-limited
        tcp dport 22 ip saddr 192.168.1.0/24 \
            ct state new limit rate 10/minute burst 20 packets accept

        # Log + drop todo lo demas
        limit rate 10/minute log prefix "NFT-DROP: " level warn
        counter drop
    }

    chain output {
        type filter hook output priority 0; policy drop;

        oif "lo" accept
        ct state established,related accept

        # Solo DNS, apt y NTP permitidos
        tcp dport 53 accept
        udp dport 53 accept
        tcp dport { 80, 443 } accept
        udp dport 123 accept

        # Todo lo demas logueado y dropeado
        limit rate 5/minute log prefix "NFT-OUT-DROP: " level warn
        counter drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
        counter drop
    }
}

# /etc/audit/rules.d/bastion.rules
-D
-b 8192
-f 2

## CREDENTIAL ACCESS (T1003)
-w /etc/shadow -p wa -k T1003_credential_access
-w /etc/gshadow -p wa -k T1003_credential_access
-w /etc/passwd -p wa -k T1003_credential_access

## PERSISTENCE (T1547/T1053/T1543)
-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k T1547_kernel_module
-w /etc/crontab -p wa -k T1053_cron_persistence
-w /etc/cron.d/ -p wa -k T1053_cron_persistence
-w /var/spool/cron/ -p wa -k T1053_cron_persistence
-w /etc/systemd/system/ -p wa -k T1543_systemd_persistence
-w /usr/lib/systemd/system/ -p wa -k T1543_systemd_persistence

## PRIVILEGE ESCALATION (T1548)
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k T1548_privilege_change
-w /etc/sudoers -p wa -k T1548_sudo_modify
-w /etc/sudoers.d/ -p wa -k T1548_sudo_modify
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid!=0 -F auid!=-1 -k T1548_priv_exec

## DEFENSE EVASION (T1562/T1070)
-w /etc/apparmor.d/ -p wa -k T1562_modify_apparmor
-w /usr/sbin/auditctl -p x -k T1562_tamper_audit
-w /etc/audit/ -p wa -k T1562_tamper_audit
-w /var/log/ -p wa -k T1070_log_tampering

## LATERAL MOVEMENT (T1021)
-w /etc/ssh/sshd_config -p wa -k T1021_ssh_config
-w /etc/ssh/sshd_config.d/ -p wa -k T1021_ssh_config

## EXECUTION (T1059)
-a always,exit -F arch=b64 -S execve -k T1059_execution

## REGLAS INMUTABLES tras boot (requiere reinicio para modificar)
-e 2

# Timer: cada 15 min con jitter de 2 min
[Timer]
OnBootSec=10min
OnUnitActiveSec=15min
RandomizedDelaySec=2min
Persistent=true

SecurityFiles = p+u+g+s+b+m+c+sha256+sha512
/etc/apparmor.d SecurityFiles
/etc/seccomp SecurityFiles
/etc/ssh/sshd_config SecurityFiles
/boot Binlib

┌─────────────────────────┐
│       BASTION           │
│  auditd → audisp-remote ─────┐
│  Wazuh Agent ─────────────────┼──→ SIEM (Wazuh/Elastic/Splunk)
│  Velociraptor Client ─────────┼──→ Velociraptor Server (DFIR)
│  journald → remote ───────────┘
└─────────────────────────┘

# Instalar Wazuh Agent
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --dearmor -o /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
apt update && apt install -y wazuh-agent

# Configurar manager
cat > /var/ossec/etc/ossec.conf << 'EOF'
<ossec_config>
  <client>
    <server>
      <address>WAZUH_MANAGER_IP</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <enrollment>
      <enabled>yes</enabled>
      <agent_name>bastion-prod</agent_name>
      <groups>linux,hardened,bastion</groups>
    </enrollment>
  </client>

  <!-- Monitorizar logs de auditd -->
  <localfile>
    <log_format>audit</log_format>
    <location>/var/log/audit/audit.log</location>
  </localfile>

  <!-- Integridad de ficheros criticos (syscheck) -->
  <syscheck>
    <frequency>900</frequency>
    <directories check_all="yes" realtime="yes">/etc/ssh,/etc/apparmor.d,/etc/audit,/etc/nftables.conf,/etc/sysctl.d</directories>
    <directories check_all="yes">/boot,/usr/sbin/sshd,/usr/sbin/auditd</directories>
  </syscheck>

  <!-- Deteccion de rootkits -->
  <rootcheck>
    <frequency>3600</frequency>
  </rootcheck>
</ossec_config>
EOF

systemctl enable wazuh-agent
systemctl start wazuh-agent

# Descargar e instalar Elastic Agent
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.x-linux-x86_64.tar.gz
tar xzf elastic-agent-*.tar.gz
cd elastic-agent-*

# Enrollar con Fleet Server
./elastic-agent install \
  --url=https://FLEET_SERVER:8220 \
  --enrollment-token=TOKEN \
  --insecure

# Instalar forwarder
dpkg -i splunkforwarder-*.deb

# Configurar outputs
cat > /opt/splunkforwarder/etc/system/local/outputs.conf << 'EOF'
[tcpout]
defaultGroup = splunk_indexers
[tcpout:splunk_indexers]
server = SPLUNK_INDEXER:9997
sslCertPath = /opt/splunkforwarder/etc/certs/server.pem
sslPassword = ********
sslVerifyServerCert = true
EOF

# Monitorizar audit log
cat > /opt/splunkforwarder/etc/system/local/inputs.conf << 'EOF'
[monitor:///var/log/audit/audit.log]
sourcetype = linux:audit
index = security

[monitor:///var/log/auth.log]
sourcetype = linux_secure
index = security
EOF

# audisp-remote para envio de audit logs via syslog
cat > /etc/audit/plugins.d/syslog.conf << 'EOF'
active = yes
direction = out
path = /sbin/audisp-syslog
type = always
args = LOG_LOCAL6
format = string
EOF

# rsyslog para enviar a QRadar
cat > /etc/rsyslog.d/qradar.conf << 'EOF'
local6.* @@QRADAR_IP:514;RSYSLOG_SyslogProtocol23Format
EOF

systemctl restart rsyslog
systemctl restart auditd

# Instalar Velociraptor client
curl -L -o /usr/local/bin/velociraptor \
  https://github.com/Velocidex/velociraptor/releases/latest/download/velociraptor-linux-amd64
chmod +x /usr/local/bin/velociraptor

# Generar config de cliente (desde el server)
# velociraptor config client > client.config.yaml

# Instalar como servicio
cat > /etc/systemd/system/velociraptor-client.service << 'EOF'
[Unit]
Description=Velociraptor Client
After=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/velociraptor client -config /etc/velociraptor/client.config.yaml
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

systemctl enable velociraptor-client
systemctl start velociraptor-client

-- Verificar que kernel params KSPP estan activos
SELECT * FROM proc_cmdline() WHERE Key =~ "lockdown|pti|slab"

-- Buscar procesos sin Seccomp
SELECT Pid, Name, Cmdline FROM pslist()
WHERE NOT SeccompMode

-- Verificar integridad de ficheros criticos
SELECT FullPath, hash(path=FullPath, hashselect="SHA256") as Hash
FROM glob(globs="/etc/ssh/**")

-- Detectar modulos kernel cargados (deberian ser minimos)
SELECT * FROM modules()

# Añadir al chain output para permitir envio a SIEM
# Wazuh
tcp dport 1514 ip daddr WAZUH_MANAGER_IP accept
# Elastic
tcp dport 8220 ip daddr FLEET_SERVER_IP accept
# Splunk
tcp dport 9997 ip daddr SPLUNK_INDEXER_IP accept
# Velociraptor
tcp dport 8000 ip daddr VELOCIRAPTOR_SERVER_IP accept
# Syslog (QRadar)
tcp dport 514 ip daddr QRADAR_IP accept

# /etc/modprobe.d/bastion-blacklist.conf

# Almacenamiento USB (vector de exfiltracion)
blacklist usb-storage
install usb-storage /bin/false

# Protocolos con historico de vulnerabilidades
blacklist dccp       # CVE-2017-6074
blacklist sctp       # Multiples CVEs
blacklist rds        # CVE-2010-3904
blacklist tipc       # CVE-2022-0435

# DMA attacks
blacklist firewire-core
blacklist thunderbolt
install thunderbolt /bin/false

# Wireless/Bluetooth (innecesario en servidor)
blacklist cfg80211
blacklist bluetooth

# /etc/ssh/sshd_config.d/hardening.conf

# Acceso restringido
Port 22
AddressFamily inet
ListenAddress 192.168.1.200
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
MaxAuthTries 3
MaxSessions 2
LoginGraceTime 30

# Key exchange: sntrup761 es hibrido post-cuantico + X25519
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256

# Solo cifrados AEAD
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com

# MACs Encrypt-then-MAC
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Host keys (mantener RSA para compatibilidad con clientes legacy)
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256

# Zero forwarding
AllowTcpForwarding no
AllowAgentForwarding no
AllowStreamLocalForwarding no
X11Forwarding no
PermitTunnel no
GatewayPorts no
PermitUserEnvironment no

# Timeouts
ClientAliveInterval 300
ClientAliveCountMax 2

# Logging verbose para correlacion con auditd
LogLevel VERBOSE
Banner /etc/issue.net

$ sudo /usr/local/bin/security-test-suite.sh

============================================================
 BASTION SECURITY TEST SUITE
============================================================

[1/12] Parametros de kernel KSPP
  ✓ slab_nomerge
  ✓ init_on_alloc=1
  ✓ pti=on
  ✓ lockdown=confidentiality
  ...

[4/12] Seccomp-BPF en servicios
  ✓ ssh: SystemCallFilter activo
  ✓ auditd: drop-in de hardening presente
  ✓ Perfiles Seccomp generados: 3

[5/12] Firewall nftables
  ✓ nftables activo
  ✓ Politica deny-all (input + forward)

============================================================
 RESULTADOS
  Passed:   42 / 45
  Warnings: 3 / 45
  Failed:   0 / 45

  ESTADO: BASTION OPERATIVO
============================================================

# Modo auditoria: AppArmor complain + Seccomp log (sin bloquear)
sudo /usr/local/bin/bastion-emergency.sh audit-mode

# Monitorizar que se habria bloqueado
journalctl -f | grep -i 'apparmor\|seccomp\|denied'

# Restaurar hardening completo
sudo /usr/local/bin/bastion-emergency.sh restore-hardening

Hardening index : 79 [###############     ]
Tests performed : 256
Warnings        : 1 (AIDE database no inicializada aun)
Suggestions     : 26