rules-ubuntu

RISK: 'apt-key' is deprecated in Ubuntu 22.04 and removed in 24.04; keys placed in the global trusted keyring can sign packages from ANY repo, breaking the per-repo trust boundary. FIX: write the dearmored key to /etc/apt/keyrings/<name>.gpg and reference it with 'signed-by=/etc/apt/keyrings/<name>.gpg' in the .sources / .list entry.

RISK: An apt source without 'signed-by=' falls back to the global /etc/apt/trusted.gpg* keyrings, so any key on the system can authenticate this repo's packages — defeating per-repo trust. FIX: write 'deb [signed-by=/etc/apt/keyrings/<vendor>.gpg] https://… suite component'.

RISK: World-writable system paths let any local user replace binaries, configs, or scripts that root later executes — a classic local privilege-escalation vector. FIX: grant the minimum needed mode (typically 644 for files, 755 for dirs) and use group ownership instead of world-write.

RISK: Piping a remote script straight into a shell runs unverified, unsigned code as your user (or root) — partial downloads or a compromised host can execute destructive commands. FIX: Download to a file, inspect/checksum it, then run: 'curl -fsSL URL -o setup.sh; less setup.sh; bash setup.sh'.

Disabling AppArmor removes mandatory access control protections that confine processes to their expected behavior. Keep AppArmor enforcing in production.

Disabling the firewall (UFW/iptables) exposes all ports to the network. Ensure firewall rules are preserved and only temporarily bypassed if absolutely necessary.

RISK: Disabling unattended-upgrades stops automatic delivery of Ubuntu security (USN) patches — historically the only reason kernel/openssl/xz CVEs were closed before exploitation in fleet machines. FIX: keep 'APT::Periodic::Unattended-Upgrade "1"' and scope which origins auto-install via 'Unattended-Upgrade::Allowed-Origins' instead of disabling.

RISK: Re-enabling unprivileged user namespaces (or disabling AppArmor's userns restriction added in Ubuntu 23.10/24.04) exposes the kernel to bugs like CVE-2024-1086 (nf_tables LPE, actively exploited in ransomware). FIX: leave the restriction in place; grant only the specific binary that needs it via 'aa-genprof'/profile, or use 'unshare' under a confined profile.

RISK: Mounting /tmp, /home, /var, or /dev/shm without 'nosuid' (and ideally 'noexec','nodev') lets an attacker drop a SUID binary in a writable mount and gain root — a CIS Ubuntu Benchmark hardening control. FIX: add 'nosuid,nodev' (and 'noexec' where feasible) to the mount options.

NOPASSWD in sudoers removes the password requirement for sudo, allowing privilege escalation without authentication. Require passwords for all sudo calls.

RISK: 'nullok' on pam_unix lets accounts with an empty password hash log in with no password — any account whose hash field is blanked becomes a passwordless backdoor. FIX: remove the 'nullok' option; require a password (or key) for every account.

pam_permit.so grants authentication to all users without verification — it bypasses all password checks. Use this only in explicitly isolated environments.

Directly setting or changing the root password is a high-impact operation that can lock out other administrators. Use sudo and document the change.

/etc/shadow contains hashed passwords for all system accounts. Reading this file enables offline password cracking. Access via PAM or getspent() for legitimate use.

RISK: 'rm -rf /' (or with --no-preserve-root) wipes the entire filesystem; an unset variable in a script (e.g. 'rm -rf $UNSET/') turns this into 'rm -rf /'. FIX: target a specific absolute path, quote variables, and use 'set -u' so unset vars abort the script.

Disabling SELinux removes mandatory access control that prevents privilege escalation and confines processes. Set to permissive mode for debugging, not disabled.

SSH password authentication is vulnerable to brute-force attacks. Use key-based authentication: set 'PasswordAuthentication no' and deploy SSH keys.

PermitRootLogin yes allows direct root SSH logins — brute-forceable and leaves no audit trail. Set 'PermitRootLogin no' and use a regular account with sudo.

NOPASSWD in sudoers grants passwordless privilege escalation. Restrict it to specific commands only: 'user ALL=(ALL) NOPASSWD: /usr/bin/specific-cmd'

Setting the SUID/SGID bit allows a program to run with the owner's (often root's) privileges regardless of who executes it — a common privilege escalation vector. Avoid SUID/SGID on custom binaries.

RISK: Setting NoNewPrivileges=false lets the unit (and its children) gain privileges via SUID/file capabilities — needed only for legitimate setuid helpers, otherwise it widens the blast radius of any RCE in the service. FIX: remove the line (default is false but you should explicitly set 'NoNewPrivileges=true' on hardened units).

Systemd service units that run as root and execute scripts from /tmp or download-and-execute patterns are common persistence and privilege escalation vectors.

Editing /etc/sudoers directly can corrupt the file and lock you out. Always use 'visudo' which validates syntax before saving.

World-writable cron files allow any user to modify scheduled jobs, enabling privilege escalation. Cron files should be owned by root with mode 600 or 644.