#
# Common settings for a Debian11 server install with no additional products installed
# >>> Included File: ../custom_includes/server_Debian11
#
# Additional users that can be considered system file owners
ADD_SYSTEM_FILE_OWNER=man
# ADD_SYSTEM_FILE_OWNER=Debian-exim
# On the above..,  I use sendmail, but the debian exim4 package (which is not exim complient)
# is intalled by default on new servers. Note that removing the exim4 package does not
# remove the userid/group created when it was installed (a security issue I would think)
# so you have to do a "userdel Debian-exim" plus a "rm -rf /var/spool/exim4" manually
# after removing the package
#
# Directory ownership overrides as required
ALLOW_OWNER_ROOT=dev:
ALLOW_OWNER_ROOT=proc:
ALLOW_OWNER_ROOT=www-data:
ALLOW_OWNER_ROOT=backup:
ALLOW_OWNER_ROOT=systemd:
ALLOW_OWNER_ROOT=misc:
ALLOW_OWNER_ROOT=games:
ALLOW_OWNER_ROOT=daemon:
ALLOW_OWNER_ROOT=bin:
ALLOW_OWNER_ROOT=sbin:
ALLOW_OWNER_ROOT=mail:
ALLOW_OWNER_ROOT=backups:
ALLOW_OWNER_ROOT=sshd:
ALLOW_OWNER_ROOT=exim4:
ALLOW_OWNER_ROOT=libvirt:
ALLOW_OWNER_ROOT=nfs:
#
# Directory permission overrides for shared system directories
# These may be drwxr-xr-x, drwxr-x--x or drwx--x--x
ALLOW_DIRPERM_SYSTEM=sys:
ALLOW_DIRPERM_SYSTEM=proc:
ALLOW_DIRPERM_SYSTEM=games:
ALLOW_DIRPERM_SYSTEM=man:
ALLOW_DIRPERM_SYSTEM=www-data:
ALLOW_DIRPERM_SYSTEM=backups:
ALLOW_DIRPERM_SYSTEM=systemd:
ALLOW_DIRPERM_SYSTEM=rpcbind:
ALLOW_DIRPERM_SYSTEM=misc:
ALLOW_DIRPERM_SYSTEM=sbin:
ALLOW_DIRPERM_SYSTEM=dev:
ALLOW_DIRPERM_SYSTEM=sshd:
ALLOW_DIRPERM_SYSTEM=tpm:
ALLOW_DIRPERM_SYSTEM=avahi-daemon:
ALLOW_DIRPERM_SYSTEM=speech-dispatcher:
ALLOW_DIRPERM_SYSTEM=colord:
ALLOW_DIRPERM_SYSTEM=gdm3:
ALLOW_DIRPERM_SYSTEM=libvirt:
ALLOW_DIRPERM_SYSTEM=mta-sts:
ALLOW_DIRPERM_SYSTEM=nfs:
#
# Directory permission overrides for shared system directories
# These may be drwxr-xr-x, drwxr-x--x or drwx--x--x
ALLOW_DIRPERM_EXPLICIT=mail drwxrwsrwt:
ALLOW_DIRPERM_EXPLICIT=exim4 drwxr-x---:
ALLOW_DIRPERM_EXPLICIT=sendmail drwxr-s--x:
ALLOW_DIRPERM_EXPLICIT=chrony drwxr-x---:
ALLOW_DIRPERM_EXPLICIT=bin lrwxrwxrwx:
ALLOW_DIRPERM_EXPLICIT=postgresql drwxr-xr-x:
#
# Allow a file of this name to be forced OK under any directory if
# it fails initial default checks.
# A risk, but most Linux distros createi lots of dynamic PCI bus entries
# under the /sys/devices/pciNNNN:NN path as --w--w----. we do not
# want them generating false alerts.
# Risk is minimised be specifying the only permitted value.
FORCE_ANYFILE_OK=remove --w--w----:
FORCE_ANYFILE_OK=rescan --w--w----:
#
# Common network ports used by Debian12 in a default install
# For SSH must let sshd start listening on all ports so use WILD
# reason1: it tries to start beofre network is initialised, so cannot bind to interface;
#          also the same issue with cockpit on debian; if binding to a ip-addr you just
#          cannot access any server after rebooting it; so listen on unsafe 0.0.0.0 is reqd.
# reasonN: and nrpe fails a lot on debian with errors on /var/run during startup, and
#          I don't run puppet everywhere, so cannot recover it
TCP_PORTV4_ALLOWED=:22:ssh:WILD
TCP_PORTV6_ALLOWED=:22:ssh if tcpv6 enabled:WILD
NETWORK_PORT_NOLISTENER_TCPV6_OK=22:ssh tcpv6 may be disabled
TCP_PORTV4_ALLOWED=:9090:Cockpit (service cockpit.socket):WILD
TCP_PORTV6_ALLOWED=:9090:Cockpit (service cockpit.socket):WILD
#
TCP_PORTV4_ALLOWED=:111:portmapper:WILD
TCP_PORTV6_ALLOWED=:111:portmapper:WILD
UDP_PORTV4_ALLOWED=:111:portmapper:WILD
UDP_PORTV6_ALLOWED=:111:portmapper:WILD
# But is not on all Debian servers ???
NETWORK_PORT_NOLISTENER_TCPV4_OK=111:portmapper
NETWORK_PORT_NOLISTENER_TCPV6_OK=111:portmapper
NETWORK_PORT_NOLISTENER_UDPV4_OK=111:portmapper
NETWORK_PORT_NOLISTENER_UDPV6_OK=111:portmapper
## I disable the systemd-resolved.service on all my servers as it
## prevents use of local DNS server if using short (non fqdn) server names
## TCP_PORTV4_ALLOWED=:5355:systemd-resolved
## TCP_PORTV6_ALLOWED=:5355:systemd-resolved
## UDP_PORTV4_ALLOWED=:5355:systemd-resolved
## UDP_PORTV6_ALLOWED=:5355:systemd-resolved
RAW_PORTV6_ALLOWED=:58:NetworkManager
#
# From F32 onward these are started by default by NetworkManager
# Debian12 uses 546 UDP as well as TCP
TCP_PORTV6_ALLOWED=:546:dhcpv6-client
UDP_PORTV6_ALLOWED=:546:dhcpv6-client
UDP_PORTV4_ALLOWED=:547:dhcpv6-server
# However may be manually disabled by the admin by disabling ipv6 completely
# so allow for them not being active.
NETWORK_PORT_NOLISTENER_TCPV6_OK=546:dhcpv6-client
NETWORK_PORT_NOLISTENER_UDPV6_OK=546:dhcpv6-client
NETWORK_PORT_NOLISTENER_UDPV4_OK=547:dhcpv6-server
NETWORK_PORT_NOLISTENER_UDPV6_OK=9090:Cockpit TcpV6 port
#
#
# SUID files on a Debian 12 server install KVM system
#
SUID_ALLOW=/usr/lib/dbus-1.0/dbus-daemon-launch-helper:
SUID_ALLOW=/usr/lib/openssh/ssh-keysign:
SUID_ALLOW=/usr/lib/cockpit/cockpit-session:
SUID_ALLOW=/usr/bin/newgrp:
SUID_ALLOW=/usr/bin/chfn:
SUID_ALLOW=/usr/bin/procmail:
SUID_ALLOW=/usr/bin/ntfs-3g:
SUID_ALLOW=/usr/bin/passwd:
SUID_ALLOW=/usr/bin/gpasswd:
SUID_ALLOW=/usr/bin/pkexec:
SUID_ALLOW=/usr/bin/chsh:
SUID_ALLOW=/usr/bin/sudo:
SUID_ALLOW=/usr/bin/umount:
SUID_ALLOW=/usr/bin/mount:
SUID_ALLOW=/usr/bin/fusermount:
SUID_ALLOW=/usr/bin/fusermount3:
SUID_ALLOW=/usr/bin/su:
SUID_ALLOW=/usr/sbin/pppd:
SUID_ALLOW=/usr/sbin/sensible-mda:
SUID_ALLOW=/usr/lib/x86_64-linux-gnu/utempter/utempter:
SUID_ALLOW=/usr/bin/ssh-agent:
SUID_ALLOW=/usr/bin/chage:
SUID_ALLOW=/usr/bin/lockfile:
SUID_ALLOW=/usr/bin/crontab:
SUID_ALLOW=/usr/bin/expiry:
SUID_ALLOW=/usr/bin/dotlockfile:
SUID_ALLOW=/usr/bin/wall:
SUID_ALLOW=/usr/sbin/unix_chkpwd:
# Below is installed on Debian servers even if selinux is not installed
# locally, used by semanage as by default uses a remote policy server
SUID_ALLOW=/usr/lib/polkit-1/polkit-agent-helper-1:
# Below only if 'mutt' installed, I always do
SUID_ALLOW=/usr/bin/mutt_dotlock:
#
# Force explicit files as OK when checked, full path is needed
# /etc/dumpdates is normally also writeable by group disk
FORCE_PERM_OK=/etc/dumpdates:-rw-rw-r--
FORCE_PERM_OK=/var/log/wtmp:-rw-rw-r--
FORCE_PERM_OK=/var/log/btmp:-rw-rw----
FORCE_PERM_OK=/var/log/lastlog:-rw-rw-r--
#
# Allow a file of this name to be forced OK under any directory if
# it fails initial default checks.
# A risk, but Fedora now generates lots of dynamic PCI bus entries
# under the /sys/devices/pciNNNN:NN path as --w--w----. we do not
# want them generating false alerts.
# Risk is minimised be specifying the only permitted value.
FORCE_ANYFILE_OK=remove --w--w----:
FORCE_ANYFILE_OK=rescan --w--w----:
#
## These userids are permitted to have missing (not physically existing) home directories
HOMEDIR_MISSING_OK=lp:
HOMEDIR_MISSING_OK=news:
HOMEDIR_MISSING_OK=uucp:
HOMEDIR_MISSING_OK=list:
HOMEDIR_MISSING_OK=irc:
#HOMEDIR_MISSING_OK=gnats:   if needed include the gnats file from custom_includes
HOMEDIR_MISSING_OK=nobody:
HOMEDIR_MISSING_OK=_apt:
HOMEDIR_MISSING_OK=messagebus:
HOMEDIR_MISSING_OK=cockpit-ws:
# below only exists if gnats bug reporting system is installed
# Not common across all servers, just most of them
# Moved to gnats
#HOMEDIR_MISSING_OK=gnats:
#
# The below two entries (root and the group %sudo) are added by
# default to /etc/sudoers when Debian is installed.
SUDOERS_ALLOW_ALL_SERVERS=root:
SUDOERS_ALLOW_ALL_COMMANDS=root:
SUDOERS_ALLOW_ALL_SERVERS=%sudo:
SUDOERS_ALLOW_ALL_COMMANDS=%sudo:
# New in V.028
MUST_PATCH_WITHIN_DAYS=20
