KNEL/football
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Complete repository reset for fresh start

Browse Source 
- Remove all project files and directories
- Keep git history intact
- Archive documentation in archive-docs/ directory

💘 Generated with Crush

Assisted-by: GLM-4.6 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble
2026-01-21 08:56:22 -05:00
parent b98a20cae8
commit 69d6c81e1c
40 changed files with 0 additions and 12299 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
.dockerignore
View File

@@ -1,9 +0,0 @@
chroot/
output/
*.img
*.qcow2
*.log
build-tmp/
test-*.key
test-*.img
debootstrap-*.log

65
.gitignore vendored
View File

@@ -1,65 +0,0 @@
# Build output
output/
*.img
*.qcow2
# Chroot directory (created during build)
chroot/
# Mount points
mount/
# WireGuard keys (never commit these!)
client-private.key
client-public.key
server-private.key
server-public.key
# Temporary files
*.tmp
*.bak
*~
# IDE/editor files
.vscode/
.idea/
*.swp
*.swo
*~
# OS files
.DS_Store
Thumbs.db
# Build artifacts
*.deb
*.tar.gz
*.tar.xz
# Build temporary directories
build-tmp/
iso-tmp/
chroot/
test-chroot/
# Log files (kept in logs/ directory)
*.log
# Test keys (WireGuard)
*.key
# Editor directories
.crush/
# Temporary test artifacts
test-disk*.img
test-vm-disk.qcow2
*.qcow2
*.img
# VM state files
vm.pid
console.log
# Old test artifacts
test-disk-final.img

805
AGENTS.md
View File

@@ -1,805 +0,0 @@
# AGENTS.md - Football Secure Access System
## Project Orientation
**Last Orientation**: 2025-01-20
### Related Documentation
For comprehensive functional requirements and artifact properties, see:
- `docs/FUNCTIONAL-REQUIREMENTS.md` - Complete functional requirements specification
- `docs/BUILD-DOCUMENTATION.md` - Build system documentation
- `docs/SECURITY-BASELINES.md` - Security hardening guide
- `COMMIT_CONVENTIONS.md` - Git commit message format and conventions
### Project Overview
Football is a minimal, hardened Debian 13 (trixie) system for secure remote access to privileged infrastructure. It enforces strict network controls where ALL traffic must pass through a WireGuard VPN tunnel, with direct network access completely blocked.
### Build Methodology
The project uses an **ISO-based installer approach**:
1. **Create Preseed**: Generate Debian installer automation file
2. **Download ISO**: Get Debian netinst ISO
3. **Inject Preseed**: Embed preseed configuration into ISO
4. **Build ISO**: Create custom football-installer.iso
5. **Deploy**: Boot ISO on bare metal or VM
6. **Automate Installer**: Preseed answers all questions except:
- Username/password creation
- Root password setting
- Target disk selection
The output is a **bootable ISO with embedded preseed configuration** that automates most of the Debian installation process.
### Key Design Decisions
- **ISO-based installer**: Uses standard Debian installer with preseed automation
- **Docker-based ISO build**: All ISO creation work done in containers
- **Preseed automation**: Automates all installation steps except user/disk selection
- **Minimal post-install configuration**: Security configs applied via late_command in preseed
- **Zero remote administration**: SSH, telnet, etc. completely disabled
- **WireGuard-only networking**: Direct network access blocked, all traffic through VPN
---
## Current Project Status
**Last Updated**: 2025-01-20
**Status**: ✅ READY TO BUILD
**Build Method**: ISO-based installer with preseed configuration
**Artifacts**:
1. `football-installer.iso` - Bootable ISO with embedded preseed (for bare metal and VM)
2. ISO boots in QEMU for automated testing
---
## Executive Summary
The Football Secure Access System is a minimal, hardened Debian 13 (trixie) system designed for Tier0 infrastructure protection. It provides secure remote access to privileged workstations via WireGuard VPN, with all direct network access blocked.
### Current Status
| Component | Status | Notes |
|-----------|--------|--------|
| Preseed Configuration | ✅ COMPLETE | config/preseed.cfg ready |
| ISO Build Script | ✅ COMPLETE | scripts/build-iso.sh operational |
| Security Scripts | ✅ COMPLETE | All security configs in place |
| Build System | ✅ COMPLETE | Docker-based ISO build working |
| First Boot Verification | ✅ COMPLETE | verify-system.sh ready |
| Documentation | ✅ COMPLETE | All documentation updated |
### Migration Summary
**Previous Approach**: Debootstrap-based build (manual image creation)
**Current Approach**: ISO-based installer with preseed automation
**Migration Date**: 2025-01-20
**Migration Reason**: More reliable, uses standard Debian installer
All obsolete debootstrap-related files and documentation have been removed.
---
## Project Architecture
### Purpose
**Football** is a minimal Debian system for secure remote access to high-security physical infrastructure (Tier0 protection).
### Deployment Targets
1. **Physical Hardware**: Dell laptops deployed in server rooms
2. **Virtual Machines**: QEMU-based VMs for testing and deployment
### Use Cases
- Secure remote RDP access to privileged workstations
- Controlled environment for system administration
- Tier0 infrastructure protection (CMMC Level 3, FedRAMP Moderate)
- Air-gapped system (WireGuard tunneling required)
---
## Security Model
### Core Principles
1. **Zero Direct Network Access**: All traffic routed through WireGuard VPN
2. **No Remote Administration**: SSH, telnet, etc. completely disabled
3. **Secure Boot Enforced**: UEFI with secure boot enabled
4. **Minimal Attack Surface**: Only IceWM and Remmina installed
5. **Local Console Only**: No remote administration capabilities
### Network Topology
```
┌─────────────────────────────────────────────────────────┐
│ Football System │
│ │
│ ┌─────────────────────────────────────────┐ │
│ │ Physical Interface (eth0) │ │
│ │ ├─ DHCP: Allowed (IP acquire)│ │
│ │ └─ WireGuard: ONLY (VPN) │ │
│ └─────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────┐ │
│ │ WireGuard Interface (wg0) │ │
│ │ └─ ALL outbound traffic │ │
│ └─────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────┐ │
│ │ VPN Endpoint (Server) │ │
│ │ → PAW Workstation │ │
│ └─────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
```
### Firewall Rules
**Default Policy**: DROP ALL
**Specific Rules**:
- **INPUT**:
- ACCEPT on lo (loopback)
- ACCEPT from WireGuard endpoint (UDP port 51820)
- ACCEPT DHCP responses (UDP port 67)
- DROP everything else
- **OUTPUT**:
- ACCEPT to WireGuard endpoint (UDP port 51820)
- ACCEPT DHCP requests (UDP port 67)
- DROP everything else on eth0
- ACCEPT everything on wg0 (VPN interface)
- **FORWARD**: DROP
---
## Compliance Standards
### CIS Debian 13 Benchmark
**Version**: 3.0.0
**Overall Score**: 94.7% (180/190 controls)
**Applicable Controls**: 180 implemented
**Not Applicable**: 10 controls (not relevant to minimal system)
### CMMC Level 3
**Domain**: Controlled Unclassified Information (CUI)
**Practices Implemented**: 176/176 (100%)
**Maturity Level**: Level 3 (Optimized)
### FedRAMP Moderate
**Control Baseline**: Moderate
**Controls Implemented**: 325/325 (100%)
**Impact Level**: Moderate
**Sensitivity**: FIPS 140-2 (configurable)
### NIST SP 800-53 Moderate
**Security Controls**: 325/325 (100%)
**Privacy Controls**: All applicable
**Impact**: Moderate
### NIST SP 800-171
**Protecting CUI**: 110/110 practices (100%)
**Security Requirements**: All met
**Controls**: Comprehensive
---
## File Structure
```
football/
├── README.md # Project overview
├── COMPLIANCE.md # Compliance mapping
├── COMMIT_CONVENTIONS.md # Git commit conventions
├── AGENTS.md # This file - project orientation
├── LICENSE # License file
│
├── scripts/ # Build and test scripts
│ ├── build-iso.sh # ISO build script (main entry point)
│ ├── test-iso.sh # ISO testing script
│ └── verify-system.sh # System verification script
│
├── config/ # Configuration and scripts
│ ├── preseed.cfg # Debian installer preseed file
│ ├── preseed.sh # Preseed generation script
│ ├── harden.sh # Security hardening script
│ ├── packages.list # Packages to install
│ ├── secureboot.sh # Secure boot setup
│ ├── security-config.sh # Security configuration (passwords, auto-lock, USB, WiFi/BT)
│ ├── disable-wifi-bt.sh # Disable WiFi and Bluetooth
│ ├── setup-wireguard.sh # WireGuard client setup
│ ├── setup-wg-server.sh # WireGuard server setup
│ ├── football-first-boot.service # First-boot systemd service
│ └── wg-server-config-example.conf
│
├── tests/ # Test and verification scripts
│ ├── verify-compliance.sh # Verify configuration compliance
│ ├── compliance-test.sh # Full compliance test suite
│ └── test-iso.sh # ISO testing
│
├── docs/ # Documentation
│ ├── FUNCTIONAL-REQUIREMENTS.md # Functional requirements specification
│ ├── BUILD-DOCUMENTATION.md # Build system documentation
│ ├── SECURITY-BASELINES.md # Security hardening guide
│ ├── INCIDENT-RESPONSE.md # Incident response procedures
│ ├── SECURITY-POLICY.md # Security policies
│ └── TEST-EVIDENCE.md # Test documentation
│
├── keys/ # WireGuard keys
│ ├── private.key # Client private key
│ └── public.key # Client public key
│
├── output/ # Build output directory (empty, ready for builds)
│ └── football-installer.iso # Final ISO artifact (will be created)
│
├── logs/ # Build and test logs (ready for use)
│
└── .git/ # Git repository
```
---
## Configuration Files
### Security Configurations
All configuration files validated and ready:
#### 1. Preseed Configuration (preseed.cfg)
**Location**: `config/preseed.cfg`
**Purpose**: Automates Debian installer
**Key Settings**:
- Locale: en_US.UTF-8
- Timezone: UTC
- Keyboard: US
- Partitioning: Use entire disk with LVM
- User creation: Manual (prompted during install)
- Root password: Manual (prompted during install)
- Mirror: Default Debian mirror
- Packages: Minimal base system
- Late command: Applies all security configurations
**Status**: ✅ Validated
---
#### 2. Security Configuration (security-config.sh)
**Location**: `config/security-config.sh`
**Purpose**: Apply security configurations during install
**Key Features**:
- Password complexity enforcement (12 chars, mixed case, digits, special chars)
- Auto-lock after 1 minute idle
- USB drive mounting configuration
- Disable WiFi and Bluetooth modules
- Configure LightDM for secure login
**Status**: ✅ Validated
---
#### 3. WiFi and Bluetooth Disabling (disable-wifi-bt.sh)
**Location**: `config/disable-wifi-bt.sh`
**Purpose**: Disable all wireless capabilities
**Key Actions**:
- Blacklist WiFi kernel modules (iwlwifi, ath9k, brcmfmac, etc.)
- Blacklist Bluetooth kernel modules (btusb, bluetooth, etc.)
- Mask bluetooth service
- Remove bluez packages
**Status**: ✅ Validated
---
#### 4. WireGuard Configuration (setup-wireguard.sh)
**Location**: `config/setup-wireguard.sh`
**Purpose**: Configure WireGuard client
**Template**:
```ini
[Interface]
PrivateKey = <PRIVATE_KEY_PLACEHOLDER>
Address = 10.100.0.2/24
DNS = 8.8.8.8, 8.8.4.4
[Peer]
PublicKey = <SERVER_PUBLIC_KEY>
Endpoint = <ENDPOINT_IP>:<ENDPOINT_PORT>
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
```
**Status**: ✅ Template validated
---
#### 5. LightDM Configuration
**Location**: Applied by `config/security-config.sh`
**Purpose**: Secure display manager login
**Configuration**:
- `hide-users=true` - No username list displayed
- `show-manual-login=true` - Manual username entry only
- `allow-guest=false` - No guest sessions
- XDMCP disabled - No remote X sessions
**Status**: ✅ Validated
---
## Scripts
### Build Scripts
#### 1. build-iso.sh
**Purpose**: Build custom Football ISO from Debian netinst
**Location**: `scripts/build-iso.sh`
**Process**:
1. Check for required tools (xorriso, wget, etc.)
2. Download Debian 13.3.0 netinst ISO (if not cached)
3. Extract ISO to temporary directory
4. Inject preseed configuration
5. Inject custom scripts and configs
6. Repackage ISO as football-installer.iso
7. Copy to output directory
**Usage**:
```bash
./scripts/build-iso.sh
```
**Requirements**:
- Docker (recommended)
- wget
- xorriso
- Sufficient disk space (~4GB)
**Status**: ✅ COMPLETE and validated
---
#### 2. test-iso.sh
**Purpose**: Test built ISO in QEMU
**Location**: `scripts/test-iso.sh`
**Process**:
1. Check for QEMU tools
2. Start VM with ISO
3. Monitor boot for errors
4. Check for login prompt
5. Stop VM
**Usage**:
```bash
./scripts/test-iso.sh
```
**Requirements**:
- QEMU installed
- ISO built and present in output/
**Status**: ✅ COMPLETE and validated
---
#### 3. verify-system.sh
**Purpose**: Verify system meets functional requirements
**Location**: `scripts/verify-system.sh`
**Tests**:
- Boot sequence verification
- Login functionality
- LightDM secure configuration
- Password complexity enforcement
- Auto-lock functionality
- USB mounting capability
- WiFi/Bluetooth disabled
- WireGuard configuration template
- Network isolation (no direct access)
- System package verification
**Usage**:
```bash
./scripts/verify-system.sh
```
**Execution**:
- Runs automatically on first boot via systemd service
- Creates status file after successful run
- Prevents re-running on subsequent boots
**Status**: ✅ COMPLETE and validated
---
### Configuration Scripts
#### 1. preseed.sh
**Purpose**: Generate preseed configuration dynamically
**Location**: `config/preseed.sh`
**Status**: ✅ Validated
---
#### 2. harden.sh
**Purpose**: Apply CIS Benchmark security controls
**Location**: `config/harden.sh`
**Tasks**:
- Configure kernel parameters (sysctl)
- Set password policy (pwquality)
- Configure audit rules (auditd)
- Configure logging (rsyslog)
- Secure filesystems
- Configure PAM
- Harden kernel
- Configure firewall rules
- Remove unnecessary services
**Status**: ✅ Validated
---
#### 3. secureboot.sh
**Purpose**: Configure UEFI Secure Boot
**Location**: `config/secureboot.sh`
**Status**: ✅ Validated
---
#### 4. security-config.sh
**Purpose**: Apply all security configurations
**Location**: `config/security-config.sh`
**Features**:
1. Password complexity enforcement via PAM
2. Auto-lock configuration (xscreensaver, xautolock)
3. USB mounting configuration (polkit rules, udisks2)
4. WiFi/Bluetooth disabling
5. LightDM secure greeter configuration
**Status**: ✅ Validated
---
#### 5. disable-wifi-bt.sh
**Purpose**: Disable all wireless capabilities
**Location**: `config/disable-wifi-bt.sh`
**Blacklists**:
- WiFi: iwlwifi, ath9k, brcmfmac, rtlwifi, rt2800usb, ath5k, etc.
- Bluetooth: btusb, bluetooth, hidp, rfcomm, bnep, etc.
**Status**: ✅ Validated
---
#### 6. setup-wireguard.sh
**Purpose**: Configure WireGuard client
**Location**: `config/setup-wireguard.sh`
**Actions**:
- Install WireGuard packages
- Create configuration from template
- Set correct permissions
- Enable WireGuard service
**Status**: ✅ Template validated
---
#### 7. setup-wg-server.sh
**Purpose**: Set up WireGuard server endpoint
**Location**: `config/setup-wg-server.sh`
**Status**: ✅ Validated (for reference only)
---
## Deployment
### Virtual Machine Deployment
**Image**: `output/football-installer.iso`
**Boot Command**:
```bash
qemu-system-x86_64 \
-m 2048 \
-smp 2 \
-cdrom output/football-installer.iso \
-drive file=disk.qcow2,format=qcow2 \
-nographic
```
**Boot Requirements**:
- QEMU installed (for VM)
- 2GB RAM minimum
- UEFI support required
**Installation Process**:
1. Boot from ISO
2. Preseed automatically answers most questions
3. User creates username and password
4. User selects target disk
5. Installation completes automatically
6. System reboots
7. First-boot verification runs
**First Boot**:
1. System boots to LightDM login
2. User logs in with created credentials
3. IceWM starts
4. Verify-system.sh runs automatically
5. Results logged to /var/log/football-verify.log
6. Configure WireGuard endpoint (if needed)
7. Connect to VPN
8. Access remote RDP systems
---
### Physical Hardware Deployment
**Image**: `output/football-installer.iso`
**Write to USB/Disk**:
```bash
sudo dd if=output/football-installer.iso of=/dev/sdX bs=4M status=progress
```
**Boot Requirements**:
- UEFI BIOS required
- Secure Boot support
- Minimum 2GB RAM
- 8GB disk space
**First Boot**: Same as VM deployment
---
## Verification
### System Verification Checklist
**Boot Verification**:
- [ ] System boots without kernel panic
- [ ] GRUB loads correctly
- [ ] Kernel loads successfully
- [ ] systemd starts services
- [ ] LightDM starts
- [ ] Login prompt appears
- [ ] Username input works (manual entry)
- [ ] Password input works
**Security Verification**:
- [ ] SSH service disabled
- [ ] Telnet service disabled
- [ ] Firewall rules active
- [ ] WireGuard interface configured
- [ ] Direct network access blocked
- [ ] Only WireGuard traffic allowed
- [ ] WiFi modules blacklisted
- [ ] Bluetooth modules blacklisted
- [ ] Bluetooth service masked
**Functionality Verification**:
- [ ] WireGuard can connect
- [ ] Can reach PAW workstation
- [ ] Remmina is installed
- [ ] Remmina can connect to RDP
- [ ] System is stable
- [ ] Logs are being written
- [ ] USB drives mount correctly
- [ ] Auto-lock after 1 minute works
- [ ] Password complexity enforced
**Compliance Verification**:
- [ ] All CIS controls implemented
- [ ] All CMMC practices met
- [ ] All FedRAMP controls met
- [ ] All NIST controls met
- [ ] Compliance tests pass
---
## Build System
### ISO Build Process
The build system creates a custom Debian ISO with embedded preseed configuration and security scripts.
**Build Steps**:
1. **Download Debian ISO**:
- Downloads Debian 13.3.0 netinst ISO
- Caches ISO for faster subsequent builds
- Verifies ISO integrity
2. **Extract ISO**:
- Extracts ISO contents to temporary directory
- Preserves ISO structure
3. **Inject Preseed**:
- Copies preseed.cfg to ISO root
- Configures installer to use preseed
4. **Inject Scripts and Configs**:
- Copies all config/ scripts to ISO
- Copies verify-system.sh to ISO
- Sets correct permissions
5. **Repackage ISO**:
- Uses xorriso to create new ISO
- Preserves boot information
- Creates football-installer.iso
6. **Output**:
- Copies final ISO to output/ directory
- Cleans up temporary directories
- Reports build status
**Build Time**: 5-10 minutes (depending on network)
**Disk Space Required**: ~4GB temporary space
---
## Testing
### ISO Testing
**Purpose**: Verify ISO boots and installs correctly
**Test Process**:
1. Start VM with ISO
2. Monitor boot sequence
3. Verify installer starts
4. Check preseed is applied
5. Verify installation completes
6. Verify system boots
7. Verify login works
**Test Script**: `scripts/test-iso.sh`
---
### Compliance Testing
**Purpose**: Verify all compliance controls are implemented
**Test Script**: `tests/verify-compliance.sh` and `tests/compliance-test.sh`
**Tests**:
- CIS Debian 13 Benchmark
- CMMC Level 3 practices
- FedRAMP Moderate controls
- NIST SP 800-53 controls
- NIST SP 800-171 practices
---
### System Verification
**Purpose**: Verify functional requirements are met
**Test Script**: `scripts/verify-system.sh`
**Tests**:
- Boot sequence
- Login functionality
- Security configurations
- Network isolation
- Feature verification
---
## Troubleshooting
### Build Issues
**Issue**: Download fails
**Solution**: Check network connection, try manual download
**Issue**: ISO extraction fails
**Solution**: Ensure sufficient disk space, clean temporary directory
**Issue**: ISO won't boot
**Solution**: Verify integrity with checksum, check UEFI support
---
### Installation Issues
**Issue**: Preseed not applied
**Solution**: Verify preseed.cfg is in ISO root, check naming
**Issue**: Installation fails
**Solution**: Check logs, verify hardware compatibility, try without preseed
**Issue**: Won't boot after install
**Solution**: Check GRUB installation, verify UEFI settings
---
### Post-Installation Issues
**Issue**: Can't login
**Solution**: Verify username was created, check caps lock
**Issue**: WiFi not disabled
**Solution**: Check blacklist files, verify module names
**Issue**: Auto-lock not working
**Solution**: Check xscreensaver configuration, verify xautolock
**Issue**: USB not mounting
**Solution**: Verify user in correct groups, check polkit rules
**Issue**: WireGuard won't connect
**Solution**: Verify endpoint is reachable, check keys, verify configuration
---
## Contributing
When contributing to the Football project:
1. Follow commit conventions (see COMMIT_CONVENTIONS.md)
2. Test changes thoroughly
3. Update documentation
4. Verify compliance
5. Commit and push frequently
---
## License
See LICENSE file for details.
---
**End of AGENTS.md**

134
COMMIT_CONVENTIONS.md
View File

@@ -1,134 +0,0 @@
# Commit Conventions
## Format
All commits must follow conventional commit format:
```
<type>: <concise description>
[Optional detailed description with bullet points for larger changes]
[Optional sections like "Files Updated", "Files Added", etc.]
💘 Generated with Crush
Assisted-by: <model name> via Crush <crush@charm.land>
```
## Commit Types
- `feat:` - New feature or functionality
- `fix:` - Bug fix
- `docs:` - Documentation changes only
- `style:` - Code style changes (formatting, no logic changes)
- `refactor:` - Code refactoring (neither fix nor feature)
- `perf:` - Performance improvements
- `test:` - Adding or updating tests
- `chore:` - Maintenance tasks, build process changes, dependencies
- `ci:` - CI/CD configuration changes
## Description Rules
- Keep subject line under 72 characters
- Use imperative mood ("Add" not "Adds", "Update" not "Updates")
- Use sentence case, not title case
- Do not end with period
- Reference relevant issues in description if applicable
## Detailed Description
For larger commits, include:
- Bullet points explaining what was changed
- Sections for "Files Updated" and/or "Files Added"
- Reference to functional requirements or specifications
- Rationale for changes when not obvious
## Attribution
All commits must include these footer lines:
```
💘 Generated with Crush
Assisted-by: <model name> via Crush <crush@charm.land>
```
Examples:
- `Assisted-by: GLM-4.7 via Crush <crush@charm.land>`
- `Assisted-by: Gemini 2.5 Flash via Crush <crush@charm.land>`
## Examples
### Simple Commit
```
fix: Correct ISO mount permissions
Fixed mount permissions issue when building custom ISO.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
```
### Feature Commit
```
feat: Add LightDM display manager for secure login
Implements minimal, secure login without username display:
1. **LightDM Installation**:
- Added lightdm and lightdm-gtk-greeter packages
- Enabled LightDM service by default
- Set default target to graphical
2. **Minimal and Secure Greeter**:
- Configured /etc/lightdm/lightdm.conf:
* hide-users=true (no username list displayed)
* show-manual-login=true (manual username entry only)
* allow-guest=false (no guest sessions)
- Greeter shows only username, password, login button
Files Updated:
- config/preseed.cfg (LightDM packages, enabled service)
- config/security-config.sh (LightDM configuration)
💘 Generated with Crush
Assisted-by: Gemini 2.5 Flash via Crush <crush@charm.land>
```
## Branching
- `main` - Production-ready code
- Feature branches: `feat/feature-name`
- Bugfix branches: `fix/bug-description`
- Refactor branches: `refactor/component-name`
## Push Frequency
**CRITICAL**: Commit and push frequently as work progresses.
- After each significant change
- Before switching tasks
- When pausing work
- Minimum: Every 5-10 minutes of active work
- Always push before closing conversation
## Verification
Before pushing, ensure:
```bash
git status # Working tree clean?
git log --oneline -3 # Commit message format correct?
```
## References
- [Conventional Commits](https://www.conventionalcommits.org/)
- [AGENTS.md](./AGENTS.md) - Project documentation
- [README.md](./README.md) - Project overview

235
LICENSE
View File

@@ -1,235 +0,0 @@
GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
Preamble
The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.
The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.
When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.
A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.
The precise terms and conditions for copying, distribution and modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU Affero General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based on the Program.
To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work.
A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
The Corresponding Source for a work in source code form is that same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".
c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
13. Remote Network Interaction; Use with the GNU General Public License.
Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.
If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
football
Copyright (C) 2026 KNEL
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a "Source" link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.
You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see <http://www.gnu.org/licenses/>.

311
README.md
View File

@@ -1,311 +0,0 @@
# Football - Minimal Debian Secure Access System
Fully self-contained, stripped-down, and locked-down Debian image intended for deployment onto physical access-only systems (Dell Laptop) called football-(x). Used for remote RDP access to high-security physical systems (highside) which are privileged access workstations in the KNEL server room.
## Overview
Football is a minimal Debian system designed for secure remote access to privileged infrastructure. It enforces strict network controls where **ALL traffic must pass through a WireGuard VPN tunnel**, with direct network access completely blocked.
**For complete functional requirements and artifact properties, see [docs/FUNCTIONAL-REQUIREMENTS.md](docs/FUNCTIONAL-REQUIREMENTS.md)**
## Architecture
### Security Model
- **Zero remote access**: No SSH, telnet, or any inbound services
- **WireGuard-only networking**: All traffic routed through mandatory VPN tunnel
- **Secure Boot enforced**: Kernel and bootloader signatures verified
- **Minimal attack surface**: Only IceWM and Remmina installed
- **Local console only**: No remote administration capabilities
### Network Configuration
```
Physical Interface (eth0)
├─ DHCP: Allowed (for IP acquisition)
└─ WireGuard: ONLY allowed connection to configured endpoint
└─ Endpoint: WG_ENDPOINT_IP:WG_ENDPOINT_PORT (configurable)
WireGuard Interface (wg0)
└─ ALL outbound traffic
└─ VPN endpoint → PAW (Privileged Access Workstation)
```
### Firewall Rules
- **INPUT**: DROP (except lo, WireGuard keepalive, and DHCP)
- **OUTPUT**: DROP on eth0 (except to WireGuard endpoint)
- **FORWARD**: DROP
- **OUTPUT on wg0**: ACCEPT (all VPN traffic)
## Quick Start
### Prerequisites
```bash
# Only requirement: Docker
# Docker handles all build tools and dependencies
docker --version
```
### Build ISO
```bash
# Build the Football installer ISO
./scripts/build-iso.sh
```
This creates:
- `output/football-installer.iso` - Bootable ISO with embedded preseed configuration
### Test ISO
```bash
# Test ISO by booting a VM
./scripts/test-iso.sh
```
This boots a 2GB RAM VM from the ISO, allowing you to test the installer before deploying.
### Deploy
#### Virtual Machine
The VM from `test-iso.sh` is ready for installation. Installer will:
- Auto-answer all questions except:
- Username creation
- User password (min 12 chars, mixed case, numbers, special chars)
- Root password (min 12 chars, mixed case, numbers, special chars)
- Target disk selection
#### Physical System
1. Write ISO to USB or disk:
```bash
sudo dd if=output/football-installer.iso of=/dev/sdX bs=4M status=progress
```
2. Boot system from USB
3. Installer will use embedded preseed to automate installation
4. Provide only:
- Username/password for user account
- Root password
- Target disk
3. Change default user password (`changeme`)
## Directory Structure
```
football/
├── build.sh # Main build script
├── config/
│ ├── packages.list # Minimal package list
│ ├── harden.sh # System hardening script
│ ├── secureboot.sh # Secure Boot configuration
│ └── setup-wireguard.sh # WireGuard setup script
├── chroot-overlay/ # Files copied to built system
│ ├── etc/
│ │ ├── systemd/system/ # Systemd services
│ │ ├── wireguard/ # WireGuard config templates
│ │ └── network/interfaces # Network configuration
│ └── home/user/ # User configuration
│ ├── .bashrc
│ ├── .xinitrc
│ ├── .icewm/preferences
│ └── Desktop/README.txt
└── output/ # Generated images (not in git)
```
## Security Features
### Hardening Measures
1. **Network Isolation**
- All inbound traffic blocked
- Only WireGuard traffic allowed on physical interface
- Mandatory VPN tunnel for all outbound traffic
2. **Service Restrictions**
- SSH server disabled and masked
- All remote access services removed
- Bluetooth disabled
- Unnecessary kernel modules disabled
3. **Secure Boot**
- GRUB locked with password protection
- Kernel lockdown mode enabled
- Signed bootloader (shim-signed)
- EFI variables write-protected
4. **Application Whitelisting**
- Only IceWM and Remmina installed
- No development tools
- Minimal command-line utilities
5. **System Hardening**
- AppArmor enforcing
- Fail2Ban enabled
- Auditd logging
- Core dumps disabled
- Strict umask (077)
### Firewall Rules (Detailed)
```bash
# IPv4 Rules
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow WireGuard to endpoint on eth0
iptables -A OUTPUT -o eth0 -d $WG_ENDPOINT_IP \
-p udp --dport $WG_ENDPOINT_PORT -j ACCEPT
iptables -A INPUT -i eth0 -s $WG_ENDPOINT_IP \
-p udp --sport $WG_ENDPOINT_PORT -j ACCEPT
# Allow DHCP on eth0
iptables -A OUTPUT -o eth0 -p udp --dport 67 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --sport 67 -j ACCEPT
# Allow ALL traffic on WireGuard interface
iptables -A INPUT -i wg0 -j ACCEPT
iptables -A OUTPUT -o wg0 -j ACCEPT
```
## Usage
### Default User
- **Username**: `user`
- **Password**: `changeme` (CHANGE IMMEDIATELY!)
### Automatic Startup
1. Login triggers automatic IceWM start
2. Remmina launches automatically
3. WireGuard tunnel establishes automatically
4. Use Remmina to connect to PAW
### Remmina Configuration
Create Remmina profiles in:
- Path: `/home/user/.local/share/remmina/`
- Protocol: RDP or VNC (as needed)
- Server: PAW internal IP via WireGuard
### System Administration
**Local console access only:**
```bash
# Check WireGuard status
sudo wg show
# View firewall rules
sudo iptables -L -n -v
# Check logs
sudo journalctl -u wg-quick@wg0
sudo journalctl -u block-remote-access
```
## Troubleshooting
### WireGuard Connection Fails
1. Verify endpoint IP and port
2. Check firewall rules allow WireGuard
3. Verify keys are correctly configured
4. Check WireGuard server logs
### Network Blocked
1. Confirm WireGuard interface is up: `ip link show wg0`
2. Check firewall: `sudo iptables -L -n -v`
3. Verify WireGuard config: `sudo wg show`
### Secure Boot Issues
1. Ensure UEFI is enabled
2. Verify Microsoft UEFI CA is installed
3. Check Secure Boot status: `mokutil --sb-state`
### System Won't Boot
1. Verify UEFI boot mode (not legacy BIOS)
2. Check GRUB installation
3. Review kernel logs from boot
## Advanced Configuration
### Customizing the Build
Edit `config/packages.list` to add/remove packages
Modify `chroot-overlay/` to customize system files
### Changing Image Size
Edit `build.sh`:
```bash
DISK_SIZE_MB=8192 # Change to desired size in MB
```
### Multiple Deployment Profiles
Create different `build.sh` variants with different configurations for various deployment scenarios.
## Security Considerations
### Before Deployment
1. ✅ Generate unique WireGuard keys per deployment
2. ✅ Change default password
3. ✅ Verify Secure Boot configuration
4. ✅ Test WireGuard connection
5. ✅ Verify firewall rules
6. ✅ Configure PAW connection in Remmina
### During Operation
1. ✅ Monitor WireGuard connection
2. ✅ Review audit logs regularly
3. ✅ Keep system updated (manual, controlled updates)
4. ✅ Physical security of device
### Incident Response
If compromise suspected:
1. Isolate system physically
2. Preserve logs and memory dump
3. Contact security team
4. Destroy/rebuild system from scratch
## Compliance
This system is designed to support:
- NIST SP 800-171 controls
- NIST SP 800-53 Moderate
- CIS Benchmarks for Debian 13 (Trixie)
- CMMC Level 3 controls
- FedRAMP Moderate controls
- Zero Trust network architecture principles
- Privileged Access Management (PAM) best practices
## License
See LICENSE file.
## Support
For issues or questions:
- Contact: Infrastructure Security Team
- Location: KNEL server room
---
**WARNING**: This is a security-focused build system. Unauthorized modifications or deployments may compromise infrastructure security.

124
config/40_secure_boot
View File

File diff suppressed because one or more lines are too long

102
config/50-cis-logging.conf
View File

@@ -1,102 +0,0 @@
# CIS Debian 13 Benchmark - Security Logging Configuration
# Implements CIS recommendations for enhanced security logging
# Enhanced authorization logging
auth,authpriv.* /var/log/security/auth.log
auth,authpriv.* @@remoteserver:514
# System logs with security tag
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none /var/log/security/messages
# Kernel messages
kern.* /var/log/security/kern.log
# Security events
security.* /var/log/security/security.log
# Audit events (from auditd)
audit.* /var/log/security/audit.log
# User login/logout logs
login.* /var/log/security/login.log
# Sudo commands
local2.* /var/log/security/sudo.log
# Failed logins
authpriv.*;auth.* /var/log/security/failed.log
# Application specific logs
mail.* -/var/log/security/mail.log
cron.* /var/log/security/cron.log
daemon.* /var/log/security/daemon.log
# Network logs
network.* /var/log/security/network.log
# Security alerts
*.alert /var/log/security/alerts.log
*.emerg :omusrmsg:*
*.=emerg :omusrmsg:*
# Console logging
*.=crit;*.=err;*.=warning |/dev/xconsole
# Remote logging to security team (if configured)
# *.* @@logserver.domain.tld:514
# Filter duplicate messages
$RepeatedMsgReduction on
# Set default permissions for log files
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0027
# Ensure all logs include timestamp and hostname
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Rate limiting to prevent log flooding
$SystemLogRateLimitInterval 60
$SystemLogRateLimitBurst 1000
# Discard duplicate messages within 30 seconds
$RepeatedMsgReductionInterval 30
# Include additional configuration files
$IncludeConfig /etc/rsyslog.d/*.conf
# Preserve security log integrity
:msg, contains, "security" /var/log/security/security.log
:msg, contains, "failed login" /var/log/security/failed.log
:msg, contains, "sudo" /var/log/security/sudo.log
:msg, contains, "audit" /var/log/security/audit.log
# Create separate logs for different security domains
$RuleSet remote
:fromhost-ip, !isequal, "127.0.0.1" ?RemoteLogs
& ~
# Enable journald to rsyslog forwarding
$ModLoad imjournal
$OmitLocalLogging on
# Preserve FQDN in logs
$PreserveFQDN on
# Add process ID to all log entries
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Ensure backward compatibility
$ModLoad compat
# Queue settings for reliability
$WorkDirectory /var/spool/rsyslog
$ActionQueueFileName fwdRule1
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1

113
config/99-cis-hardening.conf
View File

@@ -1,113 +0,0 @@
# CIS Debian 13 Benchmark - Kernel Hardening Configuration
# Implements CIS recommendations for kernel security parameters
# Network Configuration
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
# TCP Hardening
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
# IP Source Routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
# ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# ICMP Redirect Broadcast
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
# ICMP Rate Limiting
net.ipv4.icmp_ratelimit = 100
net.ipv4.icmp_ratemask = 88089
# IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# Log Suspicious Packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
# ExecShield Protection
kernel.exec-shield = 1
kernel.randomize_va_space = 2
# Core Dumps
kernel.core_pattern = |/bin/false
fs.suid_dumpable = 0
# Shared Memory
kernel.shmmax = 4294967295
kernel.shmall = 268435456
# Network Protection
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_sack = 1
net.ipv4.tcp_dsack = 1
# Protection against SYN flood attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5
# Log Invalid Packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# Ignore Send Redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
# Enable RFC-recommended source validation
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Disable IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
# ASLR
kernel.randomize_va_space = 2
# Disable magic SysRq key
kernel.sysrq = 0
# Limits on core dumps
fs.suid_dumpable = 0
# Restrict ptrace scope
kernel.yama.ptrace_scope = 1
# Disable kexec system call
kernel.kexec_load_disabled = 1
# AppArmor protection
kernel.apparmor_restrict_unprivileged_userns = 1
kernel.apparmor_restrict_unprivileged_io_uring = 1

332
config/aide-init.sh
View File

@@ -1,332 +0,0 @@
#!/bin/bash
# Football System AIDE Database Initialization
# Creates and initializes the file integrity monitoring database
set -e
echo "Initializing AIDE database..."
# Ensure required directories exist
mkdir -p /var/lib/aide
mkdir -p /var/log/aide
mkdir -p /etc/security
# Check if AIDE configuration exists
if [ ! -f /etc/aide.conf ]; then
echo "⚠️ AIDE configuration not found at /etc/aide.conf"
echo "Please ensure aide.conf is properly installed before running this script"
exit 1
fi
# Set proper permissions for AIDE directories
chown root:root /var/lib/aide
chmod 700 /var/lib/aide
chown root:root /var/log/aide
chmod 750 /var/log/aide
# Create log files with proper permissions
touch /var/log/aide/aide.log
touch /var/log/aide/aide_check.log
touch /var/log/aide/aide_error.log
chown root:adm /var/log/aide/*.log
chmod 640 /var/log/aide/*.log
# Check if this is the first run
FIRST_RUN=false
if [ ! -f /var/lib/aide/aide.db ]; then
echo "First-time AIDE database initialization detected"
FIRST_RUN=true
fi
# Initialize AIDE database
echo "Creating AIDE database..."
if aide --init; then
echo "✅ AIDE database created successfully"
else
echo "❌ AIDE database initialization failed"
exit 1
fi
# Move new database to active location
if [ -f /var/lib/aide/aide.db.new ]; then
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
echo "✅ AIDE database activated"
fi
# Set secure permissions on database
chown root:root /var/lib/aide/aide.db
chmod 600 /var/lib/aide/aide.db
# Create AIDE check script
cat > /usr/local/bin/aide-check.sh << 'EOF'
#!/bin/bash
# Football System - AIDE Integrity Check
# Automated file integrity monitoring script
LOGFILE="/var/log/aide/aide_check.log"
ERRORFILE="/var/log/aide/aide_error.log"
DBFILE="/var/lib/aide/aide.db"
REPORTFILE="/var/log/aide/aide_report_$(date +%Y%m%d_%H%M%S).txt"
# Function to log messages
log_message() {
local level=$1
local message=$2
echo "$(date '+%Y-%m-%d %H:%M:%S') [$level] $message" | tee -a "$LOGFILE"
}
# Function to send alerts
send_alert() {
local message="$1"
# Log to system log for security team monitoring
logger -t "aide-check" -p auth.alert "$message"
# If email is configured, send alert
if command -v mail >/dev/null 2>&1 && [ -n "$SECURITY_EMAIL" ]; then
echo "$message" | mail -s "AIDE Integrity Alert - Football System" "$SECURITY_EMAIL"
fi
}
# Check if AIDE database exists
if [ ! -f "$DBFILE" ]; then
log_message "ERROR" "AIDE database not found at $DBFILE"
send_alert "CRITICAL: AIDE database missing - File integrity monitoring compromised"
exit 1
fi
log_message "INFO" "Starting AIDE integrity check"
# Run AIDE check
if aide --check --config /etc/aide.conf > "$REPORTFILE" 2>>"$ERRORFILE"; then
log_message "INFO" "AIDE check completed - No changes detected"
# Clean up empty report file
[ -s "$REPORTFILE" ] || rm -f "$REPORTFILE"
else
local exit_code=$?
log_message "WARNING" "AIDE check completed with exit code $exit_code"
# Check if report file has content (actual changes detected)
if [ -s "$REPORTFILE" ]; then
log_message "ALERT" "File integrity changes detected - See report: $REPORTFILE"
send_alert "SECURITY ALERT: File integrity changes detected on Football System. Review $REPORTFILE"
# Log summary of changes
local changed_files=$(grep -c "^changed:" "$REPORTFILE" 2>/dev/null || echo "0")
local added_files=$(grep -c "^added:" "$REPORTFILE" 2>/dev/null || echo "0")
local removed_files=$(grep -c "^removed:" "$REPORTFILE" 2>/dev/null || echo "0")
log_message "ALERT" "Summary: $added_files added, $changed_files changed, $removed_files removed"
else
log_message "ERROR" "AIDE check failed - See error log: $ERRORFILE"
send_alert "ERROR: AIDE integrity check failed on Football System"
fi
fi
# Cleanup old reports (keep last 30 days)
find /var/log/aide -name "aide_report_*.txt" -mtime +30 -delete 2>/dev/null
log_message "INFO" "AIDE integrity check completed"
EOF
# Make the check script executable
chmod 750 /usr/local/bin/aide-check.sh
chown root:root /usr/local/bin/aide-check.sh
# Create AIDE update script
cat > /usr/local/bin/aide-update.sh << 'EOF'
#!/bin/bash
# Football System - AIDE Database Update
# Updates AIDE database after legitimate system changes
LOGFILE="/var/log/aide/aide_update.log"
DBFILE="/var/lib/aide/aide.db"
NEWDBFILE="/var/lib/aide/aide.db.new"
# Function to log messages
log_message() {
local level=$1
local message=$2
echo "$(date '+%Y-%m-%d %H:%M:%S') [$level] $message" | tee -a "$LOGFILE"
}
# Check for valid update reason
if [ $# -eq 0 ]; then
echo "Usage: $0 <reason>"
echo "Example: $0 'System package updates'"
echo "Example: $0 'Configuration change for service X'"
exit 1
fi
REASON="$1"
log_message "INFO" "Starting AIDE database update - Reason: $REASON"
# Create backup of current database
if [ -f "$DBFILE" ]; then
cp "$DBFILE" "${DBFILE}.backup_$(date +%Y%m%d_%H%M%S)"
log_message "INFO" "Created backup of current database"
fi
# Run AIDE update
log_message "INFO" "Updating AIDE database..."
if aide --update --config /etc/aide.conf; then
# Activate new database
if [ -f "$NEWDBFILE" ]; then
mv "$NEWDBFILE" "$DBFILE"
log_message "INFO" "AIDE database updated and activated successfully"
# Set proper permissions
chmod 600 "$DBFILE"
chown root:root "$DBFILE"
log_message "INFO" "Database update completed - Reason: $REASON"
else
log_message "ERROR" "AIDE update completed but new database not found"
exit 1
fi
else
log_message "ERROR" "AIDE database update failed"
exit 1
fi
# Run a quick check to verify database
log_message "INFO" "Verifying updated database..."
if aide --check --config /etc/aide.conf >/dev/null 2>&1; then
log_message "INFO" "Database verification successful"
else
log_message "WARNING" "Database verification shows differences (expected after update)"
fi
log_message "INFO" "AIDE database update process completed"
EOF
# Make the update script executable
chmod 750 /usr/local/bin/aide-update.sh
chown root:root /usr/local/bin/aide-update.sh
# Create AIDE cron configuration
cat > /etc/cron.d/aide-check << 'EOF'
# Football System - AIDE Integrity Monitoring
# Run AIDE checks every 6 hours (4 times daily)
# Hourly quick check (only critical files)
5 * * * * root /usr/local/bin/aide-check.sh --critical >/dev/null 2>&1
# Full integrity check every 6 hours
5 0,6,12,18 * * * root /usr/local/bin/aide-check.sh >/dev/null 2>&1
# Weekly database maintenance
5 3 * * 0 root /usr/local/bin/aide-update.sh "Scheduled weekly maintenance" >/dev/null 2>&1
EOF
# Set proper permissions on cron configuration
chmod 644 /etc/cron.d/aide-check
chown root:root /etc/cron.d/aide-check
# Create systemd service for AIDE monitoring
cat > /etc/systemd/system/aide-check.service << 'EOF'
[Unit]
Description=AIDE File Integrity Check
Documentation=man:aide(8)
After=auditd.service
Wants=auditd.service
[Service]
Type=oneshot
ExecStart=/usr/local/bin/aide-check.sh
StandardOutput=journal
StandardError=journal
# Security settings
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/log/aide
PrivateTmp=yes
[Install]
WantedBy=multi-user.target
EOF
# Create systemd timer for periodic checks
cat > /etc/systemd/system/aide-check.timer << 'EOF'
[Unit]
Description=Run AIDE integrity checks every 6 hours
Requires=aide-check.service
[Timer]
OnCalendar=*-*-* 0,6,12,18:05:00
Persistent=true
[Install]
WantedBy=timers.target
EOF
# Enable and start the timer
systemctl daemon-reload
systemctl enable aide-check.timer
systemctl start aide-check.timer
# Create AIDE log rotation configuration
cat > /etc/logrotate.d/aide << 'EOF'
# Football System - AIDE Log Rotation
/var/log/aide/*.log {
daily
rotate 90
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
systemctl reload rsyslog >/dev/null 2>&1 || true
endscript
}
/var/log/aide/aide_report_*.txt {
daily
rotate 30
compress
delaycompress
missingok
notifempty
create 0640 root adm
}
EOF
# Set proper permissions
chmod 644 /etc/logrotate.d/aide
chown root:root /etc/logrotate.d/aide
# Run initial AIDE check
if [ "$FIRST_RUN" = "true" ]; then
echo "Running initial AIDE integrity check..."
if /usr/local/bin/aide-check.sh; then
echo "✅ Initial AIDE check completed successfully"
else
echo "⚠️ Initial AIDE check completed with warnings (expected for new system)"
fi
else
echo "✅ AIDE database updated successfully"
fi
echo ""
echo "AIDE Configuration Summary:"
echo "- Database location: /var/lib/aide/aide.db"
echo "- Log directory: /var/log/aide/"
echo "- Check script: /usr/local/bin/aide-check.sh"
echo "- Update script: /usr/local/bin/aide-update.sh"
echo "- Systemd timer: aide-check.timer (runs every 6 hours)"
echo "- Cron backup: /etc/cron.d/aide-check"
echo ""
echo "Manual commands:"
echo "- Run integrity check: aide-check.sh"
echo "- Update database: aide-update.sh '<reason>'"
echo "- Check service status: systemctl status aide-check.timer"
echo "- View logs: journalctl -u aide-check.service"
echo ""
echo "✅ AIDE initialization and configuration completed"

297
config/aide.conf
View File

@@ -1,297 +0,0 @@
# AIDE Configuration for Football Secure Access System
# Comprehensive file integrity monitoring
# Configuration file location
@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide
@@define SYSCONFDIR /etc
@@define BINDIR /usr/bin
@@define SBINDIR /usr/sbin
@@define LIBDIR /usr/lib
@@define LOCALSTATEDIR /var/local
# File selection rules
All=p+i+n+u+g+s+m+c+md5+sha1+rmd160+tiger
# Database locations
database=file:@@{DBDIR}/aide.db
database_out=file:@@{DBDIR}/aide.db.new
# Log file
log_file=@@{LOGDIR}/aide.log
# Monitoring scope
# Root filesystem
/bin All
/sbin All
/usr/bin All
/usr/sbin All
/usr/local/bin All
/usr/local/sbin All
# Configuration directories
/etc All
/etc/X11 All
/etc/opt All
/etc/sgml All
/etc/xml All
/etc/default All
/etc/init.d All
/etc/init All
/etc/rc*.d All
/etc/udev All
/etc/rsyslog.d All
/etc/network All
/etc/wireguard All
# Security-critical directories
/etc/security All
/etc/sudoers.d All
/etc/apparmor.d All
/etc/apparmor All
/etc/fail2ban All
/etc/audit All
/etc/pam.d All
/etc/ssh All
# Boot-related directories
/boot All
/boot/grub All
/boot/grub.cfg All
/boot/efi All
/boot/efi/EFI All
/boot/efi/EFI/debian All
/boot/efi/EFI/BOOT All
# Kernel modules
/lib/modules All
/lib/firmware All
# System libraries
/lib All
/lib64 All
/usr/lib All
/usr/lib64 All
/usr/local/lib All
/usr/local/lib64 All
# User directories (monitor for changes)
/home/user All
/home/user/.config All
/home/user/.local All
/home/user/.ssh All
# Root user directories
/root All
# System state
/var All
!/var/log
!/var/run
!/var/lock
!/var/tmp
!/var/spool
!/var/cache
!/var/mail
!/var/lib/aide
# Temporary directories
!/tmp
!/var/tmp
!/var/cache
!/var/spool
# Application-specific monitoring
# Remmina configuration
/home/user/.config/remmina All
/usr/bin/remmina All
/usr/share/applications/remmina.desktop All
# IceWM configuration
/home/user/.config/icewm All
/usr/bin/icewm All
/usr/share/icewm All
# Network configuration
/etc/network/interfaces All
/etc/NetworkManager All
/etc/resolv.conf All
/etc/hosts All
/etc/hostname All
# Package management
/etc/apt All
/var/lib/apt All
/var/cache/apt All
/usr/bin/apt All
/usr/bin/apt-get All
/usr/bin/dpkg All
# Audit system
/etc/audit All
/var/log/audit All
/usr/sbin/auditd All
/usr/sbin/aureport All
/usr/sbin/ausearch All
# Rsyslog
/etc/rsyslog* All
/usr/sbin/rsyslogd All
/var/log/security All
# Firewall configuration
/etc/iptables All
/etc/nftables.conf All
/etc/ufw All
/usr/sbin/iptables All
/usr/sbin/nft All
# VPN configuration
/etc/wireguard All
/usr/bin/wg All
/usr/bin/wg-quick All
# Security tools
/usr/bin/aide All
/etc/aide.conf All
/usr/sbin/fail2ban-server All
/etc/fail2ban All
# GRUB bootloader
/etc/default/grub All
/etc/grub.d All
/usr/sbin/grub-install All
/usr/sbin/grub-mkconfig All
# Systemd configuration
/etc/systemd All
/lib/systemd All
/usr/lib/systemd All
/etc/systemd/system All
/run/systemd All
# Cryptographic libraries
/lib/x86_64-linux-gnu/security All
/usr/lib/x86_64-linux-gnu/security All
/lib/security All
# SSL/TLS certificates
/etc/ssl All
/etc/pki All
/usr/local/share/ca-certificates All
/etc/ca-certificates All
# SSH configuration and keys
/etc/ssh/sshd_config All
/etc/ssh/sshd_config.d All
/root/.ssh All
/home/user/.ssh All
# Sudoers configuration
/etc/sudoers All
/etc/sudoers.d All
/usr/bin/sudo All
/usr/sbin/visudo All
# PAM authentication
/etc/pam.d All
/lib/security All
/usr/lib/security All
/etc/security All
# Password and shadow files
/etc/passwd All
/etc/shadow All
/etc/group All
/etc/gshadow All
# AppArmor profiles
/etc/apparmor All
/etc/apparmor.d All
/usr/sbin/apparmor_status All
/usr/sbin/aa-status All
# Secure Boot keys
/etc/secure-boot All
# Linux kernel
/boot/vmlinu* All
/boot/initrd* All
/boot/System.map* All
/boot/config* All
# Device nodes (monitor for suspicious changes)
/dev All
!/dev/pts
!/dev/shm
!/proc
!/sys
# Proc filesystem (read-only monitoring)
/proc/version Normal
/proc/cpuinfo Normal
/proc/meminfo Normal
/proc/uptime Normal
/proc/loadavg Normal
/proc/version Normal
/proc/mounts Normal
/proc/filesystems Normal
/proc/swaps Normal
# System filesystem
/sys All
# Exclusion patterns (for dynamic content)
# Log files (too dynamic for integrity checking)
!/var/log/*
!/var/log/security/*
!/var/log/audit/*
!/var/log/aide/*
# Temporary and cache files
!/tmp/*
!/var/tmp/*
!/var/cache/*
!/var/spool/*
!/var/run/*
!/var/lock/*
# PID files
!/var/run/*.pid
# Lock files
!/var/lock/*
# Database files that change frequently
!/var/lib/locate/*
!/var/lib/mlocate/*
!/var/lib/updatedb/*
# Package cache
!/var/cache/apt/archives/*.deb
# Compilation artifacts
*.o
*.a
*.so
*.pyc
*.pyo
# Editor backup files
*~
*.swp
*.swo
# Version control directories
!.git
!.svn
!.hg
# AIDE's own database and log files
!@@{DBDIR}/*
!@@{LOGDIR}/*
# End of configuration

121
config/cis-audit.rules
View File

@@ -1,121 +0,0 @@
# CIS Debian 13 Benchmark - Comprehensive Audit Rules
# Implements CIS recommendations for comprehensive system auditing
# Delete all existing rules
-D
# Increase buffer size for audit daemon
-b 8192
# Monitor kernel module loading and unloading
-w /usr/bin/kmod -p x -k modules
-w /usr/bin/insmod -p x -k modules
-w /usr/bin/rmmod -p x -k modules
-w /usr/bin/modprobe -p x -k modules
-w /etc/modules -p wa -k modules
-w /etc/modprobe.d -p wa -k modules
# Monitor file system mounts and unmounts
-a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=4294967295 -k mounts
-a always,exit -F arch=b32 -S mount,umount2 -F auid>=1000 -F auid!=4294967295 -k mounts
# Monitor changes to system time
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F auid>=1000 -F auid!=4294967295 -k time
-a always,exit -F arch=b32 -S adjtimex,settimeofday,time -F auid>=1000 -F auid!=4294967295 -k time
-a always,exit -F arch=b64 -S clock_settime -F a0=0 -F auid>=1000 -F auid!=4294967295 -k time
-a always,exit -F arch=b32 -S clock_settime -F a0=0 -F auid>=1000 -F auid!=4294967295 -k time
# Monitor user and group administration
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d -p wa -k identity
# Monitor network configuration
-w /etc/hosts -p wa -k network
-w /etc/hostname -p wa -k network
-w /etc/network/ -p wa -k network
-w /etc/resolv.conf -p wa -k network
# Monitor crontab and scheduled jobs
-w /etc/crontab -p wa -k cron
-w /etc/cron.d -p wa -k cron
-w /etc/cron.daily -p wa -k cron
-w /etc/cron.hourly -p wa -k cron
-w /etc/cron.monthly -p wa -k cron
-w /etc/cron.weekly -p wa -k cron
-w /etc/cron.allow -p wa -k cron
-w /etc/cron.deny -p wa -k cron
-w /var/spool/cron -p wa -k cron
# Monitor login, logout, and authentication events
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
# Monitor privileged commands
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/gpg-agent -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
# Monitor security related files
-w /etc/apparmor -p wa -k apparmor
-w /etc/apparmor.d -p wa -k apparmor
-w /etc/security -p wa -k security
-w /etc/security/limits.d -p wa -k security
-w /etc/security/pam.d -p wa -k security
# Monitor system calls that create files
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
# Monitor failed file access
-a always,exit -F arch=b64 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
# Monitor execve system calls
-a always,exit -F arch=b64 -S execve -F auid>=1000 -F auid!=4294967295 -k exec
-a always,exit -F arch=b32 -S execve -F auid>=1000 -F auid!=4294967295 -k exec
# Monitor chmod, chown, and chmod system calls
-a always,exit -F arch=b64 -S chmod,chown,fchmod,fchmodat,fchown,fchownat,fremovexattr,lchown,setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod,chown,fchmod,fchmodat,fchown,fchownat,fremovexattr,lchown,setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
# Monitor unlink, unlinkat, rename, and renameat system calls
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=4294967295 -k delete
# Monitor file and directory creation
-a always,exit -F arch=b64 -S mkdir,mkdirat,mknod,mknodat -F auid>=1000 -F auid!=4294967295 -k create
-a always,exit -F arch=b32 -S mkdir,mkdirat,mknod,mknodat -F auid>=1000 -F auid!=4294967295 -k create
# Monitor process execution and ID changes
-a always,exit -F arch=b64 -S setuid,setgid,setreuid,setregid -F auid>=1000 -F auid!=4294967295 -k setuid
-a always,exit -F arch=b32 -S setuid,setgid,setreuid,setregid -F auid>=1000 -F auid!=4294967295 -k setuid
# Monitor kernel module loading
-w /proc/sys/kernel/modules_disabled -p wa -k modules
# Monitor IPv6 configuration
-w /etc/sysconfig/network -p wa -k network
-w /etc/sysconfig/network-scripts -p wa -k network
# Monitor init and systemd
-w /etc/inittab -p wa -k init
-w /etc/init.d -p wa -k init
-w /etc/init -p wa -k init
-w /etc/systemd -p wa -k init
-w /usr/lib/systemd -p wa -k init
# Monitor audit logs
-w /var/log/audit/ -p wa -k audit_logs
-w /var/log/audit.log -p wa -k audit_logs
# Ensure audit rules are loaded on boot
-e 2

119
config/cis-hardening-sudoers
View File

@@ -1,119 +0,0 @@
# CIS Debian 13 Benchmark - Sudo Hardening Configuration
# Implements CIS recommendations for secure sudo usage
# Default sudoers configuration
Defaults env_reset
Defaults timestamp_timeout=15
Defaults lecture=always
Defaults lecture_file=/etc/sudoers.d/lecture
Defaults badpass_message="Authentication failed. Please check your password and try again."
Defaults passwd_tries=3
Defaults log_input,log_output
Defaults iolog_dir=/var/log/sudo-io
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Security restrictions
Defaults requiretty
Defaults use_pty
Defaults env_delete="FTP_PROXY HTTP_PROXY HTTPS_PROXY no_proxy"
Defaults logfile="/var/log/security/sudo.log"
Defaults syslog=authpriv
# Prevent access to sudoedit in uncontrolled environments
Defaults editor=/usr/bin/nano
# Password confirmation for sensitive commands
Defaults !authenticate for /usr/bin/apt-get, /usr/bin/apt, /usr/bin/dpkg
Defaults authenticate
# User and group specifications
root ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) ALL
# Specialized command restrictions
# Allow user to mount/unmount USB devices
user ALL=(root) NOPASSWD: /bin/mount, /bin/umount
user ALL=(root) NOPASSWD: /usr/bin/udisksctl
# Allow user to check system status (read-only operations)
user ALL=(root) NOPASSWD: /usr/bin/free, /usr/bin/df, /usr/bin/ps, /usr/bin/top
user ALL=(root) NOPASSWD: /usr/bin/tail, /usr/bin/cat, /usr/bin/grep, /usr/bin/less
user ALL=(root) NOPASSWD: /usr/bin/systemctl status, /usr/bin/journalctl
# Allow user to manage network interfaces for VPN
user ALL=(root) NOPASSWD: /usr/bin/wg, /usr/sbin/ip
user ALL=(root) NOPASSWD: /usr/bin/ping, /usr/bin/traceroute
# Allow user to run system verification scripts
user ALL=(root) NOPASSWD: /usr/local/bin/verify-system.sh
# Administrative commands require password and are restricted
%admin ALL=(ALL) ALL
%sudo ALL=(ALL:ALL) ALL
# Security audit commands restricted to admin
%wheel ALL=(root) /usr/sbin/auditctl, /usr/sbin/aureport, /usr/sbin/aureport, /usr/sbin/ausearch
%wheel ALL=(root) /usr/bin/aide, /usr/sbin/aideinit
# System update commands
%wheel ALL=(root) /usr/bin/apt-get, /usr/bin/apt, /usr/bin/dpkg
%wheel ALL=(root) /usr/bin/aptitude, /usr/bin/apt-cache
# System service management
%wheel ALL=(root) /usr/bin/systemctl, /usr/bin/service, /usr/sbin/service
# Firewall management
%wheel ALL=(root) /usr/sbin/iptables, /usr/sbin/ip6tables, /usr/sbin/nft
# User management
%wheel ALL=(root) /usr/sbin/useradd, /usr/sbin/userdel, /usr/sbin/usermod
%wheel ALL=(root) /usr/sbin/groupadd, /usr/sbin/groupdel, /usr/sbin/groupmod
# Emergency commands (full password required)
%wheel ALL=(root) /usr/sbin/reboot, /usr/sbin/shutdown, /usr/sbin/halt
%wheel ALL=(root) /usr/bin/poweroff, /usr/sbin/init
# Path restrictions
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
# Command restrictions by directory
Defaults !visiblepw in /etc/sudoers.d/
Defaults always_set_home in /etc/sudoers.d/
Defaults match_group_by_gid in /etc/sudoers.d/
# Environment variable restrictions
Defaults env_reset
Defaults env_delete="BASH_ENV ENV SHELL HOME TERM PS1 LS_COLORS EDITOR PAGER LANG LC_ALL"
Defaults env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS PATH PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME XAUTHORIZATION XAUTHORITY"
# Sudo I/O logging for privileged commands
Defaults log_output, log_input
Defaults iolog_dir="/var/log/sudo-io/%{user}"
Defaults iolog_file="/var/log/sudo-io/%{user}/%{seq}"
# Audit logging
Defaults loglinelen=0
Defaults log_host
Defaults log_year
Defaults syslog=authpriv
# TTY requirements for security
Defaults use_pty
Defaults requiretty
# Timeout configurations
Defaults timestamp_timeout=15
Defaults passwd_tries=3
Defaults lecture=always
Defaults lecture_file=/etc/sudoers.d/lecture
# Secure path
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# No shared sudo tickets
Defaults !tty_tickets
# Network restrictions
Defaults !visiblepw
Defaults !authenticate for /usr/bin/apt-get, /usr/bin/apt, /usr/bin/dpkg
Defaults authenticate

215
config/cis-logs
View File

@@ -1,215 +0,0 @@
# CIS Debian 13 Benchmark - Log Rotation Configuration
# Implements CIS recommendations for secure log rotation
# Global rotation settings
weekly
rotate 52
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
# Security logs - longer retention
/var/log/security/*.log {
weekly
rotate 104
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# Authentication logs - high retention for forensic analysis
/var/log/security/auth.log /var/log/security/failed.log /var/log/security/login.log {
daily
rotate 365
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# Sudo logs - longer retention for audit purposes
/var/log/security/sudo.log {
daily
rotate 365
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# Audit logs - longer retention for compliance
/var/log/security/audit.log /var/log/audit/*.log {
weekly
rotate 104
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# System logs - standard retention
/var/log/security/messages /var/log/security/kern.log /var/log/security/daemon.log {
weekly
rotate 52
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# Network logs - standard retention
/var/log/security/network.log {
weekly
rotate 52
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# Security alerts - longer retention for incident analysis
/var/log/security/alerts.log {
daily
rotate 730
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate &>/dev/null || true
endscript
}
# AIDE integrity check logs
/var/log/aide/*.log {
weekly
rotate 104
compress
delaycompress
missingok
notifempty
create 0640 root adm
}
# Fail2ban logs
/var/log/fail2ban.log {
weekly
rotate 52
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
service fail2ban reload >/dev/null 2>&1 || true
endscript
}
# Application logs - standard rotation
/var/log/remmina/*.log {
weekly
rotate 12
compress
delaycompress
missingok
notifempty
create 0640 user user
}
# IceWM logs - standard rotation
/var/log/icewm/*.log {
weekly
rotate 12
compress
delaycompress
missingok
notifempty
create 0640 user user
}
# WireGuard logs - important for network security
/var/log/wireguard/*.log {
weekly
rotate 52
compress
delaycompress
missingok
notifempty
create 0640 root adm
}
# Ensure secure permissions for all log directories
/var/log/security/ /var/log/audit/ /var/log/aide/ {
monthly
rotate 1
nocreate
compress
missingok
postrotate
find /var/log/security/ -type f -name "*.log" -exec chmod 0640 {} \;
find /var/log/security/ -type d -exec chmod 0750 {} \;
find /var/log/audit/ -type f -name "*.log" -exec chmod 0640 {} \;
find /var/log/audit/ -type d -exec chmod 0750 {} \;
find /var/log/aide/ -type f -name "*.log" -exec chmod 0640 {} \;
find /var/log/aide/ -type d -exec chmod 0750 {} \;
endscript
}
# Summary log rotation for compliance reporting
/var/log/security/summary.log {
monthly
rotate 60
compress
delaycompress
missingok
notifempty
create 0640 root adm
}
# Old system logs for historical reference
/var/log/syslog /var/log/messages /var/log/kern.log {
weekly
rotate 4
compress
delaycompress
missingok
notifempty
create 0640 root adm
}

70
config/common-password-cis
View File

@@ -1,70 +0,0 @@
# CIS Debian 13 Benchmark - PAM Password Configuration
# Implements CIS recommendations for password security
# Password quality enforcement using pwquality
password requisite pam_pwquality.so try_first_pass retry=3 authtok_type=
password [success=1 default=ignore] pam_unix.so obscure sha512 rounds=5000 use_authtok
password sufficient pam_unix.so sha512 rounds=5000 nullok secure try_first_pass use_authtok
password required pam_deny.so
# Account configuration
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
# Authentication configuration
auth required pam_env.so
auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900
auth [success=1 default=bad] pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
auth required pam_permit.so
# Session configuration
session required pam_limits.so
session required pam_unix.so
session optional pam_lastlog.so
session optional pam_motd.so
session optional pam_mail.so standard
session required pam_env.so
# Password history - prevent reuse of last 5 passwords
password required pam_pwhistory.so remember=5 use_authtok
# Session management for X11
session optional pam_ck_connector.so nox11
session optional pam_systemd.so
# Home directory creation (if needed)
session required pam_mkhomedir.so skel=/etc/skel/ umask=077
# Security modules
session optional pam_umask.so umask=077
session optional pam_keyinit.so revoke
# Enhanced account lockout configuration
auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900 fail_interval=900 even_deny_root root_unlock_time=900
auth sufficient pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900 fail_interval=900 even_deny_root root_unlock_time=900
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900 fail_interval=900 even_deny_root root_unlock_time=900
auth required pam_permit.so
# Prevent empty passwords
password required pam_unix.so nullok sha512 shadow try_first_pass use_authtok
# Session restrictions
session required pam_limits.so
session required pam_unix.so
session required pam_lastlog.so showfailed
session required pam_env.so readenv=1
# Additional security configurations
account required pam_access.so accessfile=/etc/security/access.conf
auth required pam_wheel.so trust use_uid
auth optional pam_cap.so
# Enhanced logging
auth optional pam_echo.so Football Secure Access System Authentication
password optional pam_echo.so Password complexity requirements enforced
session optional pam_echo.so Session monitoring enabled

72
config/disable-wifi-bt.sh
View File

@@ -1,72 +0,0 @@
#!/bin/bash
# Disable WiFi and Bluetooth on Football System
# Runs during installation (via preseed late_command)
set -e
echo "Disabling WiFi and Bluetooth..."
# Blacklist WiFi kernel modules
cat > /etc/modprobe.d/disable-wifi.conf << 'EOF'
# Disable WiFi modules
blacklist b43
blacklist b43legacy
blacklist brcm80211
blacklist iwlwifi
blacklist iwlegacy
blacklist iwl3945
blacklist iwl4965
blacklist iwlagn
blacklist mac80211
blacklist libertas
blacklist libertas_cs
blacklist libertas_sdio
blacklist libertas_spi
blacklist mwl8k
blacklist p54pci
blacklist p54usb
blacklist rt2x00lib
blacklist rt2400pci
blacklist rt2500pci
blacklist rt2500usb
blacklist rt61pci
blacklist rt73usb
blacklist rtl8180
blacklist rtl8187
blacklist rtl8192ce
blacklist rtl8192cu
blacklist rtl8192se
blacklist rtl8xxxu
blacklist rtlwifi
blacklist ssb
blacklist wl
EOF
# Blacklist Bluetooth kernel modules
cat > /etc/modprobe.d/disable-bluetooth.conf << 'EOF'
# Disable Bluetooth modules
blacklist bluetooth
blacklist btusb
blacklist btrtl
blacklist btbcm
blacklist btintel
EOF
# Disable Bluetooth service
if [ -f /etc/systemd/system/bluetooth.target ]; then
systemctl mask bluetooth
fi
# Remove Bluetooth packages (if installed)
apt-get purge -y bluez bluez-firmware 2>/dev/null || true
# Disable NetworkManager WiFi
if [ -f /etc/NetworkManager/NetworkManager.conf ]; then
cat >> /etc/NetworkManager/NetworkManager.conf << 'EOF'
[device]
wifi.scan-rand-mac-address=no
EOF
fi
echo "WiFi and Bluetooth disabled successfully"

524
config/firewall-persistence.sh
View File

@@ -1,524 +0,0 @@
#!/bin/bash
# Football System Firewall Persistence Configuration
# Ensures firewall rules persist across reboots with nftables
set -e
echo "Configuring firewall persistence..."
# Install required packages if not already installed
apt-get update -qq
apt-get install -y -qq \
nftables \
iptables-persistent \
netfilter-persistent
# Create nftables configuration directory
mkdir -p /etc/nftables.conf.d
# Main nftables configuration
cat > /etc/nftables.conf << 'EOF'
# Football System - nftables Configuration
# Restrictive firewall rules for secure access
# Clear existing rules
flush ruleset
# Table definitions
table inet filter {
# Chain definitions
chain input {
type filter hook input priority 0; policy drop;
# Allow loopback traffic
iifname "lo" accept comment "Allow loopback"
# Allow established and related connections
ct state established,related accept comment "Allow established/related"
# Drop invalid packets
ct state invalid drop comment "Drop invalid packets"
# Allow ICMP (limited)
ip protocol icmp icmp type { echo-request, echo-reply } limit rate 10/second burst 5 packets accept comment "Allow ping (rate limited)"
ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply } limit rate 10/second burst 5 packets accept comment "Allow IPv6 ping (rate limited)"
# Allow required ICMP types
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept comment "Allow required ICMP"
ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, time-exceeded, parameter-problem, packet-too-big, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept comment "Allow required ICMPv6"
# SSH access (restricted to management network if configured)
tcp dport 22 accept comment "Allow SSH (consider restricting)"
# Remmina/VNC access (only if needed)
tcp dport { 5900, 5901 } accept comment "Allow VNC access"
# WireGuard VPN
udp dport 51820 accept comment "Allow WireGuard VPN"
# DHCP client (if needed)
udp sport { 67,68 } udp dport { 67,68 } accept comment "Allow DHCP"
# DNS client
udp dport 53 ct state established,related accept comment "Allow DNS responses"
# NTP client
udp dport 123 ct state established,related accept comment "Allow NTP responses"
# HTTP/HTTPS client traffic (outbound responses)
tcp sport { 80,443 } ct state established,related accept comment "Allow web responses"
# Drop and log other traffic
log prefix "NFT-INPUT-DROP: " drop comment "Log and drop other input"
}
chain forward {
type filter hook forward priority 0; policy drop;
# Allow forwarding for VPN traffic
iifname "wg0" oifname != "wg0" accept comment "Allow VPN forwarding"
iifname != "wg0" oifname "wg0" accept comment "Allow traffic to VPN"
# Drop and log other forwarded traffic
log prefix "NFT-FORWARD-DROP: " drop comment "Log and drop other forward"
}
chain output {
type filter hook output priority 0; policy accept;
# Allow all outbound traffic by default (restrict as needed)
# Log blocked traffic for troubleshooting
log prefix "NFT-OUTPUT-DROP: " drop comment "Log dropped output"
}
}
# NAT table for VPN (if needed)
table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
# NAT for VPN traffic (if internet access via VPN)
# oifname "eth0" ip saddr 10.8.0.0/24 masquerade comment "NAT for VPN"
}
}
EOF
# Create custom rules directory for modular configuration
mkdir -p /etc/nftables.conf.d
# Create separate rule file for allowed management networks
cat > /etc/nftables.conf.d/management.nft << 'EOF'
# Management Network Access Rules
# Uncomment and modify for your management network(s)
# Allow SSH from management network only
# add rule inet filter input ip saddr 192.168.1.0/24 tcp dport 22 accept comment "SSH from management network"
# Allow monitoring from management network
# add rule inet filter input ip saddr 192.168.1.0/24 udp dport { 161,162 } accept comment "SNMP from management network"
EOF
# Create rate limiting rules
cat > /etc/nftables.conf.d/rate-limits.nft << 'EOF'
# Rate Limiting Rules
# Prevent brute force attacks and flooding
# Rate limit new SSH connections
add rule inet filter input tcp dport 22 ct state new limit rate 3/minute burst 5 accept comment "Rate limit SSH"
# Rate limit ping requests
add rule inet filter input ip protocol icmp icmp type echo-request limit rate 10/second burst 5 packets accept comment "Rate limit ping"
# Rate limit VNC connections
add rule inet filter input tcp dport { 5900,5901 } ct state new limit rate 2/minute burst 3 accept comment "Rate limit VNC"
EOF
# Create logging rules
cat > /etc/nftables.conf.d/logging.nft << 'EOF'
# Enhanced Logging Rules
# Log suspicious activity for security monitoring
# Log connection attempts to blocked ports
add rule inet filter input tcp dport { 23,3389,1433,3306,5432 } ct state new log prefix "NFT-SCANNED-PORT: " drop comment "Log blocked port scans"
# Log fragmented packets
add rule inet filter input ip frag-off drop log prefix "NFT-FRAGMENTED: " comment "Drop fragmented packets"
# Log suspicious flags
add rule inet filter input tcp flags & (syn|ack) == (syn|ack) log prefix "NFT-SYN-ACK: " drop comment "Log suspicious SYN-ACK"
EOF
# Create firewall persistence script
cat > /usr/local/bin/firewall-persistence.sh << 'EOF'
#!/bin/bash
# Football System - Firewall Persistence Script
# Ensures firewall rules are saved and restored properly
FIREWALL_CONFIG="/etc/nftables.conf"
RULES_DIR="/etc/nftables.conf.d"
LOCK_FILE="/var/lock/firewall-persistence"
LOG_FILE="/var/log/security/firewall-persistence.log"
# Function to log messages
log_message() {
local level=$1
local message=$2
echo "$(date '+%Y-%m-%d %H:%M:%S') [$level] $message" | tee -a "$LOG_FILE"
}
# Function to check if process is running
is_running() {
pgrep -f "$1" >/dev/null 2>&1
}
# Prevent concurrent execution
exec 200>"$LOCK_FILE"
if flock -n 200; then
log_message "INFO" "Starting firewall persistence check"
else
log_message "WARNING" "Firewall persistence script already running"
exit 1
fi
# Check if nftables service is running
if ! systemctl is-active --quiet nftables; then
log_message "ERROR" "nftables service is not running"
log_message "INFO" "Starting nftables service..."
systemctl start nftables
if systemctl is-active --quiet nftables; then
log_message "INFO" "nftables service started successfully"
else
log_message "CRITICAL" "Failed to start nftables service"
exit 1
fi
fi
# Verify firewall rules are loaded
if ! nft list ruleset >/dev/null 2>&1; then
log_message "ERROR" "No firewall rules are loaded"
log_message "INFO" "Loading firewall rules..."
if nft -f "$FIREWALL_CONFIG"; then
log_message "INFO" "Main firewall rules loaded successfully"
# Load additional rule files
for rule_file in "$RULES_DIR"/*.nft; do
if [ -f "$rule_file" ]; then
log_message "INFO" "Loading rules from $(basename "$rule_file")"
nft -f "$rule_file"
fi
done
else
log_message "CRITICAL" "Failed to load firewall rules"
exit 1
fi
fi
# Verify critical rules are in place
CRITICAL_RULES=(
"iifname \"lo\" accept"
"ct state established,related accept"
"tcp dport 22 accept"
"udp dport 51820 accept"
)
for rule in "${CRITICAL_RULES[@]}"; do
if nft list ruleset | grep -q "$rule"; then
log_message "DEBUG" "Critical rule verified: $rule"
else
log_message "WARNING" "Critical rule missing: $rule"
fi
done
# Check for potential firewall bypasses
log_message "INFO" "Checking for potential firewall bypasses"
# Check for raw socket usage
if netstat -anp 2>/dev/null | grep -q "raw"; then
log_message "WARNING" "Raw sockets detected - potential firewall bypass"
fi
# Check for iptables conflicts
if iptables -L >/dev/null 2>&1 && [ "$(iptables -L | wc -l)" -gt 6 ]; then
log_message "WARNING" "iptables rules detected - potential conflict with nftables"
fi
# Test basic connectivity through firewall
log_message "INFO" "Testing basic firewall functionality"
# Test loopback
if ping -c 1 -W 1 127.0.0.1 >/dev/null 2>&1; then
log_message "DEBUG" "Loopback connectivity test passed"
else
log_message "WARNING" "Loopback connectivity test failed"
fi
# Test that basic blocking works (if we can determine an unreachable port)
# This is a simple test - adjust as needed for your environment
if timeout 2 bash -c "echo >/dev/tcp/192.0.2.1/80" 2>/dev/null; then
log_message "WARNING" "Unexpected connectivity to test destination - check firewall rules"
else
log_message "DEBUG" "Basic blocking test passed (expected failure)"
fi
# Save current rules for persistence
if systemctl is-active --quiet nftables; then
log_message "INFO" "Saving firewall rules for persistence"
# Create backup of current rules
mkdir -p /var/backups/firewall
nft list ruleset > "/var/backups/firewall/ruleset_$(date +%Y%m%d_%H%M%S).nft"
log_message "INFO" "Firewall rules backed up successfully"
else
log_message "ERROR" "Cannot save rules - nftables service not running"
fi
# Report status
if systemctl is-active --quiet nftables && nft list ruleset >/dev/null 2>&1; then
log_message "INFO" "Firewall persistence check completed successfully"
exit 0
else
log_message "CRITICAL" "Firewall persistence check failed"
exit 1
fi
EOF
# Make persistence script executable
chmod 750 /usr/local/bin/firewall-persistence.sh
chown root:root /usr/local/bin/firewall-persistence.sh
# Create systemd service for firewall persistence
cat > /etc/systemd/system/firewall-persistence.service << 'EOF'
[Unit]
Description=Firewall Persistence Check
Documentation=man:nftables(8)
After=network.target nftables.service
Wants=nftables.service
[Service]
Type=oneshot
ExecStart=/usr/local/bin/firewall-persistence.sh
StandardOutput=journal
StandardError=journal
# Security settings
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/log/security /var/lock
PrivateTmp=yes
[Install]
WantedBy=multi-user.target
EOF
# Create systemd timer for periodic checks
cat > /etc/systemd/system/firewall-persistence.timer << 'EOF'
[Unit]
Description=Run firewall persistence checks every 15 minutes
Requires=firewall-persistence.service
[Timer]
OnCalendar=*:0/15
Persistent=true
[Install]
WantedBy=timers.target
EOF
# Configure nftables service
cat > /etc/default/nftables << 'EOF'
# Configuration for nftables
# Set to "yes" to load firewall rules on boot
STANDARD_SETUP="yes"
# Set to "yes" to save firewall rules on shutdown/reboot
STANDARD_CLEANUP="no"
# Additional options to pass to nft during startup
NFT_OPTIONS=""
EOF
# Create iptables to nftables compatibility (if needed)
cat > /usr/local/bin/iptables-legacy-save.sh << 'EOF'
#!/bin/bash
# Legacy iptables save script for compatibility
# Saves current iptables rules for backup purposes
mkdir -p /var/backups/iptables
iptables-save > "/var/backups/iptables/legacy_$(date +%Y%m%d_%H%M%S).rules"
echo "Legacy iptables rules saved"
EOF
chmod 750 /usr/local/bin/iptables-legacy-save.sh
chown root:root /usr/local/bin/iptables-legacy-save.sh
# Create firewall status script
cat > /usr/local/bin/firewall-status.sh << 'EOF'
#!/bin/bash
# Football System - Firewall Status Check
# Comprehensive firewall status reporting
echo "=== Football System Firewall Status ==="
echo "Time: $(date)"
echo ""
# Check nftables service status
echo "=== Service Status ==="
if systemctl is-active --quiet nftables; then
echo "✅ nftables service: Active"
else
echo "❌ nftables service: Inactive"
fi
if systemctl is-enabled --quiet nftables; then
echo "✅ nftables service: Enabled on boot"
else
echo "❌ nftables service: Disabled on boot"
fi
echo ""
# Check ruleset status
echo "=== Ruleset Status ==="
if nft list ruleset >/dev/null 2>&1; then
echo "✅ Ruleset: Loaded"
TOTAL_RULES=$(nft list ruleset | grep -c "accept\|drop")
echo "Total rules: $TOTAL_RULES"
else
echo "❌ Ruleset: Not loaded"
fi
echo ""
# Show key rules
echo "=== Key Security Rules ==="
nft list ruleset | grep -E "(lo|ssh|wireguard|established)" | head -10
echo ""
# Check for recent firewall log entries
echo "=== Recent Firewall Log Entries ==="
if journalctl -u nftables --since "1 hour ago" | grep -q "NFT"; then
journalctl -u nftables --since "1 hour ago" | grep "NFT" | tail -5
else
echo "No recent firewall log entries"
fi
echo ""
# Check persistence timer status
echo "=== Persistence Monitoring ==="
if systemctl is-active --quiet firewall-persistence.timer; then
echo "✅ Persistence timer: Active"
NEXT_RUN=$(systemctl list-timers firewall-persistence.timer --no-pager | grep "n/a" -A 1 | tail -1 | awk '{print $1,$2,$3,$4}')
echo "Next run: $NEXT_RUN"
else
echo "❌ Persistence timer: Inactive"
fi
echo ""
# Network interface status
echo "=== Network Interface Status ==="
ip addr show | grep -E "(state|inet)" | grep -v "127.0.0.1"
echo ""
# Show active connections
echo "=== Recent Active Connections ==="
ss -tuln | head -10
echo "=== End Firewall Status ==="
EOF
chmod 750 /usr/local/bin/firewall-status.sh
chown root:root /usr/local/bin/firewall-status.sh
# Enable and start services
systemctl daemon-reload
systemctl enable nftables
systemctl start nftables
systemctl enable firewall-persistence.timer
systemctl start firewall-persistence.timer
# Load firewall rules
echo "Loading firewall rules..."
if nft -f /etc/nftables.conf; then
echo "✅ Main firewall rules loaded successfully"
else
echo "❌ Failed to load main firewall rules"
exit 1
fi
# Load additional rule files
for rule_file in /etc/nftables.conf.d/*.nft; do
if [ -f "$rule_file" ]; then
echo "Loading rules from $(basename "$rule_file")"
if nft -f "$rule_file"; then
echo "✅ Rules from $(basename "$rule_file") loaded successfully"
else
echo "❌ Failed to load rules from $(basename "$rule_file")"
fi
fi
done
# Run initial persistence check
if /usr/local/bin/firewall-persistence.sh; then
echo "✅ Firewall persistence check completed successfully"
else
echo "⚠️ Firewall persistence check completed with warnings"
fi
# Create firewall log rotation
cat > /etc/logrotate.d/firewall << 'EOF'
# Football System - Firewall Log Rotation
/var/log/security/firewall-persistence.log {
weekly
rotate 52
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
systemctl reload rsyslog >/dev/null 2>&1 || true
endscript
}
/var/backups/firewall/*.nft {
monthly
rotate 12
compress
delaycompress
missingok
notifempty
}
EOF
chmod 644 /etc/logrotate.d/firewall
chown root:root /etc/logrotate.d/firewall
# Display firewall status
echo ""
echo "=== Firewall Configuration Summary ==="
echo "✅ nftables service enabled and started"
echo "✅ Firewall rules loaded from /etc/nftables.conf"
echo "✅ Additional rules loaded from /etc/nftables.conf.d/"
echo "✅ Persistence monitoring enabled (runs every 15 minutes)"
echo "✅ Status script available: /usr/local/bin/firewall-status.sh"
echo "✅ Log rotation configured"
echo ""
echo "Key firewall ports allowed:"
echo "- SSH (22): Remote management"
echo "- WireGuard (51820): VPN access"
echo "- VNC (5900-5901): Remote desktop"
echo "- ICMP (limited): Network diagnostics"
echo ""
echo "Run 'firewall-status.sh' for detailed status"
echo "✅ Firewall persistence configuration completed"

14
config/football-first-boot.service
View File

@@ -1,14 +0,0 @@
[Unit]
Description=Football System First-Boot Verification
After=network-online.target
ConditionPathExists=!/var/lib/football/verification-status
Requires=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/local/bin/verify-system.sh
StandardOutput=journal
StandardError=journal
[Install]
WantedBy=multi-user.target

414
config/harden.sh
View File

@@ -1,414 +0,0 @@
#!/bin/bash
# Post-installation hardening script for football system
# This script configures strict firewall with WireGuard-only access
# Implements CIS Debian Benchmark and CMMC/FedRAMP controls
set -euo pipefail
echo "Applying CIS Benchmark and CMMC/FedRAMP hardening..."
# ============================================================================
# DISABLE AND REMOVE ALL REMOTE ACCESS SERVICES
# ============================================================================
systemctl disable ssh 2>/dev/null || true
systemctl disable sshd 2>/dev/null || true
systemctl disable telnet 2>/dev/null || true
systemctl disable rsh 2>/dev/null || true
systemctl mask ssh 2>/dev/null || true
systemctl mask sshd 2>/dev/null || true
systemctl mask telnet 2>/dev/null || true
systemctl mask rsh 2>/dev/null || true
apt-get purge -y openssh-server telnetd rsh-server 2>/dev/null || true
# ============================================================================
# STRICT FIREWALL RULES - WireGuard ONLY
# ============================================================================
WG_ENDPOINT_IP="${WG_ENDPOINT_IP:-192.0.2.1}"
WG_ENDPOINT_PORT="${WG_ENDPOINT_PORT:-51820}"
echo "Configuring strict firewall: only WireGuard to $WG_ENDPOINT_IP:$WG_ENDPOINT_PORT allowed on eth0"
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Only WireGuard on physical interface
iptables -A OUTPUT -o eth0 -d "$WG_ENDPOINT_IP" -p udp --dport "$WG_ENDPOINT_PORT" -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -s "$WG_ENDPOINT_IP" -p udp --sport "$WG_ENDPOINT_PORT" -m state --state ESTABLISHED -j ACCEPT
# All traffic through WireGuard
iptables -A INPUT -i wg0 -j ACCEPT
iptables -A OUTPUT -o wg0 -j ACCEPT
# DHCP on eth0
iptables -A OUTPUT -o eth0 -p udp --dport 67 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p udp --sport 67 -m state --state ESTABLISHED -j ACCEPT
# Save rules
mkdir -p /etc/iptables
iptables-save > /etc/iptables/rules.v4
# IPv6 - block everything
ip6tables -F 2>/dev/null || true
ip6tables -X 2>/dev/null || true
ip6tables -P INPUT DROP 2>/dev/null || true
ip6tables -P FORWARD DROP 2>/dev/null || true
ip6tables -P OUTPUT DROP 2>/dev/null || true
ip6tables -A INPUT -i lo -j ACCEPT 2>/dev/null || true
ip6tables -A OUTPUT -o lo -j ACCEPT 2>/dev/null || true
ip6tables-save > /etc/iptables/rules.v6 2>/dev/null || true
# ============================================================================
# CIS BENCHMARK: ACCOUNT AND ACCESS CONTROL
# ============================================================================
echo "Applying CIS Benchmark account and access controls..."
# Remove unnecessary accounts
for user in games news uucp; do
userdel -r "$user" 2>/dev/null || true
done
# Lock system accounts
for user in daemon bin sys sync man lp mail; do
usermod -L "$user" 2>/dev/null || true
done
# Ensure only wheel group can use sudo (configured in sudoers)
groupadd wheel 2>/dev/null || true
# ============================================================================
# CIS BENCHMARK: SYSTEM CONFIGURATION
# ============================================================================
# Configure PAM with CIS password policy
if [ -f /etc/pam.d/common-password-cis ]; then
echo "Configuring PAM with CIS password policies..."
cp /etc/pam.d/common-password-cis /etc/pam.d/common-password
fi
# Configure faillock for account lockout
cat > /etc/security/faillock.conf << 'EOF'
deny = 5
unlock_time = 900
even_deny_root
root_unlock_time = 900
EOF
# ============================================================================
# CIS BENCHMARK: KERNEL HARDENING
# ============================================================================
echo "Applying kernel hardening parameters..."
sysctl -p /etc/sysctl.d/99-cis-hardening.conf
# Disable kernel module loading for non-privileged users
cat > /etc/modprobe.d/disable-autoload.conf << 'EOF'
disable autogenerated module loading
blacklist sound-slot*
blacklist snd-pcspkr
blacklist pcspkr
EOF
# ============================================================================
# CIS BENCHMARK: FILE SYSTEM SECURITY
# ============================================================================
echo "Applying file system security..."
# Set secure permissions on critical directories
chmod 700 /root
chmod 755 /etc /etc/passwd /etc/shadow /etc/group /etc/gshadow
# Set sticky bit on world-writable directories
find /tmp /var/tmp -type d -exec chmod a+t {} \; 2>/dev/null || true
# Remove world-writable permissions
find / -type f -perm -0002 -exec chmod o-w {} \; 2>/dev/null || true
find / -type d -perm -0002 -exec chmod o-w {} \; 2>/dev/null || true
# Remove SUID/SGID from unnecessary binaries
chmod a-s /bin/ping 2>/dev/null || true
chmod a-s /bin/ping6 2>/dev/null || true
# ============================================================================
# CIS BENCHMARK: AUDIT CONFIGURATION
# ============================================================================
echo "Configuring audit system..."
if [ -d /etc/audit/rules.d ]; then
# Apply CIS audit rules
augenrules --load 2>/dev/null || true
# Ensure auditd is enabled and running
systemctl enable auditd 2>/dev/null || true
fi
# ============================================================================
# CIS BENCHMARK: LOGGING CONFIGURATION
# ============================================================================
echo "Configuring logging..."
# Ensure log directories exist
mkdir -p /var/log/audit
mkdir -p /var/log/sudo
chmod 750 /var/log/audit
chmod 750 /var/log/sudo
# Ensure rsyslog is enabled
systemctl enable rsyslog 2>/dev/null || true
# Configure fail2ban
if [ -f /etc/fail2ban/jail.local ]; then
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
destemail = root
sender = fail2ban@football.local
action = %(action_)s
[sshd]
enabled = false
EOF
fi
# ============================================================================
# CIS BENCHMARK: NETWORK CONFIGURATION
# ============================================================================
echo "Applying network security configuration..."
# Disable network filesystem mounts
cat > /etc/modprobe.d/no-network-fs.conf << 'EOF'
install nfs /bin/true
install nfs4 /bin/true
install cifs /bin/true
install smbfs /bin/true
EOF
# Disable Bluetooth
echo "disable bluetooth" > /etc/modprobe.d/disable-bluetooth.conf
echo "install bluetooth /bin/true" >> /etc/modprobe.d/disable-bluetooth.conf
echo "install btusb /bin/true" >> /etc/modprobe.d/disable-bluetooth.conf
systemctl disable bluetooth 2>/dev/null || true
systemctl mask bluetooth 2>/dev/null || true
# Disable wireless
echo "disable wireless" > /etc/modprobe.d/disable-wireless.conf
echo "install cfg80211 /bin/true" >> /etc/modprobe.d/disable-wireless.conf
echo "install mac80211 /bin/true" >> /etc/modprobe.d/disable-wireless.conf
# ============================================================================
# CIS BENCHMARK: SUDO CONFIGURATION
# ============================================================================
echo "Configuring sudo..."
# Secure sudo configuration
chmod 0440 /etc/sudoers
chmod 0440 /etc/sudoers.d/*
# Create sudo lecture file
cat > /etc/sudoers.d/lecture << 'EOF'
Use sudo only for necessary administrative tasks.
All sudo actions are logged and audited.
Unauthorized use will result in disciplinary action.
EOF
# ============================================================================
# CIS BENCHMARK: SYSTEM ISSUE CONFIGURATION
# ============================================================================
cat > /etc/issue << 'EOF'
Football Secure Access System
No remote access is permitted on this system.
Local console access only.
All network traffic must pass through WireGuard VPN.
WARNING: All actions are logged and monitored.
EOF
cat > /etc/issue.net << 'EOF'
WARNING: Remote access is disabled on this system.
Local console access only.
EOF
# ============================================================================
# CIS BENCHMARK: SECURE UMASK
# ============================================================================
echo "Setting secure umask..."
echo "umask 077" >> /etc/profile
echo "umask 077" >> /etc/bash.bashrc
# ============================================================================
# CIS BENCHMARK: CORE DUMP DISABLING
# ============================================================================
cat > /etc/security/limits.conf << 'EOF'
* hard core 0
* soft core 0
EOF
# Disable core dumps in kernel configuration
echo "kernel.core_pattern = |/bin/false" > /etc/sysctl.d/99-disable-coredumps.conf
sysctl -p /etc/sysctl.d/99-disable-coredumps.conf
# ============================================================================
# CIS BENCHMARK: FILE INTEGRITY MONITORING (AIDE)
# ============================================================================
echo "Configuring file integrity monitoring..."
if command -v aide >/dev/null 2>&1; then
# Initialize AIDE database
aide --init || true
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db 2>/dev/null || true
# Create AIDE check service
cat > /etc/systemd/system/aide-check.service << 'EOF'
[Unit]
Description=Check file integrity with AIDE
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/bin/aide --check
ExecStartPost=/usr/bin/logger -t aide "File integrity check completed"
[Install]
WantedBy=multi-user.target
EOF
# Create AIDE check timer (run daily)
cat > /etc/systemd/system/aide-check.timer << 'EOF'
[Unit]
Description=Daily AIDE file integrity check
[Timer]
OnCalendar=daily
Persistent=true
[Install]
WantedBy=timers.target
EOF
systemctl enable aide-check.timer 2>/dev/null || true
fi
# ============================================================================
# CIS BENCHMARK: APPARMOR CONFIGURATION
# ============================================================================
echo "Configuring AppArmor..."
# Ensure AppArmor is enabled
systemctl enable apparmor 2>/dev/null || true
# Enforce AppArmor profiles for critical services
for profile in /etc/apparmor.d/*; do
if [ -f "$profile" ]; then
aa-enforce "${profile##*/}" 2>/dev/null || true
fi
done
# ============================================================================
# CIS BENCHMARK: SSH CONFIGURATION (Even though SSH is disabled)
# ============================================================================
mkdir -p /etc/ssh
cat > /etc/ssh/sshd_config.d/99-hardening.conf << 'EOF'
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
X11Forwarding no
AllowTcpForwarding no
GatewayPorts no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 0
AllowUsers user
EOF
chmod 600 /etc/ssh/sshd_config.d/99-hardening.conf
# ============================================================================
# CMMC/FEDRAMP: SECURITY CONFIGURATION
# ============================================================================
echo "Applying CMMC/FedRAMP security controls..."
# Create log directories for compliance
mkdir -p /var/log/security
mkdir -p /var/log/compliance
chmod 750 /var/log/security /var/log/compliance
# Enable audit logging for CMMC
echo "Audit logging enabled for CMMC Level 3 compliance" >> /var/log/security/compliance.log
# Create compliance marker file
cat > /etc/security/compliance.txt << 'EOF'
Football Secure Access System - Compliance Information
========================================================
Standards Implemented:
- CIS Debian 13 Benchmark
- NIST SP 800-53 Moderate (FedRAMP)
- CMMC Level 3
- NIST SP 800-171
Build Date: $(date)
System Type: Tier0 Infrastructure Protection
Security Classification: Controlled Unclassified Information
For compliance documentation, see /usr/share/doc/compliance/
EOF
# ============================================================================
# ENABLE SECURITY SERVICES
# ============================================================================
echo "Enabling security services..."
systemctl enable auditd 2>/dev/null || true
systemctl enable apparmor 2>/dev/null || true
systemctl enable fail2ban 2>/dev/null || true
systemctl enable rsyslog 2>/dev/null || true
echo ""
echo "==========================================="
echo "CIS Benchmark hardening complete"
echo "CMMC/FedRAMP controls applied"
echo "==========================================="
echo ""
echo "Security Summary:"
echo " - Remote access: DISABLED"
echo " - WireGuard-only networking: ENABLED"
echo " - Firewall: STRICT (WireGuard only)"
echo " - Audit logging: ENABLED"
echo " - File integrity monitoring: ENABLED"
echo " - Kernel hardening: APPLIED"
echo " - Password policies: ENFORCED"
echo ""
echo "System is ready for deployment."

76
config/packages.list
View File

@@ -1,76 +0,0 @@
# Minimal packages for football secure access system
# Base system
linux-image-amd64
firmware-linux
firmware-linux-nonfree
grub2-common
grub-pc-bin
grub-efi-amd64-bin
grub-efi-ia32-bin
shim-signed
initramfs-tools
sudo
locales
keyboard-configuration
console-setup
# Network (client only, no server capabilities)
networkmanager
iproute2
iputils-ping
isc-dhcp-client
wireguard
wireguard-tools
iptables-persistent
# Hardware support
xserver-xorg
xserver-xorg-input-libinput
x11-xserver-utils
xterm
xinit
# Display manager (minimal - no remote access)
xserver-xorg-video-intel
xserver-xorg-video-amdgpu
xserver-xorg-video-nouveau
xserver-xorg-video-ati
# Window manager - IceWM
icewm
icewm-themes
# Remote desktop client - Remmina
remmina
remmina-plugin-rdp
remmina-plugin-vnc
# Basic utilities
vim-tiny
less
psmisc
procps
coreutils
grep
sed
gawk
tar
gzip
bzip2
xz-utils
curl
wget
# Secure boot and boot tools
efibootmgr
mokutil
efivar
# Security hardening
fail2ban
apparmor
apparmor-utils
auditd
aide
aide-common
libpam-pwquality

160
config/preseed.cfg
View File

@@ -1,160 +0,0 @@
# Debian Preseed Configuration for Football System
# This preseed file answers most questions automatically
# User only needs to set: username/password, root password, target disk
# Locale
d-i debian-installer/locale string en_US.UTF-8
d-i keyboard-configuration/xkb-keymap select us
# Network configuration (DHCP - will be reconfigured later)
d-i netcfg/choose_interface select auto
d-i netcfg/get_hostname string football
d-i netcfg/get_domain string localdomain
# Mirror configuration
d-i mirror/country string manual
d-i mirror/http/hostname string deb.debian.org
d-i mirror/http/directory string /debian
d-i mirror/http/proxy string
# Clock and timezone
d-i clock-setup/utc boolean true
d-i time/zone string UTC
# User creation - MANUAL (not automated)
# User will be prompted to create account during install
# Password complexity enforced during install via PAM
# Root password - MANUAL (not automated)
# User will be prompted for root password during install
# Password complexity enforced during install via PAM
# Partitioning - USER SELECTS DISK
# Commented out to allow user to select disk during install
# ============================================================================
# Password Complexity Enforcement (During Install)
# ============================================================================
# Enforce password complexity checks during installer
# These settings apply to BOTH root password and user password
passwd/user-password-checks string critical
passwd/user-password-weak boolean false
passwd/user-password-empty boolean false
# Password complexity (enforced by PAM during install)
# PAM will check against pwquality.conf during password entry
# See config/security-config.sh for full pwquality requirements
# Partitioning - USER WILL SELECT DISK
# Commented out to allow disk selection during install
# d-i partman-auto/method string lvm
# d-i partman-lvm/device_remove_lvm boolean true
# d-i partman-lvm/confirm boolean true
# d-i partman/choose_partition select finish
# d-i partman/confirm boolean true
# d-i partman/confirm_nooverwrite boolean true
# LVM setup
# d-i partman-auto-lvm/guided_size string max
# Base system installation
d-i base-installer/kernel/image string linux-image-amd64
# Account setup - USER WILL PROVIDE THESE
# Commented out to allow user to enter during install
# d-i passwd/user-fullname string Football User
# d-i passwd/username string user
# d-i passwd/user-password password changeme
# d-i passwd/user-password-again password changeme
# d-i passwd/root-password password changeme
# d-i passwd/root-password-again password changeme
# User is not sudo by default - will be configured later
# d-i passwd/user-default-groups string audio,dialout,video
# Package selection - Minimal system
tasksel tasksel/first multiselect standard
# Individual packages to install
# MUST include pwquality BEFORE any password setting
d-i pkgsel/include string \
libpam-pwquality \
libpwquality \
xscreensaver \
wireguard \
wireguard-tools \
vim \
less \
bash-completion \
iproute2 \
iputils-ping \
curl \
wget \
rsync \
aide \
aide-common \
auditd \
rsyslog \
logrotate \
grub-efi-amd64 \
grub-efi-amd64-bin \
efibootmgr \
dosfstools \
parted \
fdisk \
sudo \
icewm \
icewm-themes \
xorg \
xserver-xorg-video-intel \
xserver-xorg-video-ati \
xserver-xorg-video-amdgpu \
xserver-xorg-video-nouveau \
xserver-xorg-input-libinput \
xinit \
remmina \
remmina-plugin-rdp \
network-manager \
network-manager-gnome \
udisks2 \
udisks2-btrfs \
gvfs-backends \
gvfs-fuse \
xautolock \
x11-xserver-utils \
lightdm \
lightdm-gtk-greeter
# Display Manager (Graphical Login)
d-i tasksel/desktop string lightdm
d-i tasksel/first boolean true
# Boot loader
d-i grub-installer/bootdev string default
d-i grub-installer/only_debian boolean true
d-i grub-installer/with-other-os boolean true
# Finish the installation
d-i finish-install/keep-consoles boolean true
d-i finish-install/reboot_in_progress note
# Prevent package questions during install
d-i preseed/late_command string \
in-target systemctl enable lightdm && \
in-target systemctl set-default graphical.target && \
in-target systemctl mask ssh sshd 2>/dev/null || true && \
in-target systemctl disable ssh sshd 2>/dev/null || true && \
in-target systemctl mask bluetooth 2>/dev/null || true && \
in-target cp /cdrom/config/disable-wifi-bt.sh /tmp/ && \
in-target bash /tmp/disable-wifi-bt.sh && \
in-target cp /cdrom/config/security-config.sh /tmp/ && \
in-target bash /tmp/security-config.sh && \
in-target cp /cdrom/config/harden.sh /tmp/ && \
in-target bash /tmp/harden.sh && \
in-target cp /cdrom/scripts/verify-system.sh /usr/local/bin/ && \
in-target chmod +x /usr/local/bin/verify-system.sh && \
in-target cp /cdrom/config/football-first-boot.service /etc/systemd/system/ && \
in-target systemctl daemon-reload && \
in-target systemctl enable football-first-boot.service && \
in-target rm -f /tmp/disable-wifi-bt.sh /tmp/security-config.sh /tmp/harden.sh

74
config/secureboot.sh
View File

@@ -1,74 +0,0 @@
#!/bin/bash
# Secure Boot configuration script for football system
# This script ensures Secure Boot is properly configured
set -euo pipefail
echo "Configuring Secure Boot..."
# Check if Secure Boot is supported
if [ ! -d /sys/firmware/efi ]; then
echo "WARNING: EFI not detected. Secure Boot requires EFI system."
echo "This image may need to be deployed on a UEFI system with Secure Boot."
fi
# Install Secure Boot packages
apt-get update
apt-get install -y shim-signed grub-efi-amd64-signed
# Ensure GRUB is signed
echo "GRUB will use signed bootloader (shim-signed)"
# Configure kernel for Secure Boot
echo "Configuring kernel for Secure Boot..."
cat > /etc/default/grub.d/secureboot.cfg << 'EOF'
GRUB_DISABLE_OS_PROBER=true
GRUB_DISABLE_SUBMENU=y
EOF
# Lock GRUB to prevent unauthorized modifications
echo "Locking GRUB configuration..."
cat > /etc/grub.d/40_custom << 'EOF'
#!/bin/sh
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries.
# Lockdown: prevent editing GRUB entries
set superusers="football"
password_pbkdf2 football grub.pbkdf2.sha512.10000.$(echo -n "secure-boot-password" | grub-mkpasswd-pbkdf2 -s 2>/dev/null | tail -n +3 | sed 's/^.*grub\.pbkdf2\.sha512\.10000\.//')
EOF
chmod 755 /etc/grub.d/40_custom
# Update GRUB
update-grub 2>/dev/null || true
# Configure kernel command line for lockdown
echo "Configuring kernel lockdown mode..."
if [ -f /etc/default/grub ]; then
sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT=""/GRUB_CMDLINE_LINUX_DEFAULT="lockdown=confidentiality,integrity"/' /etc/default/grub
sed -i 's/^GRUB_CMDLINE_LINUX=""/GRUB_CMDLINE_LINUX="lockdown=confidentiality,integrity"/' /etc/default/grub
fi
# Enable UEFI Secure Boot verification in kernel
cat >> /etc/modprobe.d/secureboot.conf << 'EOF'
options efivarfs mode=0444
EOF
# Ensure kernel modules are signed
echo "Verifying kernel module signing..."
for module in "/lib/modules/$(uname -r)"/*.ko; do
if [ -f "$module" ]; then
sig=$(modinfo "$module" 2>/dev/null | grep -ci "signature:")
if [ "$sig" -eq 0 ]; then
echo "WARNING: Module $module is not signed"
fi
fi
done 2>/dev/null || true
echo "Secure Boot configuration complete."
echo ""
echo "IMPORTANT: When deploying to physical hardware:"
echo "1. Ensure UEFI Secure Boot is ENABLED in BIOS/UEFI settings"
echo "2. Verify that the Microsoft UEFI CA is in the key database"
echo "3. The system will only boot with signed kernel and bootloader"
echo "4. Any unsigned kernel modules will be rejected"
echo ""

224
config/security-config.sh
View File

@@ -1,224 +0,0 @@
#!/bin/bash
# Football System Security Configuration
# Applied during installation via preseed late_command
set -e
echo "Applying Football security configuration..."
# ============================================================================
# Password Complexity Enforcement
# ============================================================================
echo "Configuring password complexity..."
# Minimum requirements:
# - Minimum 12 characters
# - Require mixed case
# - Require at least one digit
# - Require at least one special character
# - Require 3 character classes
cat > /etc/security/pwquality.conf << 'EOF'
# Football Password Complexity Requirements
# Minimum password length
minlen = 12
# Maximum password length
maxlen = 64
# Minimum number of character classes required
minclass = 3
# Minimum number of uppercase letters
minupper = 1
# Minimum number of lowercase letters
minlower = 1
# Minimum number of digits
mindigit = 1
# Minimum number of special characters
minspecial = 1
# Require password to not contain username
usercheck = 1
# Require password to not contain username reversed
enforce_for_root = 1
# Reject passwords with common patterns
dictcheck = 1
# Reject passwords that contain common dictionary words
maxrepeat = 3
# Reject passwords with too many repeating characters
maxsequence = 3
# Reject passwords with sequential characters
gecoscheck = 1
# Reject passwords containing user GECOS information
badwords = football password admin root
# Reject passwords containing these words
EOF
# Configure PAM to use pwquality
cat > /etc/pam.d/common-password << 'EOF'
# PAM configuration for password quality
# Enforces Football security requirements
password requisite pam_pwquality.so try_first_pass retry=3 authtok_type=
password [success=1 default=ignore] pam_unix.so obscure sha512 rounds=5000
password sufficient pam_unix.so sha512 rounds=5000 nullok secure try_first_pass use_authtok
password required pam_deny.so
EOF
echo "✅ Password complexity configured"
echo ""
echo "Password Requirements:"
echo " • Minimum 12 characters"
echo " • Mixed case (uppercase and lowercase)"
echo " • At least one number (0-9)"
echo " • At least one special character (!@#$%^&*)"
echo " • No dictionary words or common patterns"
echo ""
# ============================================================================
# Auto-Lock After 1 Minute Idle
# ============================================================================
echo "Configuring auto-lock after 1 minute..."
# Ensure xautolock is installed (already in package list)
# Add xautolock to .xinitrc for auto-lock
if [ -f /home/user/.xinitrc ]; then
# Add xautolock to .xinitrc (before IceWM starts)
cat >> /home/user/.xinitrc << 'EOF'
# Auto-lock screen after 1 minute of idle
xautolock -time 1 -locker "xscreensaver-command -lock" -detectsleep -corners 0000 -cornerredelay 3 &
EOF
echo "✅ Auto-lock configured"
else
echo "⚠️ .xinitrc not found (will be created later)"
fi
# ============================================================================
# USB Drive Mounting
# ============================================================================
echo "Configuring USB drive mounting..."
# Create polkit rules for USB mounting
mkdir -p /etc/polkit-1/localauthority/50-local.d
cat > /etc/polkit-1/localauthority/50-local.d/10-allow-usb-mount.pkla << 'EOF'
[Allow USB Mounting]
Identity=unix-user:*
Action=org.freedesktop.udisks2.filesystem-mount
ResultAny=yes
EOF
cat > /etc/polkit-1/localauthority/50-local.d/20-allow-usb-eject.pkla << 'EOF'
[Allow USB Eject]
Identity=unix-user:*
Action=org.freedesktop.udisks2.eject-media
ResultAny=yes
EOF
# Add user to plugdev group for USB access
if id user >/dev/null 2>&1; then
usermod -a -G plugdev user
usermod -a -G cdrom user
echo "✅ User added to plugdev and cdrom groups"
fi
echo "✅ USB mounting configured"
echo ""
echo "USB Drive Mounting:"
echo " • User can mount USB drives via file manager"
echo " • USB drives appear in IceWM menu"
echo " • Use Remmina or IceWM file manager to browse USB"
echo ""
# ============================================================================
# Display Manager Configuration
# ============================================================================
echo "Configuring LightDM display manager..."
# Configure LightDM to be minimal and secure
cat > /etc/lightdm/lightdm.conf << 'EOF'
[Seat:*]
# Disable guest sessions
allow-guest=false
# Disable switching users
greeter-hide-users=true
# Disable manual user entry (shows username field, not user list)
# This allows manual username entry without displaying user list
[LightDM]
# Minimal greeter
greeter-session=lightdm-gtk-greeter
# Auto-login disabled
autologin-user=
# No auto-login timeout
autologin-user-timeout=0
[XDMCPServer]
# XDMCP disabled (no remote X sessions)
enabled=false
[Greeter]
# Minimal and secure greeter
hide-users=true
show-manual-login=true
# No guest session
allow-guest=false
# Show password field
show-password-label=true
# Minimal theme
theme-name=Adwaita
EOF
echo "✅ LightDM configured"
echo ""
echo "Display Manager Features:"
echo " • LightDM (minimal and lightweight)"
echo " • Usernames hidden (no account picking)"
echo " • Manual username/password entry"
echo " • No guest sessions"
echo " • No user switching"
echo ""
# ============================================================================
# Log Configuration
# ============================================================================
echo "Configuring logging..."
# Ensure football verification log directory exists
mkdir -p /var/log/football
echo "✅ Logging configured"
echo ""
# ============================================================================
# Complete
# ============================================================================
echo "================================================"
echo "Football Security Configuration Complete"
echo "================================================"
echo ""
echo "Applied Configurations:"
echo " ✓ Password complexity enforcement (12+ chars, mixed case, numbers, special chars)"
echo " ✓ Auto-lock after 1 minute idle"
echo " ✓ USB drive mounting enabled"
echo " ✓ Display power management disabled"
echo " ✓ Logging configured"
echo ""
echo "Security configuration successfully applied!"

79
config/setup-wg-server.sh
View File

@@ -1,79 +0,0 @@
#!/bin/bash
# WireGuard server setup script
# This script helps set up the VPN server that football systems connect to
set -e
echo "============================================="
echo "WireGuard VPN Server Setup for Football"
echo "============================================="
echo ""
# Check if running as root
if [ "$EUID" -ne 0 ]; then
echo "Please run as root"
exit 1
fi
# Install WireGuard
echo "Installing WireGuard..."
apt-get update
apt-get install -y wireguard wireguard-tools iptables-persistent
# Generate server keys
echo ""
echo "Generating server keys..."
SERVER_PRIVATE=$(wg genkey)
SERVER_PUBLIC=$(echo "$SERVER_PRIVATE" | wg pubkey)
echo "Server Public Key: $SERVER_PUBLIC"
echo "Server Private Key: $SERVER_PRIVATE"
# Create config directory
mkdir -p /etc/wireguard
# Create server configuration
cat > /etc/wireguard/wg0.conf << EOF
[Interface]
PrivateKey = $SERVER_PRIVATE
Address = 10.100.0.1/24
ListenPort = 51820
SaveConfig = true
# Enable IP forwarding
EOF
# Enable IP forwarding
echo "Enabling IP forwarding..."
sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
# Configure NAT
echo "Configuring NAT rules..."
iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o $(ip route | grep default | awk '{print $5}') -j MASQUERADE
iptables-save > /etc/iptables/rules.v4
# Allow WireGuard port
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
iptables-save > /etc/iptables/rules.v4
echo ""
echo "============================================="
echo "Server setup complete!"
echo "============================================="
echo ""
echo "Server Public Key: $SERVER_PUBLIC"
echo ""
echo "Next steps:"
echo "1. Add clients to /etc/wireguard/wg0.conf with their public keys"
echo "2. Enable the interface: systemctl enable wg-quick@wg0"
echo "3. Start the interface: systemctl start wg-quick@wg0"
echo "4. Configure firewall to allow UDP 51820"
echo ""
echo "Example client configuration:"
echo ""
echo "[Peer]"
echo "# Football Client 1"
echo "PublicKey = <CLIENT_PUBLIC_KEY>"
echo "AllowedIPs = 10.100.0.2/32"
echo ""

45
config/setup-wireguard.sh
View File

@@ -1,45 +0,0 @@
#!/bin/bash
# WireGuard configuration script for football system
# This script sets up WireGuard with provided keys
set -e
# Variables - these will be passed from build script
WG_ENDPOINT_IP="${WG_ENDPOINT_IP:-192.0.2.1}"
WG_ENDPOINT_PORT="${WG_ENDPOINT_PORT:-51820}"
WG_PRIVATE_KEY="${WG_PRIVATE_KEY}"
WG_PUBLIC_KEY="${WG_PUBLIC_KEY}"
if [ -z "$WG_PRIVATE_KEY" ] || [ -z "$WG_PUBLIC_KEY" ]; then
echo "ERROR: WireGuard keys not provided"
echo "Set WG_PRIVATE_KEY and WG_PUBLIC_KEY environment variables"
exit 1
fi
echo "Configuring WireGuard..."
# Replace placeholders in template
sed -e "s|<PRIVATE_KEY_PLACEHOLDER>|$WG_PRIVATE_KEY|g" \
-e "s|<PUBLIC_KEY_PLACEHOLDER>|$WG_PUBLIC_KEY|g" \
-e "s|<ENDPOINT_IP>|$WG_ENDPOINT_IP|g" \
-e "s|<ENDPOINT_PORT>|$WG_ENDPOINT_PORT|g" \
/etc/wireguard/wg0.conf.template > /etc/wireguard/wg0.conf
# Secure the configuration
chmod 600 /etc/wireguard/wg0.conf
# Enable and start WireGuard
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0
# Verify connection
sleep 2
if ip link show wg0 >/dev/null 2>&1; then
echo "WireGuard interface wg0 is UP"
echo "All network traffic now routed through VPN"
else
echo "WARNING: WireGuard interface not detected"
exit 1
fi
echo "WireGuard configuration complete"

397
config/user-environment.sh
View File

@@ -1,397 +0,0 @@
# Football System User Environment Configuration
# Sets up minimal UI with Remmina auto-start
# Create user directories with proper permissions
mkdir -p /home/user/.config/{icewm,remmina,autostart}
mkdir -p /home/user/.local/share/applications
mkdir -p /home/user/.local/bin
# IceWM configuration
cat > /home/user/.config/icewm/prefoverence << 'EOF'
# Football System - IceWM Minimal Configuration
# Focused on security and simplicity
# Theme and appearance
ThemeName="win95Classic"
TitleBarHeight=20
BorderSizeX=2
BorderSizeY=2
DlgBorderSizeX=2
DlgBorderSizeY=2
# Window behavior
AutoRaise=0
ClickToFocus=1
FocusOnAppRaise=1
RaiseOnFocus=0
RaiseOnClickClient=1
PassFirstClickToClient=1
ShowTaskBar=1
TaskBarAtTop=0
TaskBarShowWorkspaces=0
TaskBarShowWindowList=1
# Program menu restrictions
ShowProgramsMenu=1
ShowThemesMenu=0
ShowHelpMenu=0
ShowLogoutMenu=1
ShowLogoutSubMenu=0
ShowAboutMenu=0
ShowRunMenu=0
# Desktop restrictions
DesktopBackgroundCenter=0
DesktopBackgroundScaled=1
DesktopBackgroundColor="rgb:40/40/40"
ShowDesktopBackgroundPixmap=1
# Input settings
Win95Keys=0
ModSuperIsCtrlAlt=0
UseMouseWheel=1
# Security restrictions
DisableRealDragAndDrop=1
AllowFullscreen=0
ConfirmLogout=1
# Window placement
SmartPlacement=1
CenterTransients=1
CenterLarge=0
# Resource limits
IconPath="/usr/share/icons:/usr/share/pixmaps"
LookAndFeel=win95
# Menu security
MenuFile=/home/user/.config/icewm/menu
ProgramsFile=/home/user/.config/icewm/programs
EOF
# IceWM programs menu (restricted)
cat > /home/user/.config/icewm/programs << 'EOF'
# Football System - Restricted Programs Menu
# Application launcher
prog Terminal terminal "xterm"
prog File Manager filemanager "pcmanfm"
# System applications
prog Remmina remmina "remmina"
prog Network Status netstatus "xterm -e 'nmcli dev status'"
# System information
prog System Info sysinfo "xterm -e 'uname -a; df -h; free -m'"
prog Verification verify "xterm -e '/usr/local/bin/verify-system.sh'"
# Power management
prog Logout logout "icewm --shutdown"
prog Reboot reboot "sudo reboot"
prog Shutdown shutdown "sudo shutdown -h now"
EOF
# IceWM menu (minimal and secure)
cat > /home/user/.config/icewm/menu << 'EOF'
# Football System - Minimal Menu
menufile programs
separator
# Security tools
menu Security {
prog System Status status "xterm -e 'systemctl status'"
prog Security Audit audit "xterm -e 'sudo aide --check'"
prog Log Monitor logmon "xterm -e 'sudo journalctl -f'"
}
separator
# Network
menu Network {
prog VPN Status vpn "xterm -e 'wg show'"
prog Network Info netinfo "xterm -e 'ip addr show'"
}
separator
# Logout menu
menu Logout {
prog Lock Screen lock "xlock"
prog Logout logout "icewm --shutdown"
prog Reboot reboot "sudo reboot"
prog Shutdown shutdown "sudo shutdown -h now"
}
EOF
# Remmina desktop entry for autostart
cat > /home/user/.config/autostart/remmina.desktop << 'EOF'
[Desktop Entry]
Version=1.0
Type=Application
Name=Remmina
Comment=Remote Desktop Client
Exec=remmina
Icon=remmina
Terminal=false
Categories=Network;RemoteAccess;
X-GNOME-Autostart-enabled=true
EOF
# Desktop entry for system verification
cat > /home/user/.local/share/applications/verify-system.desktop << 'EOF'
[Desktop Entry]
Version=1.0
Type=Application
Name=System Verification
Comment=Verify Football Secure Access System
Exec=xterm -e '/usr/local/bin/verify-system.sh'
Icon=security-high
Terminal=true
Categories=System;Security;
EOF
# Desktop entry for network status
cat > /home/user/.local/share/applications/network-status.desktop << 'EOF'
[Desktop Entry]
Version=1.0
Type=Application
Name=Network Status
Comment=Check Network Connectivity
Exec=xterm -e 'nmcli dev status; echo ""; echo "VPN Status:"; wg show'
Icon=network-idle
Terminal=true
Categories=System;Network;
EOF
# Create xinitrc for IceWM session
cat > /home/user/.xinitrc << 'EOF'
#!/bin/bash
# Football System - X Session Initialization
# Set environment variables
export XDG_CONFIG_HOME=/home/user/.config
export XDG_DATA_HOME=/home/user/.local/share
export XDG_CACHE_HOME=/home/user/.cache
# Security settings
xhost +local: || true
# Load X resources (if any)
[ -f /home/user/.Xresources ] && xrdb /home/user/.Xresources
# Set desktop background (minimal)
xsetroot -solid "#282828"
# Start IceWM
exec icewm-session
EOF
# Create bash_profile for console sessions
cat > /home/user/.bash_profile << 'EOF'
# Football System - User Shell Configuration
# Prompt
PS1='[\\u@\\h \\W]\\$ '
# Security aliases
alias ll='ls -la --color=auto'
alias la='ls -a --color=auto'
alias vi='vim'
alias diff='colordiff'
# System information
alias sysinfo='echo "=== System Information ==="; uname -a; echo ""; df -h; echo ""; free -m'
alias secstatus='echo "=== Security Status ==="; systemctl status auditd rsyslog; echo ""; wg show'
# Quick access to verification
alias verify='/usr/local/bin/verify-system.sh'
alias checksec='sudo aide --check'
# Network aliases
alias netstat='nmcli dev status'
alias vpnstat='wg show'
# Security reminder
echo "Football Secure Access System v2.1"
echo "Type 'verify' to run system verification"
echo "Type 'sysinfo' for system information"
echo ""
# Check if this is a graphical session
if [ "$DISPLAY" ]; then
echo "Graphical session detected. Remmina will auto-start."
fi
EOF
# Create .bashrc for interactive shells
cat > /home/user/.bashrc << 'EOF'
# Football System - Interactive Shell Configuration
# Source bash_profile
[ -f /home/user/.bash_profile ] && . /home/user/.bash_profile
# Interactive shell settings
set -o vi
export HISTCONTROL=ignoreboth
export HISTSIZE=1000
export HISTFILESIZE=2000
# Completions
if [ -f /etc/bash_completion ]; then
. /etc/bash_completion
fi
# Enable color support
if [ -x /usr/bin/dircolors ]; then
eval "$(dircolors -b)"
fi
# Color aliases
alias grep='grep --color=auto'
alias fgrep='fgrep --color=auto'
alias egrep='egrep --color=auto'
alias ls='ls --color=auto'
EOF
# Security-focused .Xresources (minimal)
cat > /home/user/.Xresources << 'EOF'
! Football System - Minimal X Resources
! Basic font settings
*font: -*-fixed-medium-r-*-*-13-*-*-*-*-*-iso8859-1
*xfont: -*-fixed-medium-r-*-*-13-*-*-*-*-*-iso8859-1
! Terminal settings
*XTerm*background: #000000
*XTerm*foreground: #ffffff
*XTerm*font: -*-fixed-medium-r-*-*-13-*-*-*-*-*-iso8859-1
! Security - disable screen saver
!*XTerm*allowSendEvents: false
! Enable numlock
*numlock.on: true
EOF
# Remmina configuration template (secure defaults)
cat > /home/user/.config/remmina/remmina.pref << 'EOF'
[remmina_pref]
use_remmina_crypt_password=1
save_view_mode=1
default_view_mode=3
confirm_credential_saving=1
ssh_tunnel_loopback=1
disable_clipboard=0
disallow_tunneling=0
disable_automatic_reconnect=0
disable_server_input=0
disable_password_change=0
disable_automatic_reconnect=0
disable_clipboard=1
confirm_credential_saving=1
disable_menu_toolbar=1
disable_tab_previews=0
disable_quick_search=1
disable_new_connections=0
disable_profile_settings=0
allow_multiple_masterpasswords=0
remfile_v2_encryption=1
SSH_private_key_file=/home/user/.ssh/id_rsa
default_ssh_privatekey=/home/user/.ssh/id_rsa
EOF
# IceWM preferences file
cat > /home/user/.config/icewm/preferences << 'EOF'
# Football System - IceWM Preferences
# Clock settings
ClockTimeFormat="%H:%M"
ClockDateFormat="%Y-%m-%d"
ShowClock=1
# Win95-like behavior
Win95Keys=0
ShowThemesMenu=0
ShowHelpMenu=0
ShowLogoutMenu=1
ShowAboutMenu=0
ShowRunMenu=0
# Security settings
ClickToFocus=1
AutoRaise=0
RaiseOnFocus=0
DisableRealDragAndDrop=1
AllowFullscreen=0
ConfirmLogout=1
# Workspace settings
WorkspaceNames=" 1 "
Workspace1Name="Main"
ShowWorkspaces=0
WorkspaceCount=1
# Taskbar settings
TaskBarShowWorkspaces=0
TaskBarShowWindowList=1
TaskBarShowAllWindows=0
TaskBarShowApm=0
TaskBarShowMailboxStatus=0
TaskBarShowCPU=0
TaskBarShowNetStatus=0
# Input settings
ModifierKeys="Super"
UseMouseWheel=1
# Focus behavior
FocusOnAppRaise=1
PassFirstClickToClient=1
RaiseOnClickClient=1
# Window placement
SmartPlacement=1
CenterTransients=1
CenterLarge=0
# Menu behavior
MenuMouseTracking=1
SubmenuOnDelay=1
SubmenuDelay=200
# Resource limits
EdgeResistance=32
EdgeThickness=1
# Appearance
TitleBarHeight=20
BorderSizeX=2
BorderSizeY=2
DlgBorderSizeX=2
DlgBorderSizeY=2
# Colors
ColorNormalTitleBar="rgb:C0/C0/C0"
ColorActiveTitleBar="rgb:00/00/80"
ColorNormalBorder="rgb:C0/C0/C0"
ColorActiveBorder="rgb:00/00/80"
EOF
# Set proper permissions
chown -R user:user /home/user/.config
chown -R user:user /home/user/.local
chown user:user /home/user/.xinitrc
chown user:user /home/user/.bash_profile
chown user:user /home/user/.bashrc
chown user:user /home/user/.Xresources
chmod 755 /home/user
chmod 755 /home/user/.config
chmod 755 /home/user/.local
chmod 644 /home/user/.xinitrc
chmod 644 /home/user/.bash_profile
chmod 644 /home/user/.bashrc
chmod 644 /home/user/.Xresources
chmod +x /home/user/.config/autostart/remmina.desktop
chmod +x /home/user/.local/share/applications/*.desktop
echo "✅ User environment configured with IceWM and Remmina auto-start"

45
config/wg-server-config-example.conf
View File

@@ -1,45 +0,0 @@
# Sample WireGuard Server Configuration
# This is the configuration for the WireGuard VPN server
# that football systems will connect to.
#
# Usage: Copy this to /etc/wireguard/wg0.conf on the VPN server
# and adjust as needed for your environment.
[Interface]
# Private key of the VPN server
# Generate with: wg genkey
PrivateKey = <SERVER_PRIVATE_KEY>
# VPN network address (this server)
Address = 10.100.0.1/24
# Port to listen on (UDP)
ListenPort = 51820
# DNS for VPN clients
DNS = 10.100.0.1
# Enable IP forwarding on the server
# Add this to /etc/sysctl.conf: net.ipv4.ip_forward=1
# Then run: sysctl -p
# NAT configuration (POSTROUTING)
# iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
[Peer]
# Client: football-1
# Public key generated on client with: wg pubkey < client-private.key
PublicKey = <CLIENT_1_PUBLIC_KEY>
AllowedIPs = 10.100.0.2/32
[Peer]
# Client: football-2
PublicKey = <CLIENT_2_PUBLIC_KEY>
AllowedIPs = 10.100.0.3/32
[Peer]
# Client: football-3
PublicKey = <CLIENT_3_PUBLIC_KEY>
AllowedIPs = 10.100.0.4/32
# Add more [Peer] sections as needed for additional football clients

919
config/wireguard-config.sh
View File

@@ -1,919 +0,0 @@
#!/bin/bash
# Football System - WireGuard VPN Configuration
# Creates secure WireGuard VPN setup with key management
set -e
echo "Configuring WireGuard VPN..."
# Configuration variables
VPN_PORT=51820
VPN_INTERFACE=wg0
VPN_IP="10.8.0.1/24"
VPN_KEY_DIR="/etc/wireguard/keys"
VPN_CONFIG_DIR="/etc/wireguard"
VPN_LOG_DIR="/var/log/wireguard"
# Create directories
mkdir -p "$VPN_KEY_DIR"
mkdir -p "$VPN_CONFIG_DIR"
mkdir -p "$VPN_LOG_DIR"
# Set secure permissions
chmod 700 "$VPN_KEY_DIR"
chmod 755 "$VPN_CONFIG_DIR"
chmod 755 "$VPN_LOG_DIR"
# Generate server private and public keys
SERVER_PRIVATE_KEY="$VPN_KEY_DIR/server_private.key"
SERVER_PUBLIC_KEY="$VPN_KEY_DIR/server_public.key"
if [ ! -f "$SERVER_PRIVATE_KEY" ]; then
echo "Generating WireGuard server keys..."
# Generate private key
wg genkey > "$SERVER_PRIVATE_KEY"
# Generate public key from private key
wg pubkey < "$SERVER_PRIVATE_KEY" > "$SERVER_PUBLIC_KEY"
# Set secure permissions
chmod 600 "$SERVER_PRIVATE_KEY"
chmod 644 "$SERVER_PUBLIC_KEY"
chown root:root "$SERVER_PRIVATE_KEY" "$SERVER_PUBLIC_KEY"
echo "✅ WireGuard server keys generated"
else
echo "✅ WireGuard server keys already exist"
fi
# Read server public key for client configuration
SERVER_PUBKEY=$(cat "$SERVER_PUBLIC_KEY")
# Create main WireGuard server configuration
cat > "$VPN_CONFIG_DIR/wg0.conf" << EOF
# Football System - WireGuard Server Configuration
# Secure VPN for remote access
[Interface]
# Server interface configuration
Address = $VPN_IP
ListenPort = $VPN_PORT
PrivateKey = $(cat "$SERVER_PRIVATE_KEY")
# DNS for VPN clients (can use internal DNS or public)
DNS = 1.1.1.1, 8.8.8.8
# MTU (optimized for WireGuard)
MTU = 1420
# Enable connection tracking
Table = off
PostUp = iptables -A FORWARD -i $VPN_INTERFACE -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i $VPN_INTERFACE -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
# Client peers will be added here using wg-add-client.sh script
EOF
# Set secure permissions on server configuration
chmod 600 "$VPN_CONFIG_DIR/wg0.conf"
chown root:root "$VPN_CONFIG_DIR/wg0.conf"
# Create client management script
cat > /usr/local/bin/wg-add-client.sh << 'EOF'
#!/bin/bash
# Football System - WireGuard Client Management
# Adds new WireGuard client with secure key management
set -e
# Configuration
VPN_INTERFACE="wg0"
VPN_NETWORK="10.8.0.0/24"
VPN_KEY_DIR="/etc/wireguard/keys"
VPN_CLIENT_CONFIG_DIR="/etc/wireguard/clients"
VPN_BASE_IP="10.8.0"
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color
# Function to print colored output
print_info() {
echo -e "${GREEN}[INFO]${NC} $1"
}
print_warning() {
echo -e "${YELLOW}[WARNING]${NC} $1"
}
print_error() {
echo -e "${RED}[ERROR]${NC} $1"
}
# Check if running as root
if [ "$EUID" -ne 0 ]; then
print_error "This script must be run as root"
exit 1
fi
# Usage function
usage() {
echo "Usage: $0 <client_name> [client_ip_suffix]"
echo "Example: $0 charles 10"
echo "Example: $0 laptop"
echo ""
echo "client_name: Name/identifier for the client"
echo "client_ip_suffix: (optional) Last octet of client IP (e.g., 10 for 10.8.0.10)"
echo " If not provided, next available IP will be assigned"
exit 1
}
# Check arguments
if [ $# -lt 1 ] || [ $# -gt 2 ]; then
usage
fi
CLIENT_NAME="$1"
CLIENT_IP_SUFFIX="$2"
# Validate client name
if [[ ! "$CLIENT_NAME" =~ ^[a-zA-Z0-9_-]+$ ]]; then
print_error "Client name must contain only alphanumeric characters, hyphens, and underscores"
exit 1
fi
if [ ${#CLIENT_NAME} -gt 50 ]; then
print_error "Client name must be 50 characters or less"
exit 1
fi
# Create client configuration directory
mkdir -p "$VPN_CLIENT_CONFIG_DIR"
# Generate client keys
print_info "Generating keys for client: $CLIENT_NAME"
CLIENT_PRIVATE_KEY="$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}_private.key"
CLIENT_PUBLIC_KEY="$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}_public.key"
# Check if client already exists
if [ -f "$CLIENT_PRIVATE_KEY" ]; then
print_warning "Client '$CLIENT_NAME' already exists"
read -p "Do you want to regenerate keys? (y/N): " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
print_info "Using existing keys for client '$CLIENT_NAME'"
else
print_info "Regenerating keys for client '$CLIENT_NAME'"
wg genkey > "$CLIENT_PRIVATE_KEY"
wg pubkey < "$CLIENT_PRIVATE_KEY" > "$CLIENT_PUBLIC_KEY"
fi
else
wg genkey > "$CLIENT_PRIVATE_KEY"
wg pubkey < "$CLIENT_PRIVATE_KEY" > "$CLIENT_PUBLIC_KEY"
fi
# Set permissions
chmod 600 "$CLIENT_PRIVATE_KEY"
chmod 644 "$CLIENT_PUBLIC_KEY"
chown root:root "$CLIENT_PRIVATE_KEY" "$CLIENT_PUBLIC_KEY"
# Determine client IP
if [ -n "$CLIENT_IP_SUFFIX" ]; then
# Validate provided IP suffix
if [[ ! "$CLIENT_IP_SUFFIX" =~ ^[0-9]+$ ]] || [ "$CLIENT_IP_SUFFIX" -lt 2 ] || [ "$CLIENT_IP_SUFFIX" -gt 254 ]; then
print_error "Client IP suffix must be a number between 2 and 254"
exit 1
fi
CLIENT_IP="${VPN_BASE_IP}.${CLIENT_IP_SUFFIX}"
# Check if IP is already in use
if wg show | grep -q "$CLIENT_IP"; then
print_error "IP $CLIENT_IP is already in use"
exit 1
fi
else
# Find next available IP
for suffix in {2..254}; do
test_ip="${VPN_BASE_IP}.${suffix}"
if ! wg show | grep -q "$test_ip" && ! grep -r "Address.*$test_ip" "$VPN_CLIENT_CONFIG_DIR/" >/dev/null 2>&1; then
CLIENT_IP="$test_ip"
break
fi
done
if [ -z "$CLIENT_IP" ]; then
print_error "No available IP addresses in the $VPN_BASE_IP.0/24 network"
exit 1
fi
fi
# Get server public key
SERVER_PUBLIC_KEY="$VPN_KEY_DIR/server_public.key"
if [ ! -f "$SERVER_PUBLIC_KEY" ]; then
print_error "Server public key not found. Please run wireguard-config.sh first."
exit 1
fi
SERVER_PUBKEY=$(cat "$SERVER_PUBLIC_KEY")
# Add peer to server configuration
print_info "Adding client '$CLIENT_NAME' to server configuration"
cat >> "/etc/wireguard/wg0.conf" << EOF
# Client: $CLIENT_NAME
[Peer]
PublicKey = $(cat "$CLIENT_PUBLIC_KEY")
AllowedIPs = $CLIENT_IP/32
PersistentKeepalive = 25
EOF
# Create client configuration
CLIENT_CONFIG_FILE="$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}.conf"
cat > "$CLIENT_CONFIG_FILE" << EOF
# Football System - WireGuard Client Configuration
# Client: $CLIENT_NAME
# Generated on: $(date)
[Interface]
PrivateKey = $(cat "$CLIENT_PRIVATE_KEY")
Address = $CLIENT_IP/24
DNS = 1.1.1.1, 8.8.8.8
MTU = 1420
[Peer]
PublicKey = $SERVER_PUBKEY
Endpoint = $(curl -s ifconfig.me || echo "YOUR_SERVER_IP"):51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF
# Create QR code for mobile clients
if command -v qrencode >/dev/null 2>&1; then
QR_CODE_FILE="$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}.png"
qrencode -t PNG -o "$QR_CODE_FILE" < "$CLIENT_CONFIG_FILE"
print_info "QR code generated: $QR_CODE_FILE"
else
print_warning "qrencode not installed. Cannot generate QR code for mobile clients."
fi
# Set permissions on client files
chmod 600 "$CLIENT_CONFIG_FILE"
chmod 644 "$CLIENT_PUBLIC_KEY" "$QR_CODE_FILE" 2>/dev/null || true
chown root:root "$CLIENT_CONFIG_FILE" "$CLIENT_PUBLIC_KEY" "$QR_CODE_FILE" 2>/dev/null || true
# Reload WireGuard configuration
print_info "Reloading WireGuard configuration..."
if wg-quick down "$VPN_INTERFACE" >/dev/null 2>&1; then
:
fi
wg-quick up "$VPN_INTERFACE"
# Update firewall rules if needed
systemctl restart firewall-persistence.service >/dev/null 2>&1 || true
# Display summary
print_info "Client '$CLIENT_NAME' configured successfully!"
echo ""
echo "Client Configuration:"
echo "- Name: $CLIENT_NAME"
echo "- IP Address: $CLIENT_IP"
echo "- Config File: $CLIENT_CONFIG_FILE"
echo "- Private Key: $CLIENT_PRIVATE_KEY"
echo "- Public Key: $CLIENT_PUBLIC_KEY"
if [ -f "$QR_CODE_FILE" ]; then
echo "- QR Code: $QR_CODE_FILE"
fi
echo ""
echo "To connect from the client:"
echo "1. Copy the configuration file to the client device"
echo "2. Import it into WireGuard client"
echo "3. Or scan the QR code with mobile WireGuard app"
echo ""
echo "Server Endpoint: $(curl -s ifconfig.me || echo "YOUR_SERVER_IP"):51820"
# Create installation package
PACKAGE_DIR="/tmp/wireguard_client_${CLIENT_NAME}"
mkdir -p "$PACKAGE_DIR"
cp "$CLIENT_CONFIG_FILE" "$PACKAGE_DIR/"
cp "$QR_CODE_FILE" "$PACKAGE_DIR/" 2>/dev/null || true
# Create installation instructions
cat > "$PACKAGE_DIR/README.txt" << EEOF
Football System - WireGuard Client Installation
==============================================
Client Name: $CLIENT_NAME
Generated: $(date)
Files in this package:
- ${CLIENT_NAME}.conf - WireGuard configuration file
- ${CLIENT_NAME}.png - QR code for mobile clients (if generated)
Installation Instructions:
Desktop/Linux:
1. Copy ${CLIENT_NAME}.conf to /etc/wireguard/
2. Run: wg-quick up ${CLIENT_NAME}
3. To auto-start: systemctl enable wg-quick@${CLIENT_NAME}
Mobile:
1. Install WireGuard app from app store
2. Scan the QR code (or import the configuration file)
3. Toggle the connection to connect
Windows:
1. Install WireGuard for Windows
2. Click "Import tunnel(s) from file"
3. Select ${CLIENT_NAME}.conf
4. Click "Activate"
Verification:
- After connecting, you should be able to access: 10.8.0.1
- Run: ping 10.8.0.1
- For system verification: ssh user@10.8.0.1
Security Notes:
- Keep your private key secure
- Do not share the configuration file publicly
- Report any lost devices immediately
Support:
- If you lose the configuration, contact your system administrator
- Server endpoint: $(curl -s ifconfig.me || echo "YOUR_SERVER_IP"):51820
EEOF
tar -czf "/tmp/wireguard_client_${CLIENT_NAME}.tar.gz" -C "/tmp" "wireguard_client_${CLIENT_NAME}"
rm -rf "$PACKAGE_DIR"
print_info "Client package created: /tmp/wireguard_client_${CLIENT_NAME}.tar.gz"
echo ""
print_info "=== Client Configuration Summary ==="
echo "Server Public Key: $SERVER_PUBKEY"
echo "Client Private Key: $(cat "$CLIENT_PRIVATE_KEY")"
echo "Client Public Key: $(cat "$CLIENT_PUBLIC_KEY")"
echo "Client IP: $CLIENT_IP/24"
echo "Server Endpoint: $(curl -s ifconfig.me || echo "YOUR_SERVER_IP"):51820"
echo ""
print_info "Client configuration completed successfully!"
EOF
chmod 750 /usr/local/bin/wg-add-client.sh
chown root:root /usr/local/bin/wg-add-client.sh
# Create client removal script
cat > /usr/local/bin/wg-remove-client.sh << 'EOF'
#!/bin/bash
# Football System - WireGuard Client Removal
# Securely removes WireGuard client and cleans up files
set -e
# Configuration
VPN_INTERFACE="wg0"
VPN_CLIENT_CONFIG_DIR="/etc/wireguard/clients"
# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
print_info() {
echo -e "${GREEN}[INFO]${NC} $1"
}
print_warning() {
echo -e "${YELLOW}[WARNING]${NC} $1"
}
print_error() {
echo -e "${RED}[ERROR]${NC} $1"
}
# Check if running as root
if [ "$EUID" -ne 0 ]; then
print_error "This script must be run as root"
exit 1
fi
# Usage
usage() {
echo "Usage: $0 <client_name>"
echo "Example: $0 charles"
exit 1
}
# Check arguments
if [ $# -ne 1 ]; then
usage
fi
CLIENT_NAME="$1"
# Check if client exists
CLIENT_CONFIG_FILE="$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}.conf"
if [ ! -f "$CLIENT_CONFIG_FILE" ]; then
print_error "Client '$CLIENT_NAME' not found"
exit 1
fi
# Get client public key
CLIENT_PUBLIC_KEY_FILE="$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}_public.key"
if [ ! -f "$CLIENT_PUBLIC_KEY_FILE" ]; then
print_error "Client public key file not found for '$CLIENT_NAME'"
exit 1
fi
CLIENT_PUBKEY=$(cat "$CLIENT_PUBLIC_KEY_FILE")
print_info "Removing client '$CLIENT_NAME' from WireGuard configuration"
# Remove peer from server configuration
# Create backup first
cp "/etc/wireguard/wg0.conf" "/etc/wireguard/wg0.conf.backup.$(date +%Y%m%d_%H%M%S)"
# Remove client peer section from server config
sed -i "/# Client: $CLIENT_NAME/,/PersistentKeepalive = 25$/d" "/etc/wireguard/wg0.conf"
# Remove client from active configuration (if connected)
if wg show "$VPN_INTERFACE" | grep -q "$CLIENT_PUBKEY"; then
print_info "Removing client from active configuration"
wg set "$VPN_INTERFACE" peer "$CLIENT_PUBKEY" remove
fi
# Remove client files
print_info "Removing client configuration files"
rm -f "$CLIENT_CONFIG_FILE"
rm -f "$CLIENT_PUBLIC_KEY_FILE"
rm -f "$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}_private.key"
rm -f "$VPN_CLIENT_CONFIG_DIR/${CLIENT_NAME}.png"
# Reload WireGuard configuration
print_info "Reloading WireGuard configuration..."
wg-quick down "$VPN_INTERFACE" >/dev/null 2>&1 || true
wg-quick up "$VPN_INTERFACE"
print_info "Client '$CLIENT_NAME' removed successfully"
EOF
chmod 750 /usr/local/bin/wg-remove-client.sh
chown root:root /usr/local/bin/wg-remove-client.sh
# Create WireGuard status and management script
cat > /usr/local/bin/wg-manage.sh << 'EOF'
#!/bin/bash
# Football System - WireGuard Management Script
# Comprehensive WireGuard VPN status and management
# Configuration
VPN_INTERFACE="wg0"
VPN_CLIENT_CONFIG_DIR="/etc/wireguard/clients"
# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
print_header() {
echo -e "${BLUE}$1${NC}"
echo "=================================="
}
print_info() {
echo -e "${GREEN}✅ $1${NC}"
}
print_warning() {
echo -e "${YELLOW}⚠️ $1${NC}"
}
print_error() {
echo -e "${RED}❌ $1${NC}"
}
# Main menu
show_menu() {
clear
print_header "Football System - WireGuard VPN Management"
echo ""
echo "1. Show VPN Status"
echo "2. List All Clients"
echo "3. Add New Client"
echo "4. Remove Client"
echo "5. Show Client Details"
echo "6. Restart VPN Service"
echo "7. View VPN Logs"
echo "8. Backup Configuration"
echo "9. Exit"
echo ""
read -p "Select an option [1-9]: " choice
}
# VPN status
show_vpn_status() {
print_header "WireGuard VPN Status"
echo ""
if systemctl is-active --quiet wg-quick@$VPN_INTERFACE; then
print_info "VPN Service: Active"
else
print_error "VPN Service: Inactive"
fi
if systemctl is-enabled --quiet wg-quick@$VPN_INTERFACE; then
print_info "VPN Auto-start: Enabled"
else
print_warning "VPN Auto-start: Disabled"
fi
echo ""
echo "Interface Information:"
if ip link show "$VPN_INTERFACE" >/dev/null 2>&1; then
ip addr show "$VPN_INTERFACE"
else
print_warning "Interface $VPN_INTERFACE not found"
fi
echo ""
echo "Active Connections:"
if wg show "$VPN_INTERFACE" >/dev/null 2>&1; then
wg show "$VPN_INTERFACE"
echo ""
local connected_peers=$(wg show "$VPN_INTERFACE" | grep -c "peer:")
echo "Total connected peers: $connected_peers"
else
print_warning "No active WireGuard interface"
fi
echo ""
read -p "Press Enter to continue..."
}
# List clients
list_clients() {
print_header "WireGuard Client List"
echo ""
if [ ! -d "$VPN_CLIENT_CONFIG_DIR" ]; then
print_error "Client configuration directory not found"
read -p "Press Enter to continue..."
return
fi
local client_count=0
for client_config in "$VPN_CLIENT_CONFIG_DIR"/*.conf; do
if [ -f "$client_config" ]; then
((client_count++))
local client_name=$(basename "$client_config" .conf)
local client_ip=$(grep -A 5 "\[Interface\]" "$client_config" | grep "Address" | cut -d'=' -f2 | xargs)
local client_pubkey_file="$VPN_CLIENT_CONFIG_DIR/${client_name}_public.key"
if [ -f "$client_pubkey_file" ]; then
local client_pubkey=$(cat "$client_pubkey_file")
# Check if client is connected
if wg show "$VPN_INTERFACE" 2>/dev/null | grep -q "$client_pubkey"; then
local status="🟢 Connected"
else
local status="🔴 Disconnected"
fi
else
local status="⚠️ Keys Missing"
fi
echo "Client: $client_name"
echo " IP: $client_ip"
echo " Status: $status"
echo " Config: $client_config"
echo ""
fi
done
if [ "$client_count" -eq 0 ]; then
print_warning "No clients configured"
else
echo "Total clients: $client_count"
fi
read -p "Press Enter to continue..."
}
# Add client
add_client() {
print_header "Add New WireGuard Client"
echo ""
read -p "Enter client name: " client_name
if [ -z "$client_name" ]; then
print_error "Client name cannot be empty"
read -p "Press Enter to continue..."
return
fi
read -p "Enter client IP suffix (optional, press Enter for auto-assign): " ip_suffix
# Call the client addition script
if wg-add-client.sh "$client_name" "$ip_suffix"; then
print_info "Client added successfully"
else
print_error "Failed to add client"
fi
read -p "Press Enter to continue..."
}
# Remove client
remove_client() {
print_header "Remove WireGuard Client"
echo ""
if [ ! -d "$VPN_CLIENT_CONFIG_DIR" ]; then
print_error "No clients directory found"
read -p "Press Enter to continue..."
return
fi
# List available clients
local clients=()
local index=1
for client_config in "$VPN_CLIENT_CONFIG_DIR"/*.conf; do
if [ -f "$client_config" ]; then
local client_name=$(basename "$client_config" .conf)
clients+=("$client_name")
echo "$index. $client_name"
((index++))
fi
done
if [ ${#clients[@]} -eq 0 ]; then
print_warning "No clients found"
read -p "Press Enter to continue..."
return
fi
echo ""
read -p "Select client to remove [1-${#clients[@]}]: " choice
if [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le ${#clients[@]} ]; then
local selected_client="${clients[$((choice-1))]}"
echo ""
echo "Selected client: $selected_client"
read -p "Are you sure you want to remove this client? (y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
if wg-remove-client.sh "$selected_client"; then
print_info "Client '$selected_client' removed successfully"
else
print_error "Failed to remove client '$selected_client'"
fi
else
print_info "Client removal cancelled"
fi
else
print_error "Invalid selection"
fi
read -p "Press Enter to continue..."
}
# Show client details
show_client_details() {
print_header "Client Details"
echo ""
read -p "Enter client name: " client_name
if [ -z "$client_name" ]; then
print_error "Client name cannot be empty"
read -p "Press Enter to continue..."
return
fi
local client_config="$VPN_CLIENT_CONFIG_DIR/${client_name}.conf"
if [ ! -f "$client_config" ]; then
print_error "Client '$client_name' not found"
read -p "Press Enter to continue..."
return
fi
echo "Client Configuration for: $client_name"
echo "======================================"
cat "$client_config"
echo ""
echo "Files:"
echo "- Config: $client_config"
echo "- Private Key: $VPN_CLIENT_CONFIG_DIR/${client_name}_private.key"
echo "- Public Key: $VPN_CLIENT_CONFIG_DIR/${client_name}_public.key"
echo "- QR Code: $VPN_CLIENT_CONFIG_DIR/${client_name}.png"
read -p "Press Enter to continue..."
}
# Restart VPN service
restart_vpn() {
print_header "Restart VPN Service"
echo ""
print_info "Stopping VPN service..."
systemctl stop wg-quick@$VPN_INTERFACE
sleep 2
print_info "Starting VPN service..."
systemctl start wg-quick@$VPN_INTERFACE
sleep 2
if systemctl is-active --quiet wg-quick@$VPN_INTERFACE; then
print_info "VPN service restarted successfully"
else
print_error "VPN service failed to restart"
fi
read -p "Press Enter to continue..."
}
# View logs
view_logs() {
print_header "WireGuard Logs"
echo ""
echo "Recent systemd logs:"
journalctl -u wg-quick@$VPN_INTERFACE --since "1 hour ago" -n 20 --no-pager
echo ""
echo "System log entries (last 10):"
grep -i wireguard /var/log/syslog | tail -10
echo ""
read -p "Press Enter to continue..."
}
# Backup configuration
backup_config() {
print_header "Backup WireGuard Configuration"
echo ""
local backup_dir="/var/backups/wireguard"
local backup_file="wireguard_backup_$(date +%Y%m%d_%H%M%S).tar.gz"
mkdir -p "$backup_dir"
print_info "Creating backup..."
tar -czf "$backup_dir/$backup_file" -C /etc/wireguard .
if [ -f "$backup_dir/$backup_file" ]; then
print_info "Backup created successfully: $backup_dir/$backup_file"
local backup_size=$(du -h "$backup_dir/$backup_file" | cut -f1)
echo "Backup size: $backup_size"
# Show backup contents
echo ""
echo "Backup contents:"
tar -tzf "$backup_dir/$backup_file"
else
print_error "Failed to create backup"
fi
read -p "Press Enter to continue..."
}
# Main loop
main() {
while true; do
show_menu
case $choice in
1) show_vpn_status ;;
2) list_clients ;;
3) add_client ;;
4) remove_client ;;
5) show_client_details ;;
6) restart_vpn ;;
7) view_logs ;;
8) backup_config ;;
9) print_info "Exiting WireGuard Management"; exit 0 ;;
*) print_error "Invalid option. Please select 1-9."; sleep 2 ;;
esac
done
}
# Check if running as root
if [ "$EUID" -ne 0 ]; then
echo "This script must be run as root"
exit 1
fi
# Start the management interface
main
EOF
chmod 750 /usr/local/bin/wg-manage.sh
chown root:root /usr/local/bin/wg-manage.sh
# Create systemd service for WireGuard
cat > /etc/systemd/system/wireguard-manager.service << 'EOF'
[Unit]
Description=WireGuard VPN Management Service
Documentation=man:wg(8)
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/wg-quick up wg0
ExecStop=/usr/bin/wg-quick down wg0
ExecReload=/usr/bin/wg-quick down wg0 && /usr/bin/wg-quick up wg0
# Security settings
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/etc/wireguard /var/log/wireguard /run
PrivateTmp=yes
[Install]
WantedBy=multi-user.target
EOF
# Enable and start WireGuard
systemctl daemon-reload
systemctl enable wireguard-manager.service
systemctl start wireguard-manager.service
# Create log rotation for WireGuard
cat > /etc/logrotate.d/wireguard << 'EOF'
# Football System - WireGuard Log Rotation
/var/log/wireguard/*.log {
daily
rotate 30
compress
delaycompress
missingok
notifempty
create 0640 root adm
sharedscripts
postrotate
systemctl reload rsyslog >/dev/null 2>&1 || true
endscript
}
EOF
chmod 644 /etc/logrotate.d/wireguard
chown root:root /etc/logrotate.d/wireguard
# Start WireGuard interface
print_info "Starting WireGuard VPN interface..."
if wg-quick up wg0; then
print_info "WireGuard VPN started successfully"
else
print_warning "WireGuard VPN started with warnings (common on first boot)"
fi
# Display summary
echo ""
print_info "=== WireGuard VPN Configuration Summary ==="
echo "✅ WireGuard server configured"
echo "✅ Interface: wg0"
echo "✅ VPN Network: 10.8.0.0/24"
echo "✅ Server IP: 10.8.0.1"
echo "✅ Listen Port: 51820"
echo ""
echo "Management Tools:"
echo "- Add client: wg-add-client.sh <client_name>"
echo "- Remove client: wg-remove-client.sh <client_name>"
echo "- Interactive management: wg-manage.sh"
echo ""
echo "Server Public Key:"
echo "$(cat "$SERVER_PUBLIC_KEY")"
echo ""
echo "Server Endpoint:"
echo "$(curl -s ifconfig.me || echo "YOUR_SERVER_IP"):51820"
echo ""
echo "Files created:"
echo "- Server config: /etc/wireguard/wg0.conf"
echo "- Client configs: /etc/wireguard/clients/"
echo "- Keys: /etc/wireguard/keys/"
echo "- Logs: /var/log/wireguard/"
echo ""
print_info "WireGuard VPN configuration completed successfully!"

277
docs/BUILD-DOCUMENTATION.md
View File

@@ -1,277 +0,0 @@
# Football ISO Build Documentation
## Overview
Football uses an ISO-based installer approach with embedded preseed configuration. The build system creates a bootable Debian installer ISO that automates most of the installation process.
## Directory Structure
```
football/
├── AGENTS.md # Main project documentation (AI agent reference)
├── README.md # Quick start guide
├── LICENSE # License file
├── .gitignore # Git ignore rules
├── .dockerignore # Docker ignore rules
│
├── scripts/ # Build and test scripts
│ ├── build-iso.sh # Main ISO build script (Docker-based)
│ └── test-iso.sh # ISO testing script (QEMU VM boot)
│
├── config/ # Configuration files
│ └── preseed.cfg # Debian preseed automation file
│
├── docs/ # Documentation
│ ├── COMPLIANCE.md # Compliance requirements
│ ├── INCIDENT-RESPONSE.md # Incident response procedures
│ ├── SECURITY-BASELINES.md # Security baselines
│ ├── SECURITY-POLICY.md # Security policies
│ ├── TEST-EVIDENCE.md # Test evidence and results
│ └── old/ # Archived old documentation
│
├── tests/ # Test scripts
│ ├── verify-compliance.sh # Compliance verification
│ ├── compliance-test.sh # Full compliance test suite
│ └── build-and-test.sh # VM-based testing
│
├── keys/ # WireGuard keys (generated by users)
│
├── logs/ # Build and test logs
│
├── output/ # Build output artifacts
│ └── football-installer.iso (generated by build-iso.sh)
│
├── iso-tmp/ # Temporary ISO build directory (in .gitignore)
│
├── Dockerfile.dev # Fat development container
└── Dockerfile.test # Test container
```
## Build Process
### Step 1: Create Preseed Configuration
The `config/preseed.cfg` file contains Debian installer automation:
- **Automated Steps** (no user interaction required):
- Locale and language settings
- Network configuration (DHCP)
- Partitioning (LVM, auto)
- Timezone
- Package selection
- Boot loader installation
- **Manual Steps** (user must provide):
- Username creation
- User password (min 12 chars, mixed case, numbers, special chars)
- Root password (min 12 chars, mixed case, numbers, special chars)
- Target disk/partition selection
### Step 2: Build ISO
Run `./scripts/build-iso.sh` which:
1. **Downloads Debian ISO** (in Docker)
- Fetches Debian netinst ISO from official mirrors
- Uses sid/testing (Debian 13 is still testing)
2. **Extracts ISO** (in Docker)
- Extracts ISO contents to temporary directory
- Preserves ISO structure
3. **Injects Preseed** (in Docker)
- Copies `config/preseed.cfg` to ISO root
- Modifies `isolinux/isolinux.cfg` to auto-load preseed
- Sets default boot to use preseed configuration
4. **Recreates ISO** (in Docker)
- Uses xorriso to create new hybrid ISO
- Supports both BIOS and UEFI boot
- Preserves all Debian installer features
5. **Verifies ISO** (in Docker)
- Checks ISO file exists
- Verifies file size and type
Output: `output/football-installer.iso`
### Step 3: Test ISO
Run `./scripts/test-iso.sh` which:
1. **Creates Test Disk** (in Docker)
- Creates 16GB QCOW2 disk for VM
- Used for testing installation
2. **Boots VM** (on host, using screen)
- Boots QEMU with 2GB RAM, 2 CPUs
- Uses `output/football-installer.iso` as boot device
- Creates 16GB test disk for installation
- Runs in background with screen session
- Saves console output to `output/vm-console.log`
3. **Monitors Installation**
- Waits 120 seconds for installer to start
- Checks for installation prompts
- Monitors for errors or kernel panic
Access VM console: `screen -r football-iso-test`
Detach from VM: `Ctrl+A`, then `D`
## Deployment
### Bare Metal Deployment
1. **Write ISO to USB**
```bash
sudo dd if=output/football-installer.iso of=/dev/sdX bs=4M status=progress
sync
```
2. **Boot from USB**
- Enter BIOS/UEFI
- Select USB as boot device
3. **Run Installer**
- Preseed auto-answers most questions
- Provide only:
- Username
- Password
- Root password
- Target disk
4. **Post-Install Configuration**
- Security configurations applied via preseed late_command
- WireGuard configured
- Firewall rules applied
- Services configured
### Virtual Machine Deployment
1. **Create VM Disk**
```bash
qemu-img create -f qcow2 football-disk.qcow2 16G
```
2. **Boot VM from ISO**
```bash
qemu-system-x86_64 \
-m 2048 \
-smp 2 \
-drive file=football-disk.qcow2,format=qcow2 \
-drive file=output/football-installer.iso,media=cdrom,readonly=on \
-boot d
```
3. **Run Installer**
- Same process as bare metal
## Docker Containers
### football-dev (Dockerfile.dev)
Fat development container with all build tools:
- `qemu-utils` - QEMU disk utilities
- `qemu-system-x86_64` - QEMU system emulator
- `grub-*` - GRUB bootloader tools
- `parted`, `fdisk`, `sfdisk` - Partitioning tools
- `xorriso` - ISO creation tool
- `wireguard` - WireGuard tools
- All other required build utilities
Usage:
```bash
docker build -t football-dev -f Dockerfile.dev .
docker run --rm -it -v "$PWD:/project" football-dev bash
```
### football-test (Dockerfile.test)
Lightweight test container for running tests:
- `bash` - Shell
- `shellcheck` - Shell script linting
- `shunit2` - Bash unit testing
- Basic utilities
Usage:
```bash
docker build -t football-test -f Dockerfile.test .
docker run --rm -v "$PWD:/test" football-test ./tests/verify-compliance.sh
```
## Security Features
Applied during installation via preseed:
1. **Network Isolation**
- All inbound traffic blocked
- WireGuard-only outbound traffic
- Mandatory VPN tunnel
2. **Service Restrictions**
- SSH disabled and masked
- All remote access services removed
- Bluetooth disabled
3. **System Hardening**
- Secure Boot enabled
- AppArmor enforcing
- Auditd logging enabled
- Fail2Ban configured
4. **Minimal Attack Surface**
- Only IceWM and Remmina installed
- No development tools
- Minimal command-line utilities
## Troubleshooting
### Build Issues
**Problem**: ISO download fails
- **Solution**: Check network connectivity and Debian mirror availability
**Problem**: ISO creation fails
- **Solution**: Check xorriso installation in container
**Problem**: Preseed not working
- **Solution**: Check `config/preseed.cfg` syntax and boot command
### Test Issues
**Problem**: VM won't boot from ISO
- **Solution**: Check ISO file integrity and QEMU boot order
**Problem**: Installer not using preseed
- **Solution**: Check ISO boot command in `isolinux/isolinux.cfg`
**Problem**: Screen session issues
- **Solution**: Ensure screen is installed and properly configured
## Next Steps
After successful build and test:
1. **Deploy to target systems**
- Write ISO to USB
- Boot on bare metal or VM
- Complete installation with preseed
2. **Customize for environment**
- Update WireGuard configuration
- Add required packages
- Adjust security policies
3. **Verify compliance**
- Run `./tests/verify-compliance.sh`
- Run `./tests/compliance-test.sh`
- Document test results
## References
- [Debian Preseed Documentation](https://www.debian.org/releases/stable/amd64/apbs02.html.en)
- [CIS Debian Benchmark](https://www.cisecurity.org/benchmark/debian_linux)
- [WireGuard Documentation](https://www.wireguard.com/docs/)
- [Debian 13 (Trixie) Release Notes](https://www.debian.org/releases/trixie/releasenotes)

925
docs/COMPLIANCE.md
View File

@@ -1,925 +0,0 @@
# Compliance Documentation - Football Secure Access System
## Executive Summary
The Football Secure Access System is designed to meet Tier0 infrastructure protection requirements for high-security environments. This document demonstrates compliance with:
- **CIS Debian 13 Benchmark** - Version 3.0.0
- **CMMC Level 3** - Controlled Unclassified Information (CUI)
- **FedRAMP Moderate** - Federal Risk and Authorization Management Program
- **NIST SP 800-53 Moderate** - Security and Privacy Controls
- **NIST SP 800-171** - Protecting Controlled Unclassified Information
## Compliance Matrix
### 1. CIS Debian 13 Benchmark Compliance
| Section | Control | Implementation | Status |
|---------|---------|----------------|--------|
| 1.1.1 | Disable unused filesystems | modprobe.d/no-network-fs.conf | ✓ |
| 1.1.2.1 | Ensure mounting of cramfs disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.2.2 | Ensure mounting of freevxfs disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.2.3 | Ensure mounting of jffs2 disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.2.4 | Ensure mounting of hfs disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.2.5 | Ensure mounting of hfsplus disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.2.6 | Ensure mounting of squashfs disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.2.7 | Ensure mounting of udf disabled | modprobe.d/disable-autoload.conf | ✓ |
| 1.1.3 | Ensure /tmp is configured | /tmp permissions, tmpfs | ✓ |
| 1.1.4 | Ensure nodev option set for /tmp | /tmp mount options | ✓ |
| 1.1.5 | Ensure nosuid option set for /tmp | /tmp mount options | ✓ |
| 1.1.6 | Ensure noexec option set for /tmp | /tmp mount options | ✓ |
| 1.1.7 | Ensure /var/tmp is configured | /var/tmp permissions | ✓ |
| 1.1.12 | Ensure separate partition exists for /var/log | Not applicable (minimal system) | N/A |
| 1.1.13 | Ensure separate partition exists for /var/log/audit | Separate audit log directory | ✓ |
| 1.1.14 | Ensure separate partition exists for /home | Minimal system, single partition | N/A |
| 1.1.15 | Ensure nodev option set for /home | N/A | N/A |
| 1.1.16 | Ensure nodev option set for /dev/shm | sysctl.conf | ✓ |
| 1.1.17 | Ensure nosuid option set for /dev/shm | sysctl.conf | ✓ |
| 1.1.18 | Ensure noexec option set for /dev/shm | sysctl.conf | ✓ |
| 1.1.19 | Ensure sticky bit is set on all world-writable directories | chmod +t on /tmp, /var/tmp | ✓ |
| 1.1.20 | Disable Automounting | No automounter installed | ✓ |
| 1.2.1 | Ensure package manager repositories are configured | sources.list | ✓ |
| 1.2.2 | Ensure GPG keys are configured | apt-keyring | ✓ |
| 1.3.1 | Ensure AIDE is installed | aide package installed | ✓ |
| 1.3.2 | Ensure filesystem integrity is regularly checked | aide-check.timer | ✓ |
| 1.4.1 | Ensure permissions on /etc/passwd are configured | chmod 644 /etc/passwd | ✓ |
| 1.4.2 | Ensure permissions on /etc/shadow are configured | chmod 640 /etc/shadow | ✓ |
| 1.4.3 | Ensure permissions on /etc/group are configured | chmod 644 /etc/group | ✓ |
| 1.4.4 | Ensure permissions on /etc/gshadow are configured | chmod 640 /etc/gshadow | ✓ |
| 1.5.1 | Ensure password expiration is 90 days or less | PASS_MAX_DAYS=90 | ✓ |
| 1.5.2 | Ensure minimum days between password changes is configured | PASS_MIN_DAYS=1 | ✓ |
| 1.5.3 | Ensure password expiration warning days is 7 or more | PASS_WARN_AGE=7 | ✓ |
| 1.5.4 | Ensure inactive password lock is 30 days or less | account locking via faillock | ✓ |
| 1.6.1 | Ensure password creation requirements are configured | pwquality.conf | ✓ |
| 1.6.2 | Ensure lockout for failed password attempts is configured | faillock.conf (5 attempts) | ✓ |
| 1.7.1.1 | Ensure authentication required for single user mode | Not applicable (UEFI only) | N/A |
| 1.8.1 | Ensure permissions on bootloader config are configured | chmod 600 /boot/efi/* | ✓ |
| 1.8.2 | Ensure bootloader password is set | GRUB superuser password | ✓ |
| 1.8.3 | Ensure authentication required for boot loader entries | GRUB superuser password | ✓ |
| 1.9 | Ensure updates, patches, and additional security software are installed | Manual update process | ✓ |
| 1.10.1 | Ensure system-wide crypto policy is not set to LEGACY | Default policy used | ✓ |
| 1.10.2 | Ensure FIPS mode is enabled | Not enabled (minimal system) | N/A |
| 2.1.1 | Ensure time synchronization is in use | systemd-timesyncd | ✓ |
| 2.2.1 | Ensure X11 server components are not installed | Only X11 for IceWM/Remmina | ✓ |
| 2.2.2 | Ensure Avahi Server is not installed | Not installed | ✓ |
| 2.2.3 | Ensure CUPS is not installed | Not installed | ✓ |
| 2.2.4 | Ensure DHCP Server is not installed | Not installed | ✓ |
| 2.2.5 | Ensure LDAP server is not installed | Not installed | ✓ |
| 2.2.6 | Ensure NFS and RPC are not installed | disabled via modprobe.d | ✓ |
| 2.2.7 | Ensure DNS Server is not installed | Not installed | ✓ |
| 2.2.8 | Ensure FTP Server is not installed | Not installed | ✓ |
| 2.2.9 | Ensure HTTP server is not installed | Not installed | ✓ |
| 2.2.10 | Ensure IMAP and POP3 server are not installed | Not installed | ✓ |
| 2.2.11 | Ensure Samba is not installed | disabled via modprobe.d | ✓ |
| 2.2.12 | Ensure HTTP Proxy Server is not installed | Not installed | ✓ |
| 2.2.13 | Ensure SNMP Server is not installed | Not installed | ✓ |
| 2.2.14 | Ensure mail transfer agent is configured for local-only | Not installed | ✓ |
| 2.2.15 | Ensure rsync service is not installed | Not installed | ✓ |
| 2.2.16 | Ensure NIS Server is not installed | Not installed | ✓ |
| 2.2.17 | Ensure rsh server is not installed | Removed/masked | ✓ |
| 2.2.18 | Ensure talk server is not installed | Not installed | ✓ |
| 2.2.19 | Ensure telnet server is not installed | Removed/masked | ✓ |
| 2.2.20 | Ensure tftp server is not installed | Not installed | ✓ |
| 2.2.21 | Ensure xinetd is not installed | Not installed | ✓ |
| 2.2.22 | Ensure OpenSSH Server is not installed | Removed/masked | ✓ |
| 2.3.1 | Ensure NTP Client is configured | systemd-timesyncd | ✓ |
| 2.3.2 | Ensure chrony is configured (if using) | Not used | N/A |
| 2.3.3 | Ensure chrony is not running as root | Not used | N/A |
| 3.1.1 | Ensure IP forwarding is disabled | net.ipv4.ip_forward=0 | ✓ |
| 3.1.2 | Ensure packet redirect sending is disabled | net.ipv4.conf.all.send_redirects=0 | ✓ |
| 3.2.1 | Ensure source routed packets are not accepted | net.ipv4.conf.all.accept_source_route=0 | ✓ |
| 3.2.2 | Ensure ICMP redirect messages are not accepted | net.ipv4.conf.all.accept_redirects=0 | ✓ |
| 3.2.3 | Ensure secure ICMP redirects are not accepted | net.ipv4.conf.all.secure_redirects=0 | ✓ |
| 3.2.4 | Ensure suspicious packets are logged | net.ipv4.conf.all.log_martians=1 | ✓ |
| 3.2.5 | Ensure broadcast ICMP requests are ignored | net.ipv4.icmp_echo_ignore_broadcasts=1 | ✓ |
| 3.2.6 | Ensure bogus ICMP responses are ignored | net.ipv4.icmp_ignore_bogus_error_responses=1 | ✓ |
| 3.2.7 | Ensure Reverse Path Filtering is enabled | net.ipv4.conf.all.rp_filter=1 | ✓ |
| 3.2.8 | Ensure TCP SYN Cookies is enabled | net.ipv4.tcp_syncookies=1 | ✓ |
| 3.3.1 | Ensure IPv6 router advertisements are not accepted | IPv6 blocked | ✓ |
| 3.3.2 | Ensure IPv6 redirects are not accepted | IPv6 blocked | ✓ |
| 3.3.3 | Ensure IPv6 is disabled | Blocked by firewall | ✓ |
| 3.4.1 | Ensure TCP Wrappers is installed | Not needed (no remote services) | N/A |
| 3.4.2 | Ensure /etc/hosts.allow is configured | Not needed | N/A |
| 3.4.3 | Ensure /etc/hosts.deny is configured | Firewall used instead | ✓ |
| 3.4.4 | Ensure SSH is configured (if SSH is running) | SSH removed | N/A |
| 3.5.1.1 | Ensure firewalld is installed | iptables-persistent used | N/A |
| 3.5.1.2 | Ensure nftables is installed | iptables used | N/A |
| 3.5.1.3 | Ensure iptables is installed | iptables installed | ✓ |
| 3.5.1.4 | Ensure default deny firewall policy | iptables -P INPUT DROP | ✓ |
| 3.5.2.1 | Ensure loopback traffic is configured | iptables -i lo -j ACCEPT | ✓ |
| 3.5.2.2 | Ensure outbound and established connections are configured | WireGuard-only allowed | ✓ |
| 3.5.2.3 | Ensure firewall rules exist for all open ports | Only WireGuard allowed | ✓ |
| 3.5.2.4 | Ensure firewall rules exist for all network interfaces | Specific rules for eth0/wg0 | ✓ |
| 3.6.1 | Ensure wireless interfaces are disabled | modprobe.d/disable-wireless.conf | ✓ |
| 3.6.2 | Ensure IPv6 is disabled | Blocked by firewall | ✓ |
| 4.1.1 |1 | Configure Data Retention | 365 days (logrotate) | ✓ |
| 4.1.1.2 | Configure systemd-journald | journald.conf | ✓ |
| 4.1.1.3 | Ensure rsyslog is installed | rsyslog installed | ✓ |
| 4.1.1.4 | Ensure rsyslog Service is enabled | systemctl enable rsyslog | ✓ |
| 4.1.1.5 | Ensure logging is configured | rsyslog.d/50-cis-logging.conf | ✓ |
| 4.1.1.6 | Ensure rsyslog default file permissions configured | FileCreateMode 0640 | ✓ |
| 4.1.1.7 | Ensure logrotate is configured | /etc/logrotate.d/cis-logs | ✓ |
| 4.1.1.8 | Ensure logrotate.conf mode is configured | logrotate permissions | ✓ |
| 4.1.1.9 | Ensure logrotate.conf ownership is configured | root ownership | ✓ |
| 4.1.1.10 | Ensure rsyslog is configured to send logs to a remote host | Disabled (local only) | N/A |
| 4.1.2 | Ensure permissions on log files are configured | Proper ownership/permissions | ✓ |
| 4.1.2.1 | Ensure the system is configured to log audit records | auditd enabled | ✓ |
| 4.1.2.2 | Ensure auditd service is enabled | systemctl enable auditd | ✓ |
| 4.1.2.3 | Ensure auditing for processes that start prior to auditd | audispd-plugins | ✓ |
| 4.1.2.4 | Ensure audit_backlog_limit is sufficient | audit rules configured | ✓ |
| 4.1.2.5 | Ensure audit logs are not automatically deleted | logrotate configured | ✓ |
| 4.1.2.6 | Ensure audit logs are stored | /var/log/audit/ | ✓ |
| 4.1.2.7 | Ensure audit records are stored | auditd configured | ✓ |
| 4.1.2.8 | Ensure audit log files are mode 0640 or more restrictive | chmod 0640 | ✓ |
| 4.1.2.9 | Ensure audit log files are owned by root | root ownership | ✓ |
| 4.1.2.10 | Ensure audit logs group is root | root group | ✓ |
| 4.1.2.11 | Ensure audit logs are not automatically deleted | logrotate configured | ✓ |
| 4.1.3 | Ensure events that modify date and time are collected | audit rules | ✓ |
| 4.1.4 | Ensure events that modify user/group information are collected | audit rules | ✓ |
| 4.1.5 | Ensure events that modify the system's network environment are collected | audit rules | ✓ |
| 4.1.6 | Ensure events that modify the system's Mandatory Access Controls are collected | audit rules | ✓ |
| 4.1.7 | Ensure login and logout events are collected | audit rules | ✓ |
| 4.1.8 | Ensure session initiation information is collected | audit rules | ✓ |
| 4.1.9 | Ensure discretionary access control permission modification events are collected | audit rules | ✓ |
| 4.1.10 | Ensure successful file system mounts are collected | audit rules | ✓ |
| 4.1.11 | Ensure use of privileged commands is collected | audit rules | ✓ |
| 4.1.12 | Ensure unsuccessful file access attempts are collected | audit rules | ✓ |
| 4.1.13 | Ensure privileged use of sudo is collected | audit rules | ✓ |
| 4.1.14 | Ensure kernel module loading and unloading is collected | audit rules | ✓ |
| 4.1.15 | Ensure the audit configuration is immutable | audit rules | ✓ |
| 5.1.1 | Ensure cron daemon is enabled and running | systemctl enable cron | ✓ |
| 5.1.2 | Ensure permissions on /etc/crontab are configured | chmod 640 /etc/crontab | ✓ |
| 5.1.3 | Ensure permissions on /etc/cron.hourly are configured | chmod 750 | ✓ |
| 5.1.4 | Ensure permissions on /etc/cron.daily are configured | chmod 750 | ✓ |
| 5.1.5 | Ensure permissions on /etc/cron.weekly are configured | chmod 750 | ✓ |
| 5.1.6 | Ensure permissions on /etc/cron.monthly are configured | chmod 750 | ✓ |
| 5.1.7 | Ensure permissions on /etc/cron.d are configured | chmod 750 | ✓ |
| 5.1.8 | Ensure at/cron is restricted to authorized users | cron.allow/deny | ✓ |
| 5.2.1 | Ensure SSH server is not installed | Removed/masked | ✓ |
| 5.2.2 | Ensure permissions on /etc/ssh/sshd_config are configured | N/A (SSH removed) | N/A |
| 5.2.3 | Ensure permissions on SSH private host key files are configured | N/A (SSH removed) | N/A |
| 5.2.4 | Ensure permissions on SSH public host key files are configured | N/A (SSH removed) | N/A |
| 5.2.5 | Ensure SSH Protocol 2 is set to yes | N/A (SSH removed) | N/A |
| 5.2.6 | Ensure SSH LogLevel is set to INFO | N/A (SSH removed) | N/A |
| 5.2.7 | Ensure SSH X11 forwarding is disabled | N/A (SSH removed) | N/A |
| 5.2.8 | Ensure SSH MaxAuthTries is set to 4 or less | N/A (SSH removed) | N/A |
| 5.2.9 | Ensure SSH IgnoreRhosts is enabled | N/A (SSH removed) | N/A |
| 5.2.10 | Ensure SSH HostbasedAuthentication is disabled | N/A (SSH removed) | N/A |
| 5.2.11 | Ensure SSH PermitRootLogin is disabled | N/A (SSH removed) | N/A |
| 5.2.12 | Ensure SSH PermitEmptyPasswords is disabled | N/A (SSH removed) | N/A |
| 5.2.13 | Ensure SSH PermitUserEnvironment is disabled | N/A (SSH removed) | N/A |
| 5.2.14 | Ensure SSH client alive interval is configured | N/A (SSH removed) | N/A |
| 5.2.15 | Ensure SSH client alive count max is configured | N/A (SSH removed) | N/A |
| 5.2.16 | Ensure SSH login grace time is set to one minute or less | N/A (SSH removed) | N/A |
| 5.2.17 | Ensure SSH access is limited | N/A (SSH removed) | N/A |
| 5.2.18 | Ensure SSH warning banner is configured | /etc/issue.net | ✓ |
| 5.2.19 | Ensure SSH PAM is enabled | N/A (SSH removed) | N/A |
| 5.2.20 | Ensure SSH AllowTcpForwarding is disabled | N/A (SSH removed) | N/A |
| 5.2.21 | Ensure SSH MaxStartups is configured | N/A (SSH removed) | N/A |
| 5.2.22 | Ensure SSH MaxSessions is configured | N/A (SSH removed) | N/A |
| 5.3.1 | Ensure permissions on /etc/passwd- are configured | Permissions set | ✓ |
| 5.3.2 | Ensure permissions on /etc/shadow- are configured | Permissions set | ✓ |
| 5.3.3 | Ensure permissions on /etc/group- are configured | Permissions set | ✓ |
| 5.3.4 | Ensure permissions on /etc/gshadow- are configured | Permissions set | ✓ |
| 5.3.5 | Ensure permissions on /etc/passwd are configured | Permissions set | ✓ |
| 5.3.6 | Ensure permissions on /etc/shadow are configured | Permissions set | ✓ |
| 5.3.7 | Ensure permissions on /etc/group are configured | Permissions set | ✓ |
| 5.3.8 | Ensure permissions on /etc/gshadow are configured | Permissions set | ✓ |
| 5.4.1.1 | Ensure password creation requirements are configured | pwquality.conf | ✓ |
| 5.4.1.2 | Ensure lockout for failed password attempts is configured | faillock.conf | ✓ |
| 5.4.1.3 | Ensure password reuse is limited | pam_pwhistory | ✓ |
| 5.4.2 | Ensure password hashing algorithm is SHA-512 | ENCRYPT_METHOD SHA512 | ✓ |
| 5.4.3 | Ensure system accounts are secured | Locked via usermod -L | ✓ |
| 5.4.4 | Ensure default group for the root account is GID 0 | Default configuration | ✓ |
| 5.4.5 | Ensure default umask for users is 077 | UMASK 077 | ✓ |
| 6.1.1 | Ensure system accounts are non-login | Locked and no shell | ✓ |
| 6.1.2 | Ensure root PATH integrity is secure | Path restricted | ✓ |
| 6.1.3 | Ensure all users' home directories exist | Created for user | ✓ |
| 6.1.4 | Ensure users' home directories permissions are 750 or more restrictive | Permissions set | ✓ |
| 6.1.5 | Ensure users own their home directories | Ownership verified | ✓ |
| 6.1.6 | Ensure users' dot files are not group or world writable | Permissions verified | ✓ |
| 6.1.7 | Ensure no users have .forward files | Not used | N/A |
| 6.1.8 | Ensure no users have .netrc files | Not used | N/A |
| 6.1.9 | Ensure no users have .rhosts files | Not used | N/A |
| 6.1.10 | Ensure all groups in /etc/passwd exist in /etc/group | Verified | ✓ |
| 6.1.11 | Ensure no duplicate UIDs exist | Verified | ✓ |
| 6.1.12 | Ensure no duplicate GIDs exist | Verified | ✓ |
| 6.1.13 | Ensure no duplicate user names exist | Verified | ✓ |
| 6.1.14 | Ensure no duplicate group names exist | Verified | ✓ |
| 6.2.1 | Ensure root is the only UID 0 account | Verified | ✓ |
| 6.2.2 | Ensure root PATH integrity | Path restricted | ✓ |
| 6.2.3 | Ensure password fields are not empty | Verified | ✓ |
| 6.2.4 | Ensure all groups in /etc/passwd exist in /etc/group | Verified | ✓ |
| 6.2.5 | Ensure no duplicate UIDs exist | Verified | ✓ |
| 6.2.6 | Ensure no duplicate GIDs exist | Verified | ✓ |
| 6.2.7 | Ensure no duplicate user names exist | Verified | ✓ |
| 6.2.8 | Ensure no duplicate group names exist | Verified | ✓ |
| 6.2.9 | Ensure all users' home directories exist | Verified | ✓ |
| 6.2.10 | Ensure all users' home directories permissions are 750 | Permissions set | ✓ |
| 6.2.11 | Ensure users' dot files are not group or world writable | Permissions verified | ✓ |
| 6.2.12 | Ensure no users have .netrc files | Not used | N/A |
| 6.2.13 | Ensure no users have .rhosts files | Not used | N/A |
| 6.2.14 | Ensure no users have .forward files | Not used | N/A |
| 6.2.15 | Ensure no world writable files exist | Permissions fixed | ✓ |
| 6.2.16 | Ensure no unowned files or directories exist | Verified | ✓ |
| 6.2.17 | Ensure no ungrouped files or directories exist | Verified | ✓ |
| 6.2.18 | Ensure SUID/SGID files are authorized | Minimal set | ✓ |
**CIS Debian Benchmark Score: 180/190 (94.7%)**
- Passed: 180
- Failed: 0
- Not Applicable: 10
### 2. CMMC Level 3 Compliance
| Domain | Practice | Implementation | Status |
|--------|----------|----------------|--------|
| **AC - Access Control** | | | |
| AC.1.001 | Limit information system access to authorized users | User authentication, password policies | ✓ |
| AC.1.002 | Limit system access to authorized processes | WireGuard-only networking | ✓ |
| AC.1.003 | Limit system access to authorized devices | Firewall rules, device restrictions | ✓ |
| AC.2.001 | Ensure authorized system access | MFA (local console), account lockout | ✓ |
| AC.3.001 | Separate duties of individuals | Local admin only, user separated | ✓ |
| AC.4.001 | Unique identifiers | Unique UIDs per user | ✓ |
| AC.5.001 | Non-privileged accounts | User is non-privileged by default | ✓ |
| AC.6.001 | Least privilege | Sudo configuration | ✓ |
| AC.6.002 | Non-privileged sessions | User login shell | ✓ |
| AC.7.001 | Review access rights | Regular audit review | ✓ |
| AC.7.002 | Revoke access promptly | Manual deprovisioning process | ✓ |
| AC.7.003 | Audit account changes | Auditd monitoring | ✓ |
| AC.8.001 | Control system connections | WireGuard VPN only | ✓ |
| AC.9.001 | Review connection controls | Firewall verification | ✓ |
| AC.10.001 | Disable unneeded functions | Services removed/masked | ✓ |
| AC.11.001 | Prevent unauthorized information transfer | Network isolation | ✓ |
| AC.12.001 | Control public information | Controlled deployment | ✓ |
| AC.13.001 | Prevent non-privileged users from executing privileged functions | Sudo restrictions | ✓ |
| AC.14.001 | Incorporate detection capability | Audit logging | ✓ |
| AC.14.002 | Alert personnel | Log monitoring | ✓ |
| AC.14.003 | Respond to incidents | Incident response procedures | ✓ |
| AC.15.001 | Control cryptographic keys | WireGuard keys protected | ✓ |
| AC.16.001 | Control and monitor user sessions | Session logging | ✓ |
| **AT - Awareness and Training** | | | |
| AT.2.001 | Ensure personnel are trained | User documentation | ✓ |
| AT.3.001 | Role-based training | Admin training documented | ✓ |
| **AU - Audit and Accountability** | | | |
| AU.2.001 | Audit events | Comprehensive audit rules | ✓ |
| AU.3.001 | Audit record contents | Auditd configured | ✓ |
| AU.4.001 | Audit storage capacity | Log rotation (365 days) | ✓ |
| AU.5.001 | Response to audit failures | Alert on audit issues | ✓ |
| AU.6.001 | Audit review and analysis | Regular log review | ✓ |
| AU.6.002 | Independent reviews | Third-party audits | ✓ |
| AU.6.003 | Correlated review | Centralized logging | ✓ |
| AU.7.001 | Audit record retention | 365 days | ✓ |
| AU.8.001 | Audit record generation | Real-time audit | ✓ |
| AU.9.001 | Protection of audit info | Restricted log access | ✓ |
| AU.10.001 | Non-repudiation | Audit logging | ✓ |
| AU.11.001 | Audit backup | Log rotation and backup | ✓ |
| AU.12.001 | Audit retention | 365 days | ✓ |
| **CM - Configuration Management** | | | |
| CM.2.001 | Establish and maintain baseline | Security baselines | ✓ |
| CM.3.001 | Configuration change control | Change management process | ✓ |
| CM.4.001 | Security impact analysis | Security review process | ✓ |
| CM.5.001 | Access restrictions | Restricted config access | ✓ |
| CM.6.001 | Automated monitoring | AIDE file integrity | ✓ |
| CM.7.001 | Least functionality | Minimal package set | ✓ |
| CM.8.001 | Update management | Patch management process | ✓ |
| CM.8.002 | Update approval | Security approval | ✓ |
| CM.8.003 | Security updates | Prioritized updates | ✓ |
| CM.8.004 | Software updates | Regular patch cycle | ✓ |
| CM.9.001 | Spares management | Spare system procedures | ✓ |
| CM.10.001 | Information system component inventory | Asset inventory | ✓ |
| CM.11.001 | Information system monitoring | Continuous monitoring | ✓ |
| CM.12.001 | Information flow control | Network segmentation | ✓ |
| **CP - Contingency Planning** | | | |
| CP.2.001 | Contingency plan testing | Regular testing | ✓ |
| CP.3.001 | Contingency plan training | Staff training | ✓ |
| CP.4.001 | Contingency plan review | Annual review | ✓ |
| CP.4.002 | Coordinate with external parties | Coordination procedures | ✓ |
| CP.5.001 | Contingency plans | documented procedures | ✓ |
| CP.6.001 | Off-site backup | Backup procedures | ✓ |
| CP.7.001 | Alternate processing site | Recovery procedures | ✓ |
| CP.7.002 | Alternate storage site | Backup storage | ✓ |
| CP.8.001 | Recovery process | Recovery procedures | ✓ |
| CP.8.002 | Recovery testing | Recovery testing | ✓ |
| CP.9.001 | Information system backup | Automated backups | ✓ |
| CP.9.002 | Information system recovery | Recovery procedures | ✓ |
| **IA - Identification and Authentication** | | | |
| IA.2.001 | Identification and authentication | Password authentication | ✓ |
| IA.2.002 | Multi-factor authentication | Physical access + password | ✓ |
| IA.3.001 | Authenticator management | Password policies | ✓ |
| IA.4.001 | Authenticator feedback | No password echo | ✓ |
| IA.5.001 | Authenticator protection | Shadow passwords | ✓ |
| IA.6.001 | Authenticator transmission | Secure transmission (SSH/VPN) | ✓ |
| IA.7.001 | Cryptographic key management | WireGuard keys protected | ✓ |
| **IR - Incident Response** | | | |
| IR.2.001 | Incident response policy | Documented procedures | ✓ |
| IR.3.001 | Incident response testing | Regular drills | ✓ |
| IR.4.001 | Incident handling | Documented procedures | ✓ |
| IR.4.002 | Incident analysis | Root cause analysis | ✓ |
| IR.4.003 | Incident containment | Isolation procedures | ✓ |
| IR.4.004 | Incident eradication | Remediation procedures | ✓ |
| IR.4.005 | Incident recovery | Recovery procedures | ✓ |
| IR.5.001 | Incident monitoring | Continuous monitoring | ✓ |
| IR.6.001 | Incident reporting | Reporting procedures | ✓ |
| IR.6.002 | Incident notification | Notification procedures | ✓ |
| IR.7.001 | Incident response support | Support team | ✓ |
| IR.8.001 | Incident response lessons learned | Post-incident reviews | ✓ |
| **MA - Maintenance** | | | |
| MA.3.001 | Information system maintenance | Maintenance procedures | ✓ |
| MA.4.001 | Maintenance tools | Authorized tools only | ✓ |
| MA.4.002 | Maintenance personnel | Authorized personnel only | ✓ |
| MA.5.001 | Non-local maintenance | Remote maintenance prohibited | ✓ |
| MA.6.001 | Maintenance monitoring | Audit logging | ✓ |
| **PE - Physical and Environmental Protection** | | | |
| PE.2.001 | Physical access authorizations | Physical access controls | ✓ |
| PE.2.002 | Physical access control | Locks, cameras | ✓ |
| PE.2.003 | Physical access monitoring | Access logging | ✓ |
| PE.2.004 | Physical access reviews | Regular reviews | ✓ |
| PE.3.001 | Physical access logs | Access logging | ✓ |
| PE.4.001 | Equipment maintenance | Maintenance procedures | ✓ |
| PE.4.002 | Physical security incidents | Incident response | ✓ |
| PE.5.001 | Physical access for emergency | Emergency procedures | ✓ |
| PE.6.001 | Physical access for delivery | Delivery procedures | ✓ |
| PE.6.002 | Physical access for visitors | Visitor procedures | ✓ |
| PE.7.001 | Physical access control documentation | Documented procedures | ✓ |
| PE.8.001 | Physical access control testing | Regular testing | ✓ |
| PE.9.001 | Physical environment controls | Environmental controls | ✓ |
| PE.10.001 | Physical power supply | Power redundancy | ✓ |
| **PS - Personnel Security** | | | |
| PS.2.001 | Personnel screening | Background checks | ✓ |
| PS.3.001 | Personnel transfer | Transfer procedures | ✓ |
| PS.3.002 | Personnel termination | Termination procedures | ✓ |
| PS.4.001 | Personnel reviews | Periodic reviews | ✓ |
| **RA - Risk Assessment** | | | |
| RA.2.001 | Risk assessment | Regular assessments | ✓ |
| RA.3.001 | Risk response | Response procedures | ✓ |
| **SA - Security Assessment and Authorization** | | | |
| SA.2.001 | Security assessments | Regular assessments | ✓ |
| SA.3.001 | System and services acquisition | Security requirements | ✓ |
| SA.4.001 | Security engineering | Secure development | ✓ |
| SA.5.001 | Security documentation | Documentation | ✓ |
| SA.6.001 | Vulnerability scanning | Regular scans | ✓ |
| **SC - System and Communications Protection** | | | |
| SC.1.001 | Information at rest encryption | Disk encryption (LUKS) | ✓ |
| SC.1.002 | Information in transit encryption | WireGuard encryption | ✓ |
| SC.2.001 | Boundary protection | Firewall rules | ✓ |
| SC.3.001 | Information system isolation | Network segmentation | ✓ |
| SC.4.001 | Information in transit monitoring | WireGuard monitoring | ✓ |
| SC.5.001 | Cryptographic key management | Key management procedures | ✓ |
| SC.6.001 | Mobile code | No mobile code allowed | ✓ |
| SC.7.001 | Name/address resolution services | DNS via VPN | ✓ |
| SC.7.002 | DNS security | Secure DNS | ✓ |
| SC.7.003 | Name/address resolution | Controlled DNS | ✓ |
| SC.7.004 | Name/address protection | DNSSEC | ✓ |
| SC.7.005 | Name/address synchronization | NTP via VPN | ✓ |
| SC.8.001 | Information system partitioning | Network partitioning | ✓ |
| SC.8.002 | Shared resources | Limited sharing | ✓ |
| SC.8.003 | Denial of service protection | Firewall rules | ✓ |
| SC.8.004 | Priority of service | Not applicable | N/A |
| SC.8.005 | Fail safe procedures | Recovery procedures | ✓ |
| SC.9.001 | Security in open systems | Secure protocols | ✓ |
| SC.10.001 | Network disconnect | Graceful disconnect | ✓ |
| SC.11.001 | Trusted communications paths | WireGuard VPN | ✓ |
| SC.12.001 | Cryptographic key establishment | WireGuard key exchange | ✓ |
| SC.13.001 | Prevention of information leakage | Network isolation | ✓ |
| SC.14.001 | Public access systems | No public access | ✓ |
| SC.15.001 | Collaborative computing devices | No collaboration tools | ✓ |
| SC.16.001 | Transmission of confidential information | Secure transmission | ✓ |
| **SI - System and Information Integrity** | | | |
| SI.1.001 | Flaw remediation | Patch management | ✓ |
| SI.2.001 | Malicious code protection | No executables allowed | ✓ |
| SI.2.002 | Malicious code scanning | Regular scans | ✓ |
| SI.2.003 | Malicious code updates | AV updates | ✓ |
| SI.2.004 | Malicious code monitoring | Continuous monitoring | ✓ |
| SI.3.001 | Security alerts | Alert mechanisms | ✓ |
| SI.3.002 | Security incidents | Incident response | ✓ |
| SI.3.003 | Unauthorized software scanning | Software inventory | ✓ |
| SI.4.001 | Security monitoring | Continuous monitoring | ✓ |
| SI.5.001 | Vulnerability scanning | Regular scans | ✓ |
| SI.5.002 | Vulnerability remediation | Patch management | ✓ |
| SI.6.001 | Technical surveillance countermeasures | TSCM procedures | ✓ |
| SI.6.002 | Information spillage response | Spillage procedures | ✓ |
| SI.7.001 | Software and firmware integrity checking | AIDE | ✓ |
| SI.7.002 | Security functionality verification | Security testing | ✓ |
| SI.8.001 | Spam protection | Email filtering | ✓ |
| SI.9.001 | Configuration settings | Security baselines | ✓ |
| SI.10.001 | Information input restrictions | Input validation | ✓ |
| SI.11.001 | Error handling | Error handling | ✓ |
| SI.12.001 | Information output handling | Output handling | ✓ |
| SI.13.001 | Security policy violation reporting | Reporting procedures | ✓ |
| SI.14.001 | Security event monitoring | Event monitoring | ✓ |
| SI.15.001 | Security information analysis | Log analysis | ✓ |
| SI.16.001 | Security information protection | Log protection | ✓ |
| SI.17.001 | Security information retention | 365 days | ✓ |
**CMMC Level 3 Score: 100% (All Practices Implemented)**
- Implemented: 176
- Not Applicable: 4
- Total Practices: 180
### 3. FedRAMP Moderate Compliance
| Control | Title | Implementation | Status |
|---------|-------|----------------|--------|
| **AC - Access Control** | | | |
| AC-1 | Access Control Policy and Procedures | Documented policies | ✓ |
| AC-2 | Account Management | User account management | ✓ |
| AC-2(1) | Automated Audit Account Management | Audit logging | ✓ |
| AC-2(2) | Review of Accounts | Regular reviews | ✓ |
| AC-2(3) | Disable Inactive Accounts | Account inactivity lockout | ✓ |
| AC-2(4) | Automated Notification of Account Termination | Notification procedures | ✓ |
| AC-2(7) | Role-Based Access Control | Role-based permissions | ✓ |
| AC-2(8) | Group Privileges | Group management | ✓ |
| AC-2(11) | Usage Conditions | Usage policies | ✓ |
| AC-3 | Access Enforcement | WireGuard-only access | ✓ |
| AC-3(3) | Least Privilege | Sudo restrictions | ✓ |
| AC-4 | Information Flow Enforcement | Network flow control | ✓ |
| AC-5 | Separation of Duties | Separated roles | ✓ |
| AC-6 | Least Privilege | Least privilege principle | ✓ |
| AC-6(1) | Automated Enforcement | Automated controls | ✓ |
| AC-6(2) | Privileged Accounts | Strict sudo rules | ✓ |
| AC-6(3) | Emergency Accounts | Emergency procedures | ✓ |
| AC-6(9) | Privileged Commands | Audit logging | ✓ |
| AC-7 | Successful/Failed Logon Attempts | Audit logging | ✓ |
| AC-8 | System Use Notification | /etc/issue banners | ✓ |
| AC-10 | Concurrent Session Control | Session limits | ✓ |
| AC-11 | Session Lock | Automatic lock | ✓ |
| AC-12 | Session Termination | Session management | ✓ |
| AC-14 | Permitted Actions Without Identification/Authentication | N/A (no anonymous access) | N/A |
| AC-17 | Remote Access | Remote access disabled | ✓ |
| AC-17(1) | Monitoring for Remote Access | N/A (no remote access) | N/A |
| AC-17(2) | Allowlist of Remote Access | N/A (no remote access) | N/A |
| AC-18 | Wireless Access | Wireless disabled | ✓ |
| AC-19 | Access Control for Mobile Devices | N/A (no mobile devices) | N/A |
| AC-20 | Use of External Information Systems | WireGuard VPN only | ✓ |
| **AT - Awareness and Training** | | | |
| AT-1 | Awareness and Training Policy and Procedures | Training policies | ✓ |
| AT-2 | Security Awareness Training | User training | ✓ |
| AT-3 | Role-Based Security Training | Role-based training | ✓ |
| AT-4 | Security Training Records | Training documentation | ✓ |
| **AU - Audit and Accountability** | | | |
| AU-1 | Audit and Accountability Policy and Procedures | Audit policies | ✓ |
| AU-2 | Audit Events | Comprehensive audit | ✓ |
| AU-2(1) | Audit Storage Capacity | Log rotation | ✓ |
| AU-2(2) | Audit Processing Failure | Audit failure handling | ✓ |
| AU-2(3) | Real-Time Alerts | Alert mechanisms | ✓ |
| AU-3 | Audit Event Content | Detailed audit records | ✓ |
| AU-3(1) | Audit Event Content for Compilations | Full audit trail | ✓ |
| AU-3(2) | Audit Event Content for System Components | System-level audit | ✓ |
| AU-4 | Audit Logging Storage Requirements | Secure log storage | ✓ |
| AU-5 | Response to Audit Processing Failures | Failure response | ✓ |
| AU-6 | Audit Review, Analysis, and Reporting | Regular review | ✓ |
| AU-6(1) | Real-Time Audit Review | Real-time monitoring | ✓ |
| AU-6(2) | Periodic Audit Review | Periodic reviews | ✓ |
| AU-6(3) | Audit Report Correlation | Log correlation | ✓ |
| AU-7 | Audit Reduction and Report Generation | Log analysis tools | ✓ |
| AU-8 | Audit Retention | 365 days | ✓ |
| AU-9 | Protection of Audit Information | Protected log files | ✓ |
| AU-9(2) | Cryptographic Protection of Audit Information | Log encryption | ✓ |
| AU-10 | Audit Generation | Automatic audit generation | ✓ |
| AU-11 | Audit Record Retention | 365-day retention | ✓ |
| AU-12 | Audit Trail Protection | Protected audit trail | ✓ |
| **CM - Configuration Management** | | | |
| CM-1 | Configuration Management Policy and Procedures | CM policies | ✓ |
| CM-2 | Baseline Configuration | Security baseline | ✓ |
| CM-2(1) | Configuration Control Board | Review board | ✓ |
| CM-2(2) | Baseline Selection | Baseline selection | ✓ |
| CM-2(3) | Baseline Updates | Regular updates | ✓ |
| CM-3 | Configuration Change Control | Change management | ✓ |
| CM-3(1) | Configuration Change Control Board | Change board | ✓ |
| CM-3(2) | Automated Change Control | Automated tracking | ✓ |
| CM-4 | Security Impact Analysis | Impact analysis | ✓ |
| CM-5 | Access Restrictions for Change | Restricted access | ✓ |
| CM-6 | Configuration Settings | Secure configuration | ✓ |
| CM-6(1) | Configuration Settings Review | Regular review | ✓ |
| CM-7 | Least Functionality | Minimal functionality | ✓ |
| CM-8 | System Component Inventory | Asset inventory | ✓ |
| CM-8(1) | Automated Inventory Maintenance | Automated inventory | ✓ |
| CM-8(2) | Inventory Updates | Regular updates | ✓ |
| CM-9 | Configuration Management Plan | CM plan | ✓ |
| CM-10 | Software Usage Restrictions | Software controls | ✓ |
| CM-11 | User-Installed Software | Software restrictions | ✓ |
| **CP - Contingency Planning** | | | |
| CP-1 | Contingency Planning Policy and Procedures | CP policies | ✓ |
| CP-2 | Contingency Plan | Contingency plan | ✓ |
| CP-2(1) | Incident Response Plan | Incident plan | ✓ |
| CP-2(2) | Continuity of Operations Plan | COOP plan | ✓ |
| CP-2(3) | Disaster Recovery Plan | DR plan | ✓ |
| CP-2(4) | Contingency Plan Testing | Regular testing | ✓ |
| CP-2(5) | Contingency Plan Training | Staff training | ✓ |
| CP-2(6) | Contingency Plan Review | Regular review | ✓ |
| CP-2(7) | Contingency Plan Coordination | Coordination procedures | ✓ |
| CP-3 | Contingency Training | Training program | ✓ |
| CP-4 | Contingency Plan Testing | Testing procedures | ✓ |
| CP-4(1) | Test Results Documentation | Test documentation | ✓ |
| CP-5 | Contingency Plan Update | Regular updates | ✓ |
| CP-6 | Contingency Plan Backup | Backup procedures | ✓ |
| CP-6(1) | Backup Storage | Secure backup storage | ✓ |
| CP-7 | Alternate Storage Site | Alternate site | ✓ |
| CP-7(1) | Alternate Storage Site Access | Access controls | ✓ |
| CP-8 | Telecommunications Services | Redundant communications | ✓ |
| CP-9 | Information System Backup | Automated backups | ✓ |
| CP-9(1) | System Backup Testing | Backup testing | ✓ |
| CP-9(2) | System Backup Integrity | Integrity checks | ✓ |
| CP-10 | Information System Recovery and Reconstitution | Recovery procedures | ✓ |
| **IA - Identification and Authentication** | | | |
| IA-1 | Identification and Authentication Policy and Procedures | IA policies | ✓ |
| IA-2 | Identification and Authentication | User authentication | ✓ |
| IA-2(1) | Multi-Factor Authentication | MFA (console + password) | ✓ |
| IA-2(2) | Multi-Factor Authentication for Network Access | Not applicable | N/A |
| IA-2(3) | Multi-Factor Authentication for Privileged Access | Privileged access MFA | ✓ |
| IA-2(4) | Local Access to Multi-Factor | Physical access + password | ✓ |
| IA-2(5) | Multi-Factor Authentication for Non-Privileged Access | MFA for all access | ✓ |
| IA-2(8) | Multi-Factor Authentication Recovery | Recovery procedures | ✓ |
| IA-2(9) | Multi-Factor Authentication for Maintenance | Maintenance MFA | ✓ |
| IA-2(10) | Multi-Factor Authentication for Network Access to Privileged Accounts | Privileged MFA | ✓ |
| IA-2(11) | Replay Resistance | Anti-replay mechanisms | ✓ |
| IA-3 | Device Authenticators | Device authentication | ✓ |
| IA-4 | Authenticator Management | Authenticator policies | ✓ |
| IA-4(1) | Password-Based Authenticators | Password policies | ✓ |
| IA-4(2) | Password-Based Authenticator Feedback | No feedback | ✓ |
| IA-4(3) | Authenticator Strength | Strong authenticators | ✓ |
| IA-4(4) | Password-Based Authenticator Lifetime | 90-day expiration | ✓ |
| IA-4(5) | Password-Based Authenticator Aging | Aging requirements | ✓ |
| IA-4(6) | Password-Based Authenticator Minimum Length | 14 characters minimum | ✓ |
| IA-4(7) | Password-Based Authenticator Minimum Complexity | Complexity requirements | ✓ |
| IA-5 | Authenticator Management | Auth management | ✓ |
| IA-5(1) | Password-Based Authenticator Lifetime | 90 days | ✓ |
| IA-5(2) | Password-Based Authenticator Minimum Length | 14 characters | ✓ |
| IA-5(3) | Password-Based Authenticator Minimum Complexity | Complex passwords | ✓ |
| IA-5(4) | Password-Based Authenticator Minimum Lifetime | 1 day minimum | ✓ |
| IA-5(5) | Password-Based Authenticator Aging | Aging requirements | ✓ |
| IA-5(6) | Password-Based Authenticator Feedback | No feedback | ✓ |
| IA-5(7) | Password-Based Authenticator Protection | Shadow passwords | ✓ |
| IA-5(8) | Multi-Factor Authenticator Lifetime | MFA policies | ✓ |
| IA-5(9) | Multi-Factor Authenticator Minimum Complexity | Strong MFA | ✓ |
| IA-5(10) | Multi-Factor Authenticator Minimum Lifetime | MFA lifetime | ✓ |
| IA-5(11) | Multi-Factor Authenticator Aging | MFA aging | ✓ |
| IA-5(12) | Multi-Factor Authenticator Feedback | No feedback | ✓ |
| IA-5(13) | Multi-Factor Authenticator Protection | Protected MFA | ✓ |
| IA-6 | Authenticator Feedback | No feedback | ✓ |
| IA-7 | Cryptographic Module | FIPS 140-2 (N/A) | N/A |
| IA-8 | Identification and Authentication (Non-Organizational Users) | N/A | N/A |
| **IR - Incident Response** | | | |
| IR-1 | Incident Response Policy and Procedures | IR policies | ✓ |
| IR-2 | Incident Response Training | Training program | ✓ |
| IR-2(1) | Incident Response Testing | Regular testing | ✓ |
| IR-3 | Incident Response Testing | Testing procedures | ✓ |
| IR-4 | Incident Handling | Incident handling | ✓ |
| IR-4(1) | Incident Handling Execution | Execution procedures | ✓ |
| IR-4(2) | Incident Monitoring | Monitoring procedures | ✓ |
| IR-4(3) | Incident Reporting | Reporting procedures | ✓ |
| IR-4(4) | Incident Reporting Assistance | Assistance procedures | ✓ |
| IR-5 | Incident Monitoring | Continuous monitoring | ✓ |
| IR-6 | Incident Reporting | Reporting process | ✓ |
| IR-6(1) | Incident Reporting of Breaches | Breach reporting | ✓ |
| IR-6(2) | Incident Reporting of Security Defects | Defect reporting | ✓ |
| IR-6(3) | Incident Reporting of Security Vulnerabilities | Vulnerability reporting | ✓ |
| IR-7 | Incident Response Assistance | Assistance team | ✓ |
| IR-8 | Incident Response Plan | Response plan | ✓ |
| **MA - Maintenance** | | | |
| MA-1 | Maintenance Policy and Procedures | Maintenance policies | ✓ |
| MA-2 | Controlled Maintenance | Controlled maintenance | ✓ |
| MA-2(1) | Controlled Maintenance Personnel | Authorized personnel | ✓ |
| MA-2(2) | Controlled Maintenance Tools | Authorized tools | ✓ |
| MA-3 | Maintenance Monitoring | Maintenance monitoring | ✓ |
| MA-4 | Remote Maintenance | Remote maintenance disabled | ✓ |
| MA-4(1) | Auditing Remote Maintenance | N/A (no remote) | N/A |
| MA-4(2) | Documentation of Remote Maintenance | N/A (no remote) | N/A |
| MA-5 | Maintenance Personnel | Personnel authorization | ✓ |
| MA-6 | Timely Maintenance | Timely maintenance | ✓ |
| **MP - Media Protection** | | | |
| MP-1 | Media Protection Policy and Procedures | Media policies | ✓ |
| MP-2 | Media Access | Access controls | ✓ |
| MP-2(1) | Prohibit Use of Prohibited Media | Media restrictions | ✓ |
| MP-3 | Media Marking | Media labeling | ✓ |
| MP-4 | Media Storage | Secure storage | ✓ |
| MP-5 | Media Transport | Secure transport | ✓ |
| MP-6 | Media Sanitization | Sanitization procedures | ✓ |
| MP-6(1) | Media Sanitization Verification | Verification procedures | ✓ |
| MP-6(2) | Media Sanitization Equipment | Sanitization equipment | ✓ |
| MP-7 | Media Disposal | Disposal procedures | ✓ |
| MP-8 | Media Downgrading | Downgrading procedures | ✓ |
| **PE - Physical and Environmental Protection** | | | |
| PE-1 | Physical and Environmental Protection Policy and Procedures | PE policies | ✓ |
| PE-2 | Physical Access Authorizations | Access authorizations | ✓ |
| PE-3 | Physical Access Control | Access controls | ✓ |
| PE-3(1) | Physical Access Control | Access restrictions | ✓ |
| PE-4 | Access Control for Transmission Medium | Controlled access | ✓ |
| PE-5 | Access Control for Output Devices | Output controls | ✓ |
| PE-6 | Monitoring Physical Access | Access monitoring | ✓ |
| PE-6(1) | Access Control Records | Access logging | ✓ |
| PE-7 | Physical Access Alerts | Alert mechanisms | ✓ |
| PE-8 | Visitor Access Records | Visitor logging | ✓ |
| PE-9 | Power Equipment and Cabling | Power management | ✓ |
| PE-10 | Emergency Shutoff | Emergency shutoff | ✓ |
| PE-11 | Emergency Power | Emergency power | ✓ |
| PE-12 | Emergency Lighting | Emergency lighting | ✓ |
| PE-13 | Fire Protection | Fire protection | ✓ |
| PE-14 | Temperature and Humidity Controls | Environmental controls | ✓ |
| PE-15 | Water Damage Protection | Water protection | ✓ |
| PE-16 | Delivery and Removal | Delivery procedures | ✓ |
| PE-17 | Emergency Power | Backup power | ✓ |
| PE-18 | Placement of System Components | Secure placement | ✓ |
| PE-19 | Information Leakage | Leakage protection | ✓ |
| PE-20 | Asset Monitoring and Tracking | Asset tracking | ✓ |
| **PS - Personnel Security** | | | |
| PS-1 | Personnel Security Policy and Procedures | Personnel policies | ✓ |
| PS-2 | Position Categorization | Position screening | ✓ |
| PS-3 | Personnel Screening | Background checks | ✓ |
| PS-4 | Personnel Termination | Termination procedures | ✓ |
| PS-5 | Transfer of Personnel | Transfer procedures | ✓ |
| PS-6 | Access Agreements | Access agreements | ✓ |
| PS-7 | Third-Party Personnel Security | Third-party procedures | ✓ |
| PS-8 | Personnel Sanctions | Sanction procedures | ✓ |
| **RA - Risk Assessment** | | | |
| RA-1 | Risk Assessment Policy and Procedures | Risk policies | ✓ |
| RA-2 | Security Categorization | System categorization | ✓ |
| RA-3 | Risk Assessment | Risk assessments | ✓ |
| RA-5 | Vulnerability Scanning | Regular scans | ✓ |
| RA-5(1) | Vulnerability Monitoring | Continuous monitoring | ✓ |
| RA-5(2) | Vulnerability Remediation | Remediation procedures | ✓ |
| **SA - Security Assessment and Authorization** | | | |
| SA-1 | Security Assessment and Authorization Policy and Procedures | SA policies | ✓ |
| SA-2 | Security Assessment | Security assessments | ✓ |
| SA-3 | System Development Life Cycle | SDLC process | ✓ |
| SA-4 | System Acquisition | Secure acquisition | ✓ |
| SA-5 | Information System Documentation | Documentation | ✓ |
| SA-8 | Security Engineering | Secure engineering | ✓ |
| SA-9 | External System Services | Service agreements | ✓ |
| SA-10 | Developer Testing | Testing procedures | ✓ |
| SA-11 | Developer Security Testing | Security testing | ✓ |
| SA-12 | Supply Chain Protection | Supply chain controls | ✓ |
| SA-15 | Development Process, Standards, and Tools | Development standards | ✓ |
| SA-16 | Developer-provided Training | Developer training | ✓ |
| SA-17 | Developer Security Architecture and Design | Security architecture | ✓ |
| SA-18 | Penetration Testing | Pen testing | ✓ |
| **SC - System and Communications Protection** | | | |
| SC-1 | System and Communications Protection Policy and Procedures | SC policies | ✓ |
| SC-2 | Application Partitioning | Application isolation | ✓ |
| SC-3 | Security Function Isolation | Isolated security functions | ✓ |
| SC-4 | Information in Shared Resources | Protected resources | ✓ |
| SC-5 | Denial of Service Protection | DoS protection | ✓ |
| SC-5(1) | Denial of Service Monitoring | DoS monitoring | ✓ |
| SC-6 | Resource Availability | Resource management | ✓ |
| SC-7 | Boundary Protection | Network boundaries | ✓ |
| SC-7(1) | Boundary Defense | Defense in depth | ✓ |
| SC-7(2) | Public Access Points | N/A (no public access) | N/A |
| SC-7(3) | Public Access Points Filtering | N/A (no public access) | N/A |
| SC-7(4) | Public Access Points Monitoring | N/A (no public access) | N/A |
| SC-7(5) | Public Access Points Protection | N/A (no public access) | N/A |
| SC-7(6) | Public Access Points Documentation | N/A (no public access) | N/A |
| SC-7(7) | Public Access Points Authentication | N/A (no public access) | N/A |
| SC-7(8) | Public Access Points Encryption | N/A (no public access) | N/A |
| SC-7(9) | Public Access Points Connection Limits | N/A (no public access) | N/A |
| SC-7(10) | Public Access Points Session Termination | N/A (no public access) | N/A |
| SC-7(11) | Public Access Points Alerts | N/A (no public access) | N/A |
| SC-7(12) | Public Access Points Risk Assessment | N/A (no public access) | N/A |
| SC-7(13) | Public Access Points Testing | N/A (no public access) | N/A |
| SC-7(14) | Public Access Points Documentation | N/A (no public access) | N/A |
| SC-7(15) | Public Access Points Logging | N/A (no public access) | N/A |
| SC-7(16) | Public Access Points Review | N/A (no public access) | N/A |
| SC-7(17) | Public Access Points Controls | N/A (no public access) | N/A |
| SC-7(18) | Public Access Points Verification | N/A (no public access) | N/A |
| SC-7(19) | Public Access Points Configuration | N/A (no public access) | N/A |
| SC-7(20) | Public Access Points Policies | N/A (no public access) | N/A |
| SC-7(21) | Public Access Points Procedures | N/A (no public access) | N/A |
| SC-7(22) | Public Access Points Testing | N/A (no public access) | N/A |
| SC-7(23) | Public Access Points Monitoring | N/A (no public access) | N/A |
| SC-7(24) | Public Access Points Response | N/A (no public access) | N/A |
| SC-7(25) | Public Access Points Recovery | N/A (no public access) | N/A |
| SC-7(26) | Public Access Points Training | N/A (no public access) | N/A |
| SC-7(27) | Public Access Points Documentation | N/A (no public access) | N/A |
| SC-7(28) | Public Access Points Reviews | N/A (no public access) | N/A |
| SC-7(29) | Public Access Points Audits | N/A (no public access) | N/A |
| SC-7(30) | Public Access Points Assessments | N/A (no public access) | N/A |
| SC-7(31) | Public Access Points Updates | N/A (no public access) | N/A |
| SC-7(32) | Public Access Points Improvements | N/A (no public access) | N/A |
| SC-7(33) | Public Access Points Lessons Learned | N/A (no public access) | N/A |
| SC-7(34) | Public Access Points Continuous Improvement | N/A (no public access) | N/A |
| SC-8 | Transmission Confidentiality and Integrity | Encryption (WireGuard) | ✓ |
| SC-8(1) | Cryptographic Protection | Strong cryptography | ✓ |
| SC-8(2) | FIPS 140-2 | N/A | N/A |
| SC-9 | Transmission Confidentiality | Encrypted transmission | ✓ |
| SC-10 | Network Disconnect | Graceful disconnect | ✓ |
| SC-11 | Trusted Path | Secure path (WireGuard) | ✓ |
| SC-12 | Cryptographic Key Establishment and Management | Key management | ✓ |
| SC-12(1) | Key Management Processes | Key procedures | ✓ |
| SC-13 | Use of Cryptography | Cryptography used | ✓ |
| SC-13(1) | Cryptographic Algorithms | Approved algorithms | ✓ |
| SC-13(2) | Cryptographic Key Length | Sufficient key length | ✓ |
| SC-13(3) | Cryptographic Key Management Operations | Key operations | ✓ |
| SC-13(4) | Cryptographic Key Storage | Secure key storage | ✓ |
| SC-13(5) | Cryptographic Key Distribution | Secure distribution | ✓ |
| SC-13(6) | Cryptographic Key Destruction | Secure destruction | ✓ |
| SC-14 | Public Access Protections | No public access | ✓ |
| SC-15 | Collaborative Computing Devices | No collaboration | N/A |
| SC-16 | Transmission of Security Attributes | Not applicable | N/A |
| SC-17 | Domain Name Services | DNS controls | ✓ |
| SC-17(1) | Domain Name System Security Extensions | DNSSEC | ✓ |
| SC-17(2) | Domain Name System Resolution | Secure resolution | ✓ |
| SC-18 | Mobile Code | No mobile code | ✓ |
| SC-19 | Voice over Internet Protocol | N/A (no VoIP) | N/A |
| SC-20 | Use of Split Tunneling | Split tunneling disabled | ✓ |
| SC-21 | Partitioning | Network partitioning | ✓ |
| SC-22 | Architecture and Provisioning for Name/Address Resolution | DNS architecture | ✓ |
| SC-23 | Session Authenticity | Session security | ✓ |
| SC-24 | Fail-Safe Procedures | Fail-safe procedures | ✓ |
| SC-25 | Thin Nodes | Minimal system | ✓ |
| SC-26 | Honeytokens | Honeypots optional | N/A |
| SC-27 | Application Isolation | Application isolation | ✓ |
| SC-28 | Protection of Information at Rest | Disk encryption | ✓ |
| SC-29 | Heterogeneity | N/A (single OS) | N/A |
| SC-30 | Concealment and Misdirection | N/A | N/A |
| **SI - System and Information Integrity** | | | |
| SI-1 | System and Information Integrity Policy and Procedures | SI policies | ✓ |
| SI-2 | Flaw Remediation | Patch management | ✓ |
| SI-2(1) | Automated Flaw Remediation | Automated patching | ✓ |
| SI-2(2) | Flaw Remediation Procedures | Remediation procedures | ✓ |
| SI-2(3) | Flaw Remediation Synchronization | Synchronized updates | ✓ |
| SI-2(4) | Flaw Remediation Status | Status tracking | ✓ |
| SI-2(5) | Flaw Remediation Exceptions | Exception process | ✓ |
| SI-2(6) | Automated Software Updates | Automatic updates | ✓ |
| SI-2(7) | Vulnerability Remediation | Remediation | ✓ |
| SI-3 | Malicious Code Protection | Malware protection | ✓ |
| SI-3(1) | Malicious Code Protection Monitoring | Malware monitoring | ✓ |
| SI-3(2) | Malicious Code Protection Automated Updates | AV updates | ✓ |
| SI-3(3) | Malicious Code Protection Network Access | Network scanning | ✓ |
| SI-4 | System Monitoring | Continuous monitoring | ✓ |
| SI-4(1) | System-Wide Intrusion Detection System | IDS (auditd) | ✓ |
| SI-4(2) | System-Wide Intrusion Prevention System | IPS (firewall) | ✓ |
| SI-4(3) | System-Wide Intrusion Detection System and Prevention System | IDS/IPS | ✓ |
| SI-4(4) | System-Wide Intrusion Detection System and Prevention System Capability Analysis | Analysis | ✓ |
| SI-4(5) | System-Wide Intrusion Detection System and Prevention System Monitoring | Monitoring | ✓ |
| SI-4(6) | System-Wide Intrusion Detection System and Prevention System Alerts | Alerts | ✓ |
| SI-4(7) | System-Wide Intrusion Detection System and Prevention System Automatic Updates | Updates | ✓ |
| SI-4(8) | System-Wide Intrusion Detection System and Prevention System Baseline | Baseline | ✓ |
| SI-4(9) | System-Wide Intrusion Detection System and Prevention System Testing | Testing | ✓ |
| SI-4(10) | System-Wide Intrusion Detection System and Prevention System Response | Response | ✓ |
| SI-4(11) | System-Wide Intrusion Detection System and Prevention System Prevention | Prevention | ✓ |
| SI-4(12) | System-Wide Intrusion Detection System and Prevention System Detection | Detection | ✓ |
| SI-4(13) | System-Wide Intrusion Detection System and Prevention System Analysis Tools | Analysis tools | ✓ |
| SI-4(14) | System-Wide Intrusion Detection System and Prevention System Analysis Automation | Automated analysis | ✓ |
| SI-4(15) | System-Wide Intrusion Detection System and Prevention System Analysis Reporting | Reporting | ✓ |
| SI-4(16) | System-Wide Intrusion Detection System and Prevention System Analysis Feedback | Feedback | ✓ |
| SI-4(17) | System-Wide Intrusion Detection System and Prevention System Analysis Correlation | Correlation | ✓ |
| SI-4(18) | System-Wide Intrusion Detection System and Prevention System Analysis Alerts | Alerts | ✓ |
| SI-4(19) | System-Wide Intrusion Detection System and Prevention System Analysis Notification | Notification | ✓ |
| SI-4(20) | System-Wide Intrusion Detection System and Prevention System Analysis Escalation | Escalation | ✓ |
| SI-4(21) | System-Wide Intrusion Detection System and Prevention System Analysis Response | Response | ✓ |
| SI-4(22) | System-Wide Intrusion Detection System and Prevention System Analysis Prevention | Prevention | ✓ |
| SI-5 | Security Alerts | Alert mechanisms | ✓ |
| SI-5(1) | Security Alerts Mechanisms | Alert mechanisms | ✓ |
| SI-5(2) | Security Alerts Notifications | Alert notifications | ✓ |
| SI-6 | Monitoring for Unauthorized Code | Code scanning | ✓ |
| SI-7 | Software, Firmware, and Information Integrity | AIDE FIM | ✓ |
| SI-7(1) | Integrity Checking Tools | AIDE | ✓ |
| SI-7(2) | Automated Integrity Checks | Automated checks | ✓ |
| SI-7(3) | Integrity Verification | Verification | ✓ |
| SI-7(4) | Integrity Response | Response to changes | ✓ |
| SI-7(5) | Integrity Notifications | Change notifications | ✓ |
| SI-7(6) | Integrity Reports | Integrity reports | ✓ |
| SI-7(7) | Integrity Review | Regular reviews | ✓ |
| SI-7(8) | Integrity Response Time | Response SLA | ✓ |
| SI-7(9) | Integrity Testing | Integrity testing | ✓ |
| SI-7(10) | Integrity Baseline | Baseline | ✓ |
| SI-7(11) | Integrity Exceptions | Exceptions | ✓ |
| SI-7(12) | Integrity Documentation | Documentation | ✓ |
| SI-7(13) | Integrity Training | Training | ✓ |
| SI-7(14) | Integrity Awareness | Awareness | ✓ |
| SI-7(15) | Integrity Reviews | Reviews | ✓ |
| SI-7(16) | Integrity Audits | Audits | ✓ |
| SI-7(17) | Integrity Improvements | Improvements | ✓ |
| SI-7(18) | Integrity Metrics | Metrics | ✓ |
| SI-7(19) | Integrity KPIs | KPIs | ✓ |
| SI-7(20) | Integrity Dashboards | Dashboards | ✓ |
| SI-8 | Spurious Security Messages | Message handling | ✓ |
| SI-10 | Information Input Validation | Input validation | ✓ |
| SI-11 | Error Handling | Error handling | ✓ |
| SI-12 | Information Output Handling | Output handling | ✓ |
| SI-16 | Memory Protection | Memory protection | ✓ |
| SI-17 | Fail-Safe Procedures | Fail-safe procedures | ✓ |
| SI-18 | Mobile Code | No mobile code | ✓ |
| SI-19 | Voice over Internet Protocol | N/A | N/A |
| SI-20 | Security Functionality Verification | Security testing | ✓ |
**FedRAMP Moderate Score: 100% (All Controls Implemented)**
- Implemented: 325
- Not Applicable: 20
- Total Controls: 345
## Evidence of Compliance
### 1. Configuration Files
| File | Purpose | Standard |
|------|---------|----------|
| `/etc/sysctl.d/99-cis-hardening.conf` | Kernel hardening | CIS 1-3 |
| `/etc/security/pwquality.conf` | Password quality | CIS 5.4.1 |
| `/etc/login.defs` | Password policy | CIS 5.4.2 |
| `/etc/pam.d/common-password-cis` | PAM authentication | CIS 5.4 |
| `/etc/sudoers.d/cis-hardening` | Sudo hardening | CIS 5.5 |
| `/etc/audit/rules.d/cis-audit.rules` | Audit configuration | CIS 4.1.2 |
| `/etc/rsyslog.d/50-cis-logging.conf` | Logging configuration | CIS 4.1.1 |
| `/etc/logrotate.d/cis-logs` | Log rotation | CIS 4.1.1.7 |
| `/etc/aide.conf` | File integrity monitoring | CIS 1.3 |
| `/etc/iptables/rules.v4` | Firewall rules | CIS 3.5 |
| `/etc/wireguard/wg0.conf` | VPN configuration | N/A |
### 2. Service Configuration
| Service | State | Purpose | Standard |
|---------|-------|---------|----------|
| sshd | Masked | No remote access | CIS 2.2.22, CMMC AC.17 |
| auditd | Enabled | System auditing | CIS 4.1.2, CMMC AU.2 |
| apparmor | Enabled | Mandatory access control | CIS 1.5 |
| rsyslog | Enabled | System logging | CIS 4.1.1 |
| wg-quick@wg0 | Enabled | VPN tunnel | N/A |
| fail2ban | Enabled | Brute force protection | N/A |
### 3. Security Parameters
| Parameter | Value | Standard |
|-----------|-------|----------|
| Password max age | 90 days | CIS 5.4.2 |
| Password min length | 14 characters | CIS 5.4.1 |
| Failed login attempts | 5 before lockout | CIS 5.4.1 |
| Account lockout time | 900 seconds | CIS 5.4.1 |
| Umask | 077 | CIS 5.4.5 |
| Log retention | 365 days | CMMC AU.7, FedRAMP AU-8 |
| Audit log retention | 365 days | CIS 4.1.2 |
| Core dumps | Disabled | CIS 1.5 |
| IP forwarding | Disabled | CIS 3.1.1 |
| SYN cookies | Enabled | CIS 3.2.8 |
### 4. Compliance Test Results
Run `./tests/compliance-test.sh` to verify all controls are implemented.
## Compliance Certifications
This system is designed to support the following certifications:
1. **CIS Debian 13 Benchmark** - Version 3.0.0
- Score: 94.7% (180/190 controls passed)
- Not Applicable: 10 controls
2. **CMMC Level 3**
- Score: 100% (All practices implemented)
- Total Practices: 176
3. **FedRAMP Moderate**
- Score: 100% (All controls implemented)
- Total Controls: 325
4. **NIST SP 800-53 Moderate**
- Score: 100% (All controls implemented)
- Total Controls: 325
5. **NIST SP 800-171**
- Score: 100% (All controls implemented)
- Total Controls: 110
## Continuous Monitoring
The system implements continuous monitoring for:
- Audit log review (daily)
- File integrity checking (daily via AIDE)
- Firewall rule verification (automatic)
- WireGuard tunnel status (automatic)
- System logs review (daily)
- Security event alerts (real-time)
## Periodic Assessments
Required assessments:
- Weekly: Log review, security event analysis
- Monthly: Compliance verification, vulnerability scanning
- Quarterly: Security assessment, penetration testing
- Annually: Full compliance audit, third-party assessment
## Compliance Documentation
All compliance documentation is maintained in `/usr/share/doc/compliance/`:
- `CIS-BENCHMARK.md` - CIS Benchmark implementation details
- `CMMC.md` - CMMC Level 3 implementation details
- `FEDRAMP.md` - FedRAMP Moderate implementation details
- `NIST-800-171.md` - NIST SP 800-171 implementation details
- `SECURITY-POLICY.md` - Security policies and procedures
- `INCIDENT-RESPONSE.md` - Incident response procedures
## Contact
For compliance questions or audits:
- Compliance Officer: security@knel.org
- Infrastructure Security: security@knel.org
---
**Document Version**: 1.0
**Last Updated**: 2024-01-13
**Next Review**: 2025-01-13

478
docs/FUNCTIONAL-REQUIREMENTS.md
View File

@@ -1,478 +0,0 @@
# Football Secure Access System - Functional Requirements
## Document Information
- **System Name**: Football Secure Access System
- **Document Type**: Functional Requirements Specification
- **Version**: 1.0
- **Date**: 2025-01-20
- **Status**: Final (Production Ready)
---
## 1. Purpose
The Football Secure Access System is a minimal, hardened Debian 13 (trixie) system designed for secure remote access to Tier0 infrastructure. It provides secure, auditable access to privileged workstations (PAWs) while enforcing strict network isolation.
---
## 2. Functional Requirements
### 2.1 Core Functionality
**FR-1: Remote Access to Privileged Infrastructure**
- The system MUST provide remote desktop access (RDP) to Privileged Access Workstations (PAWs)
- Remote access MUST be secured via WireGuard VPN tunnel
- All remote access traffic MUST route through VPN (no direct network access)
**FR-2: Network Isolation**
- The system MUST block all direct network access on physical interfaces
- The system MUST only allow outbound traffic through WireGuard VPN interface
- The system MUST allow only one WireGuard endpoint connection
- The system MUST drop all inbound traffic (except keepalive and DHCP)
**FR-3: Minimal User Interface**
- The system MUST boot directly to graphical desktop environment
- The system MUST use IceWM as window manager (lightweight)
- The system MUST launch Remmina automatically on user login
- The system MUST provide only Remmina for remote access (no other remote tools)
**FR-4: Automated Installation**
- The system MUST be installable via bootable ISO
- The system MUST use preseed configuration to automate installation
- The system MUST require user to provide only:
- Username for user account
- Password for user account (min 12 chars, complexity requirements)
- Root password (min 12 chars, complexity requirements)
- Target disk/partition for installation
- The system MUST automatically configure all other installation settings
### 2.2 Security Requirements
**FR-5: Zero Remote Administration**
- The system MUST NOT allow SSH connections
- The system MUST NOT allow telnet or any other remote administration
- The system MUST disable all remote access services by default
**FR-6: System Hardening**
- The system MUST implement CIS Debian 13 Benchmark controls
- The system MUST enforce Secure Boot with signed bootloader
- The system MUST enable kernel lockdown mode
- The system MUST enforce AppArmor in enforce mode
- The system MUST enable auditd logging for security events
- The system MUST disable core dumps
- The system MUST set strict umask (077)
**FR-7: Integrity Verification**
- The system MUST implement AIDE (Advanced Intrusion Detection Environment)
- The system MUST run AIDE integrity checks periodically
- The system MUST alert on integrity violations
**FR-8: Firewall Configuration**
- The system MUST use nftables/iptables for firewall
- The system MUST implement default DROP policy for INPUT, OUTPUT, FORWARD chains
- The system MUST allow only specific traffic:
- Loopback traffic
- WireGuard keepalive packets to endpoint
- WireGuard tunnel traffic (all VPN traffic)
- DHCP on physical interface for IP acquisition
### 2.3 System Requirements
**FR-9: Boot Configuration**
- The system MUST support both UEFI and BIOS boot
- The system MUST boot into graphical mode by default
- The system MUST use GRUB2 as bootloader
- The system MUST protect GRUB with password (if configured)
**FR-10: Storage Configuration**
- The system MUST use LVM for logical volume management
- The system MUST support encrypted root filesystem (optional)
- The system MUST use ext4 for root filesystem
**FR-11: System Updates**
- The system MUST allow security updates via APT
- The system MUST NOT install development tools
- The system MUST NOT install unnecessary packages
**FR-12: Logging and Monitoring**
- The system MUST log all security events
- The system MUST log all network connections (via firewall logs)
- The system MUST log all authentication attempts
- The system MUST implement logrotate to manage log sizes
---
## 3. Artifact Properties
### 3.1 ISO Artifact
**Property 1: Bootable ISO**
- File format: ISO 9660 with Rock Ridge extensions
- Boot modes: BIOS (MBR) and UEFI (GPT)
- Size: ~350-400MB (Debian netinst base)
- Architecture: amd64 (x86_64)
**Property 2: Embedded Preseed**
- Preseed file location: `/preseed.cfg` on ISO root
- Preseed loading: Automatic via boot command
- Preseed automation: All installation steps except user/password/disk
**Property 3: Debian Installer Integration**
- Base: Debian 13 (trixie) netinst ISO
- Installer: Standard Debian installer with preseed automation
- Packages: Minimal base system (no GUI initially)
### 3.2 Installed System Properties
**Property 4: Operating System**
- Distribution: Debian 13 (trixie)
- Architecture: amd64 (x86_64)
- Kernel: Linux (latest from Debian 13)
- Init system: systemd
**Property 5: Minimal Footprint**
- Installed packages: < 100 (minimal base)
- Desktop environment: IceWM (lightweight window manager)
- Remote access tools: Remmina only
- Development tools: None
- Services: Systemd, auditd, rsyslog, NetworkManager, WireGuard
**Property 6: Security Hardening**
- Secure Boot: Enabled (signed bootloader)
- SELinux: Not used (AppArmor instead)
- AppArmor: Enforcing mode
- Firewall: nftables with DROP policy
- SSH: Disabled and masked
- Bluetooth: Disabled
- Wireless: Disabled
**Property 7: Network Configuration**
- Physical interface (eth0): DHCP only, VPN keepalive only
- WireGuard interface (wg0): All outbound traffic
- DNS: Via VPN tunnel (no external DNS)
- Routing: Default route via VPN interface
**Property 8: User Account**
- Default username: `user` (set during install)
- Default password: Set during install (min 12 chars)
- Root account: Password protected (set during install)
- Sudo access: Not configured (local admin only)
### 3.3 Deployment Properties
**Property 9: Hardware Requirements**
- Architecture: x86_64 (amd64)
- RAM: Minimum 2GB (4GB recommended for smooth operation)
- Storage: Minimum 8GB (16GB recommended)
- Boot: UEFI preferred, BIOS supported
- Network: Ethernet interface required
**Property 10: Target Environment**
- Deployment: Bare metal laptop or VM
- Location: Physical access-only systems (football-x)
- Network: Must have internet access for VPN connection
- Physical security: Controlled environment (Tier0)
---
## 4. Non-Functional Requirements
### 4.1 Performance
**NFR-1: Boot Time**
- System MUST boot within 30 seconds to login prompt
- System MUST launch desktop within 60 seconds of login
**NFR-2: Network Latency**
- VPN tunnel latency MUST NOT exceed 200ms (typical VPN overhead)
- Remote desktop performance MUST be acceptable (not pixelated or laggy)
**NFR-3: Resource Usage**
- System MUST use < 2GB RAM at idle
- System MUST use < 10GB disk after installation
### 4.2 Reliability
**NFR-4: Uptime**
- System MUST support 24/7 operation without restart (for deployment period)
- System MUST recover gracefully from network failures
**NFR-5: Availability**
- System MUST be available for remote access when VPN is connected
- System MUST NOT crash or hang under normal operation
### 4.3 Usability
**NFR-6: Ease of Use**
- Installation MUST require < 10 minutes of user interaction
- User MUST be able to connect to PAW within 2 minutes of login
- User MUST NOT need to configure system settings
**NFR-7: Maintainability**
- System MUST support security updates via APT
- System MUST allow administrator to add required packages (if needed)
- System MUST provide logs for troubleshooting
### 4.4 Security
**NFR-8: Compliance**
- System MUST meet CIS Debian 13 Benchmark requirements
- System MUST pass automated compliance tests
- System MUST be auditable by external security teams
**NFR-9: Encryption**
- WireGuard tunnel MUST use strong encryption (ChaCha20-Poly1305)
- VPN keys MUST be securely stored (WireGuard config files)
- Optional: Root filesystem encryption support
---
## 5. User Inputs Required
During installation, user MUST provide:
### 5.1 User Account
- **Username**: For non-root user account (e.g., `user`)
- **Password**: Must meet complexity requirements:
- Minimum 12 characters
- Mixed case (uppercase and lowercase)
- At least one number
- At least one special character
### 5.2 Root Account
- **Password**: Must meet same complexity requirements as user password
- Root access: Local console only (no remote root)
### 5.3 Target Disk
- **Disk selection**: User selects disk/partition for installation
- **Partitioning**: Automated (LVM, no manual configuration)
- **Warning**: All data on selected disk will be wiped
---
## 6. System Components
### 6.1 Core Components
- **Operating System**: Debian 13 (trixie)
- **Kernel**: Linux (latest from Debian 13)
- **Init System**: systemd
- **Bootloader**: GRUB2 (UEFI and BIOS support)
### 6.2 Desktop Components
- **Window Manager**: IceWM
- **Session Manager**: Default X session
- **Auto-start**: Remmina launches on login
### 6.3 Network Components
- **VPN Client**: WireGuard
- **Network Manager**: NetworkManager (for DHCP)
- **Firewall**: nftables/iptables
### 6.4 Security Components
- **Mandatory Access Control**: AppArmor (enforcing)
- **Intrusion Detection**: AIDE
- **Audit Framework**: auditd
- **Secure Boot**: GRUB with signed bootloader
---
## 7. Compliance Requirements
The system MUST comply with:
### 7.1 CIS Benchmarks
- CIS Debian 13 Benchmark (Level 1 controls)
- Configuration reviewed and validated
### 7.2 Security Standards
- NIST SP 800-53 (Moderate impact baseline)
- Industry best practices for secure remote access
### 7.3 Operational Security
- Least privilege: Only necessary components installed
- Defense in depth: Multiple security layers
- Security by default: Secure configuration out of the box
---
## 8. Testing Requirements
The system MUST be tested for:
### 8.1 Installation Testing
- ISO boots successfully on UEFI systems
- ISO boots successfully on BIOS systems
- Preseed configuration works as expected
- User can install system with minimal input
### 8.2 Security Testing
- Firewall rules block unauthorized traffic
- WireGuard tunnel establishes successfully
- SSH and remote access are disabled
- AppArmor is enforcing
- AIDE integrity checks work
### 8.3 Functional Testing
- User can login to desktop
- Remmina launches automatically
- User can connect to PAW via RDP
- System works on bare metal hardware
---
## 9. Verification Strategy
### 9.1 First-Boot Verification (Automatic)
The system automatically runs verification on first boot:
1. **Verification Service**: Systemd service `football-first-boot` runs once on first boot
2. **Verification Script**: `/usr/local/bin/verify-system.sh` checks all functional requirements
3. **Status Tracking**: `/var/lib/football/verification-status` prevents re-running
4. **Logging**: Results logged to `/var/log/football-first-boot-verification.log`
**Verification Checks**:
- FR-1: Remote Access (Remmina, WireGuard, IceWM installed)
- FR-2: Network Isolation (SSH disabled, firewall configured)
- FR-3: Minimal UI (IceWM configured, Remmina auto-starts)
- FR-5: Zero Remote Admin (SSH/telnet disabled)
- FR-6: System Hardening (AppArmor, auditd, AIDE installed)
- FR-7: Integrity (AIDE database and config exist)
- FR-8: Firewall (nftables/iptables installed and enabled)
- FR-9: Boot Config (GRUB and kernel installed)
- FR-10: Storage (LVM installed, root filesystem mounted)
- FR-11: System Updates (APT configured, no dev tools)
- FR-12: Logging (rsyslog, logrotate, auditd configured)
### 9.2 Preseed Integration (Installation)
Verification scripts are embedded in ISO and copied during installation:
**Scripts Baked into ISO**:
- `scripts/verify-system.sh` → `/usr/local/bin/verify-system.sh`
- `config/disable-wifi-bt.sh` → Run during late_command
- `config/football-first-boot.service` → `/etc/systemd/system/`
**Preseed Late_Command Actions**:
1. Disable SSH and SSHD services (mask and disable)
2. Disable Bluetooth service (mask)
3. Run `disable-wifi-bt.sh` script (blacklist kernel modules)
4. Copy `verify-system.sh` to `/usr/local/bin/`
5. Copy `football-first-boot.service` to `/etc/systemd/system/`
6. Enable first-boot verification service
7. Create autostart directory and Remmina autostart file
8. Create `.xinitrc` for IceWM session
9. Set correct permissions on `/home/user`
### 9.3 WiFi and Bluetooth Disabling
Both are completely disabled during installation:
**Kernel Module Blacklisting**:
- `/etc/modprobe.d/disable-wifi.conf`: All WiFi drivers blacklisted
- `/etc/modprobe.d/disable-bluetooth.conf`: All Bluetooth drivers blacklisted
**Service Masking**:
- Bluetooth service masked
- No WiFi services exist
**Package Removal**:
- `bluez`, `bluez-firmware` purged during install
### 9.4 Manual Verification (Optional)
Administrators can run verification manually:
```bash
# Run verification script
/usr/local/bin/verify-system.sh
# Check first-boot verification status
cat /var/lib/football/verification-status
# View verification logs
cat /var/log/football-first-boot-verification.log
```
### 9.5 ISO Verification (Pre-Deployment)
Before deployment, ISO can be tested:
```bash
# Test ISO by booting VM
./scripts/test-iso.sh
# Access VM console
screen -r football-iso-test
# Check for first-boot verification completion
tail -f /output/vm-console.log
```
---
## 10. Acceptance Criteria
The Football Secure Access System is considered production-ready when:
1. **ISO Artifact**:
- ISO boots on both UEFI and BIOS systems
- ISO contains embedded preseed configuration
- ISO is ~350-400MB in size
2. **Installation**:
- User can install system with < 10 minutes of interaction
- Installation requires only username, password, root password, disk selection
- All other steps are automated via preseed
3. **Security**:
- SSH is disabled
- Firewall blocks all unauthorized traffic
- WireGuard tunnel is only network path
- AppArmor is enforcing
- System passes CIS Debian 13 Benchmark tests
4. **Functionality**:
- User can login to IceWM desktop
- Remmina launches automatically
- User can connect to PAW via RDP
- Remote desktop performance is acceptable
5. **Compliance**:
- System meets all functional requirements
- System passes all automated tests
- System is auditable by external security teams
---
## 10. Revision History
| Version | Date | Author | Changes |
|---------|-------|---------|----------|
| 1.0 | 2025-01-20 | Initial functional requirements specification |
---
## Appendix A: Glossary
- **PAW**: Privileged Access Workstation - High-security workstation with administrative access to infrastructure
- **VPN**: Virtual Private Network - Encrypted network tunnel for secure remote access
- **RDP**: Remote Desktop Protocol - Protocol for remote desktop access
- **UEFI**: Unified Extensible Firmware Interface - Modern firmware interface
- **BIOS**: Basic Input/Output System - Legacy firmware interface
- **CIS**: Center for Internet Security - Organization providing security benchmarks
- **AIDE**: Advanced Intrusion Detection Environment - File integrity monitoring tool
- **AppArmor**: Linux Mandatory Access Control system
- **WireGuard**: Modern, high-performance VPN protocol
- **Preseed**: Debian installer automation mechanism
---
## Appendix B: Related Documents
- `docs/BUILD-DOCUMENTATION.md` - Build system documentation
- `docs/SECURITY-BASELINES.md` - Security hardening guide
- `docs/COMPLIANCE.md` - Compliance requirements
- `AGENTS.md` - Project overview and status
- `README.md` - Quick start guide

841
docs/INCIDENT-RESPONSE.md
View File

@@ -1,841 +0,0 @@
# Football Secure Access System - Incident Response Procedures
## Document Information
- **System Name**: Football Secure Access System
- **Classification**: Controlled Unclassified Information (CUI)
- **Version**: 1.0
- **Effective Date**: 2024-01-13
- **Review Date**: 2025-01-13
- **Owner**: Security Team
---
## Table of Contents
1. [Introduction](#1-introduction)
2. [Incident Classification](#2-incident-classification)
3. [Incident Detection](#3-incident-detection)
4. [Incident Response Process](#4-incident-response-process)
5. [Specific Incident Procedures](#5-specific-incident-procedures)
6. [Post-Incident Activities](#6-post-incident-activities)
7. [Communication Procedures](#7-communication-procedures)
8. [Documentation Requirements](#8-documentation-requirements)
9. [Training and Drills](#9-training-and-drills)
---
## 1. Introduction
### 1.1 Purpose
This document establishes procedures for detecting, responding to, and recovering from security incidents affecting the Football Secure Access System.
### 1.2 Objectives
- Minimize impact of security incidents
- Preserve evidence for investigation
- Restore system operations quickly
- Prevent recurrence of incidents
- Protect CUI from compromise
### 1.3 Scope
These procedures apply to:
- All Football Secure Access Systems deployed to Tier0 infrastructure
- All personnel responding to incidents
- All incidents affecting system security, availability, or data
### 1.4 Incident Response Team (IRT)
**Primary IRT Members:**
- Incident Response Coordinator: irt-coordinator@knel.org
- Security Analyst: security@knel.org
- System Administrator: admin@knel.org
- Compliance Officer: compliance@knel.org
**Supporting Personnel:**
- Legal Counsel (as needed)
- Public Relations (as needed)
- Management (as needed)
---
## 2. Incident Classification
### 2.1 Category I - Emergency
**Definition**: Active compromise or attack in progress
**Examples**:
- Active intrusion or malware execution
- Data exfiltration in progress
- Ransomware attack
- Denial of service affecting critical operations
- Physical security breach
**Response Time**: Immediate (within 15 minutes)
**Notification**: Immediately notify IRT Coordinator and Management
### 2.2 Category II - Urgent
**Definition**: Suspected compromise or serious security event
**Examples**:
- Suspicious login activity
- Security control failure
- Unexplained system behavior
- Loss of CUI suspected
- System compromise indicators
**Response Time**: Within 1 hour
**Notification**: Immediately notify IRT Coordinator
### 2.3 Category III - Routine
**Definition**: Security event requiring investigation
**Examples**:
- Policy violation
- Failed access attempts
- Minor security event
- Required compliance reporting
- Software vulnerability identified
**Response Time**: Within 24 hours
**Notification**: Report to IRT
---
## 3. Incident Detection
### 3.1 Detection Sources
**Automated Detection:**
- File Integrity Monitoring (AIDE) alerts
- Audit rule violations
- Firewall log anomalies
- System log errors
- Failed login attempts
- Intrusion Detection System (IDS) alerts
**Manual Detection:**
- User reports
- System administrator observations
- Security review findings
- Vulnerability scan results
- Compliance audit results
### 3.2 Detection Indicators
**Compromise Indicators:**
- Unexplained system behavior
- New or unexpected processes
- Network connections to unknown IPs
- Unauthorized file modifications
- Disabled security controls
- Unusual login activity
**Anomaly Indicators:**
- Performance degradation
- Unexpected system reboots
- Missing or corrupted files
- Failed backups
- Unusual error messages
**Security Control Failures:**
- Auditd not running
- Firewall rules changed
- AIDE check failures
- AppArmor profiles disabled
- WireGuard tunnel down
### 3.3 Initial Assessment
Upon detection of potential incident:
1. **Confirm Incident**: Verify that incident is real, not false positive
2. **Classify Incident**: Determine incident category (I, II, or III)
3. **Assess Impact**: Estimate potential impact on CUI and operations
4. **Determine Scope**: Identify affected systems and data
5. **Initiate Response**: Activate incident response procedures
---
## 4. Incident Response Process
### 4.1 Phase 1: Preparation
**Pre-Incident Preparation:**
- Incident response procedures documented and reviewed
- Incident response team trained
- Response tools and resources available
- Communication channels established
- Backups verified and accessible
- Contact information current
### 4.2 Phase 2: Detection and Analysis
**Steps:**
1. **Verify Incident**
- Confirm incident is real
- Rule out false positives
- Gather initial evidence
- Document findings
2. **Triage Incident**
- Classify incident (Category I, II, III)
- Assess severity
- Estimate impact
- Determine scope
3. **Analyze Incident**
- Identify root cause
- Determine attack vector
- Assess data impact
- Identify affected systems
4. **Document Initial Assessment**
- Incident description
- Category and severity
- Initial impact assessment
- Potential data exposure
### 4.3 Phase 3: Containment
**Goals**: Stop incident from spreading, limit damage
**Containment Strategies:**
**System Containment:**
- Isolate affected system from network
- Disconnect from WireGuard tunnel
- Suspend non-critical services
- Disable affected accounts
**Network Containment:**
- Block attacker IPs at firewall
- Filter suspicious traffic
- Disconnect from VPN
- Implement temporary restrictions
**Data Containment:**
- Disable access to affected data
- Back up potentially compromised data
- Preserve evidence
- Prevent further data exfiltration
**Containment Decision Factors:**
- System criticality
- Data sensitivity
- Business impact
- Evidence preservation needs
### 4.4 Phase 4: Eradication
**Goals**: Remove threat, restore clean system
**Steps:**
1. **Identify Threat**
- Determine malware type (if applicable)
- Identify attacker tools
- Understand attack methodology
- Locate all malicious artifacts
2. **Remove Threat**
- Remove malware
- Delete attacker tools
- Remove unauthorized accounts
- Remove backdoors
- Clean malicious configuration changes
3. **Patching**
- Identify vulnerabilities exploited
- Apply security patches
- Update software
- Re-configure security controls
4. **Verification**
- Verify threat removed
- Confirm system clean
- Validate security controls
- Test system functionality
### 4.5 Phase 5: Recovery
**Goals**: Restore normal operations, maintain security
**Steps:**
1. **Restore from Backup**
- Identify clean backup
- Verify backup integrity
- Restore system from backup
- Confirm system functional
2. **Apply Security Patches**
- Apply all pending security updates
- Re-configure security controls
- Verify firewall rules
- Confirm audit logging
3. **Verify System Integrity**
- Run AIDE to verify files
- Check for unauthorized modifications
- Validate system configuration
- Test critical functions
4. **Restore Operations**
- Reconnect to network (WireGuard)
- Enable user access
- Verify applications working
- Monitor for issues
5. **Post-Incident Monitoring**
- Enhanced monitoring for 30 days
- Additional log review
- Regular security assessments
- Watch for recurrence
### 4.6 Phase 6: Post-Incident Activity
**Goals**: Learn from incident, improve security
**Steps:**
1. **Post-Mortem Review** (within 7 days)
- Incident timeline
- Root cause analysis
- Impact assessment
- Response effectiveness
- Lessons learned
2. **Documentation**
- Complete incident report
- Gather all evidence
- Document actions taken
- Update procedures
3. **Remediation**
- Address root causes
- Implement security improvements
- Update policies as needed
- Provide additional training
4. **Communication**
- Stakeholder debrief
- Incident summary
- Actions taken
- Preventive measures implemented
---
## 5. Specific Incident Procedures
### 5.1 Malware Incident
**Detection Indicators:**
- AIDE file integrity alerts
- Suspicious processes
- System performance issues
- Unexplained file changes
- Ransomware messages
**Response:**
1. **Isolate System**
- Disconnect from network
- Suspend user sessions
- Preserve volatile memory
2. **Identify Malware**
- Scan system for malware
- Identify malware type
- Determine infection vector
- Assess data exposure
3. **Contain Malware**
- Quarantine infected files
- Block malware communication
- Disable affected accounts
- Preserve evidence
4. **Remove Malware**
- Remove malware files
- Clean registry/keys
- Remove persistence mechanisms
- Verify removal complete
5. **Restore System**
- Restore from clean backup
- Apply security patches
- Verify system integrity
- Resume operations
6. **Post-Incident**
- Analyze malware source
- Update anti-malware signatures
- Review security controls
- Update procedures
### 5.2 Data Breach Incident
**Detection Indicators:**
- Evidence of data exfiltration
- Unauthorized access to CUI
- Unusual data access patterns
- Missing or altered data
- Insider threat indicators
**Response:**
1. **Assess Breach**
- Determine what data was accessed
- Identify who accessed data
- Determine if data was copied
- Assess data sensitivity
2. **Contain Breach**
- Revoke all potentially compromised accounts
- Disable access to affected data
- Preserve logs and evidence
- Prevent further access
3. **Notify Stakeholders**
- Notify management immediately
- Notify legal counsel
- Notify compliance officer
- Prepare for external notification
4. **Investigate Breach**
- Review audit logs
- Interview involved personnel
- Analyze access patterns
- Determine root cause
5. **Remediate**
- Address access control weaknesses
- Implement additional security controls
- Update monitoring
- Provide training if needed
6. **Notify Affected Parties**
- Determine if external notification required
- Prepare notification messages
- Issue notifications per regulations
- Document notifications
### 5.3 Denial of Service Incident
**Detection Indicators:**
- System unavailable or slow
- High resource utilization
- Network connectivity issues
- Service crashes
- Unexplained traffic spikes
**Response:**
1. **Assess Impact**
- Determine affected services
- Assess user impact
- Identify attack type (if applicable)
- Estimate duration
2. **Mitigate**
- Implement traffic filtering
- Block attack sources
- Increase resources if possible
- Prioritize critical services
3. **Investigate**
- Identify attack vector
- Determine attack source
- Analyze attack patterns
- Assess vulnerability exploited
4. **Recover**
- Restore services
- Address vulnerability
- Implement additional protections
- Monitor for recurrence
### 5.4 Unauthorized Access Incident
**Detection Indicators:**
- Failed login attempts
- Successful logins from unusual locations
- New user accounts created
- Privilege escalation attempts
- Unusual administrative actions
**Response:**
1. **Contain Access**
- Lock affected accounts
- Revoke compromised credentials
- Disable suspicious accounts
- Block attacker IPs
2. **Assess Access**
- Review access logs
- Determine what was accessed
- Assess data exposure
- Identify attacker (if possible)
3. **Secure System**
- Change all passwords
- Verify security controls intact
- Check for backdoors
- Validate system integrity
4. **Investigate**
- Determine how access was gained
- Identify vulnerability exploited
- Review security controls failure
- Assess detection capabilities
5. **Prevent Recurrence**
- Address identified vulnerabilities
- Improve authentication controls
- Enhance monitoring
- Update procedures
### 5.5 Physical Security Incident
**Detection Indicators:**
- Equipment theft or loss
- Unauthorized physical access
- Physical tampering
- Media theft or loss
- Environmental threats (fire, water)
**Response:**
1. **Secure Area**
- Secure physical area
- Prevent further access
- Document scene
- Preserve evidence
2. **Assess Impact**
- Determine what was stolen/accessed
- Assess data exposure risk
- Identify affected systems
- Review access logs
3. **Notify**
- Notify security team immediately
- Notify management
- Notify legal counsel
- Notify law enforcement (if appropriate)
4. **Remediate**
- Replace stolen equipment
- Revoke credentials from stolen equipment
- Audit access logs
- Enhance physical security
5. **Prevent Recurrence**
- Review physical security controls
- Implement additional security measures
- Update procedures
- Provide security awareness training
---
## 6. Post-Incident Activities
### 6.1 Incident Report
**Report Contents:**
1. **Executive Summary**
- Incident overview
- Impact assessment
- Response summary
- Key findings
2. **Incident Details**
- Incident timeline
- Detection method
- Classification
- Affected systems and data
3. **Root Cause Analysis**
- What happened
- Why it happened
- How it happened
- Contributing factors
4. **Response Actions**
- Containment actions
- Eradication actions
- Recovery actions
- Timeline of actions
5. **Impact Assessment**
- Data exposure
- System impact
- Operational impact
- Financial impact
6. **Lessons Learned**
- What went well
- What didn't go well
- What could be improved
- Recommended changes
7. **Recommendations**
- Security improvements
- Process improvements
- Training needs
- Policy updates
**Report Timeline:**
- Initial Report: Within 24 hours of incident detection
- Interim Updates: As significant information becomes available
- Final Report: Within 7 days of incident resolution
### 6.2 Lessons Learned Meeting
**Participants:**
- Incident Response Team
- Management
- Affected stakeholders
- Security team
**Agenda:**
1. Incident timeline review
2. Root cause presentation
3. Response effectiveness assessment
4. Lessons learned discussion
5. Recommendations review
6. Action item assignment
**Outcomes:**
- Approved incident report
- Action items with owners and due dates
- Process improvements identified
- Training needs identified
- Policy updates required
### 6.3 Security Improvements
**Based on incident findings:**
1. **Technical Improvements**
- Address vulnerabilities exploited
- Enhance security controls
- Improve monitoring
- Update tools and procedures
2. **Process Improvements**
- Update incident response procedures
- Improve detection capabilities
- Enhance reporting processes
- Streamline communication
3. **Training Improvements**
- Address training gaps
- Update training materials
- Conduct additional training
- Provide security awareness
---
## 7. Communication Procedures
### 7.1 Internal Communication
**Within IRT:**
- Use encrypted communication channels
- Share information as appropriate
- Coordinate response actions
- Maintain incident log
**With Management:**
- Immediate notification for Category I
- Within 1 hour for Category II
- Within 24 hours for Category III
- Regular updates as incident progresses
**With Affected Users:**
- Notify when incident affects them
- Provide guidance on what to do
- Update on incident resolution
- Provide post-incident instructions
### 7.2 External Communication
**Legal Counsel:**
- Involved early in process
- Consult on legal requirements
- Advise on notification obligations
- Review all external communications
**Law Enforcement:**
- Involved when criminal activity suspected
- Coordinate evidence preservation
- Provide requested information
- Follow legal counsel guidance
**External Parties (Customers, Partners):**
- Notify when CUI potentially exposed
- Follow regulatory notification requirements
- Provide incident information as appropriate
- Coordinate with external IRT if needed
**Media/Press:**
- All media inquiries referred to designated spokesperson
- Coordinate responses with legal and PR
- Provide factual information only
- Do not disclose sensitive information
### 7.3 Communication Guidelines
**Do's:**
- Be factual and accurate
- Communicate timely
- Coordinate with all stakeholders
- Protect sensitive information
- Follow legal requirements
- Maintain professional tone
**Don'ts:**
- Speculate or guess
- Over-promise or under-deliver
- Blame individuals or groups
- Discuss ongoing investigations publicly
- Dismiss concerns
- Minimize impact
---
## 8. Documentation Requirements
### 8.1 Incident Log
**Maintained Throughout Incident:**
- Timestamp of all actions
- Description of all activities
- Decisions made and rationale
- Evidence collected
- Communication sent/received
- Impact assessments
### 8.2 Evidence Collection
**Evidence Types:**
- System logs (audit, system, security)
- Network logs (firewall, WireGuard)
- File system images
- Memory dumps
- Screenshots
- Notes and observations
- Interview transcripts
**Evidence Handling:**
- Preserve chain of custody
- Document collection method
- Store evidence securely
- Protect from modification
- Document disposition
### 8.3 Documentation Retention
**Incident Documentation:**
- Incident reports: 7 years
- Evidence: 7 years
- Logs: 365 days (as per audit policy)
- Meeting notes: 7 years
---
## 9. Training and Drills
### 9.1 Training
**Incident Response Training:**
- Annual training for IRT members
- Security awareness training for all users
- Role-specific training as needed
- Training on updated procedures
**Training Content:**
- Incident classification
- Detection methods
- Response procedures
- Evidence preservation
- Communication procedures
- Documentation requirements
### 9.2 Drills
**Incident Response Drills:**
- Conducted annually
- Cover different incident types
- Involve all IRT members
- Test procedures and tools
- Identify gaps and improvements
**Drill Types:**
- Malware incident drill
- Data breach drill
- Unauthorized access drill
- Physical security drill
- Denial of service drill
**Drill Assessment:**
- Evaluate response effectiveness
- Identify training needs
- Update procedures based on findings
- Document drill results
---
## Contact Information
**Incident Response Team:**
- Incident Response Coordinator: irt-coordinator@knel.org
- Security Team: security@knel.org
- Compliance Officer: compliance@knel.org
- System Administrator: admin@knel.org
**Emergency Contacts:**
- Management: [Contact information per org chart]
- Legal Counsel: [Contact information]
- Law Enforcement: 911 / [Local non-emergency]
**After Hours:**
- Use on-call rotation per org procedures
- Escalation procedures apply
- Document all after-hours contacts
---
## Related Documents
- Security Policy (docs/SECURITY-POLICY.md)
- Audit and Logging Policy (docs/AUDIT-POLICY.md)
- Change Management Policy (docs/CHANGE-MANAGEMENT-POLICY.md)
- Acceptable Use Policy (docs/ACCEPTABLE-USE-POLICY.md)
- Compliance Documentation (COMPLIANCE.md)
---
**Document Control**
- **Owner**: Security Team
- **Approver**: CISO
- **Next Review**: 2025-01-13
- **Classification**: CUI
- **Version**: 1.0
- **Effective Date**: 2024-01-13
---
**End of Document**

1042
docs/SECURITY-BASELINES.md
View File

File diff suppressed because it is too large Load Diff

659
docs/SECURITY-POLICY.md
View File

@@ -1,659 +0,0 @@
# Football Secure Access System - Security Policies
## Document Information
- **System Name**: Football Secure Access System
- **Classification**: Controlled Unclassified Information (CUI)
- **Version**: 1.0
- **Effective Date**: 2024-01-13
- **Review Date**: 2025-01-13
- **Compliance Standards**: CIS Debian 13, CMMC Level 3, FedRAMP Moderate, NIST SP 800-171
---
## Table of Contents
1. [Information Security Policy](#1-information-security-policy)
2. [Access Control Policy](#2-access-control-policy)
3. [Network Security Policy](#3-network-security-policy)
4. [Incident Response Policy](#4-incident-response-policy)
5. [Change Management Policy](#5-change-management-policy)
6. [Audit and Logging Policy](#6-audit-and-logging-policy)
7. [Password Policy](#7-password-policy)
8. [Acceptable Use Policy](#8-acceptable-use-policy)
9. [Physical Security Policy](#9-physical-security-policy)
10. [Data Classification Policy](#10-data-classification-policy)
---
## 1. Information Security Policy
### 1.1 Purpose
This policy establishes the framework for protecting Controlled Unclassified Information (CUI) and ensuring the confidentiality, integrity, and availability of the Football Secure Access System.
### 1.2 Scope
This policy applies to:
- All Football Secure Access Systems deployed to Tier0 infrastructure
- All users accessing the system
- All administrators maintaining the system
- All contractors and third parties with system access
### 1.3 Policy Statements
1.3.1 All systems must be configured in accordance with CIS Debian 13 Benchmark
1.3.2 All CUI stored on or transmitted through the system must be protected via encryption
1.3.3 All access to the system must be logged and audited
1.3.4 All security incidents must be reported within 1 hour of discovery
1.3.5 All users must complete security awareness training before system access is granted
1.3.6 All systems must undergo annual security assessments
1.3.7 All security controls must be verified quarterly for compliance
---
## 2. Access Control Policy
### 2.1 Purpose
To establish controls for granting, managing, and revoking access to the Football Secure Access System.
### 2.2 Access Principles
2.2.1 **Principle of Least Privilege**
- Users are granted only the minimum access necessary to perform their duties
- Access is reviewed quarterly and revoked when no longer required
2.2.2 **Separation of Duties**
- No single individual has complete control over security functions
- Administrative and operational duties are separated
2.2.3 **Need-to-Know**
- Access to CUI is restricted to individuals with a verified need
- Access requests must be documented and approved
### 2.3 User Access Requirements
2.3.1 All users must have a unique user account
2.3.2 All accounts must be associated with an individual (no shared accounts)
2.3.3 All accounts must be protected with a password conforming to the Password Policy
2.3.4 All accounts must be automatically locked after 5 failed login attempts
2.3.5 All accounts must be automatically locked after 90 days of inactivity
### 2.4 Administrative Access
2.4.1 Administrative access requires physical access to the system (no remote SSH)
2.4.2 All administrative actions must be logged
2.4.3 All administrators must complete security training annually
2.4.4 Administrative access must be granted via documented authorization
### 2.5 Access Revocation
2.5.1 Access must be revoked immediately upon:
- Termination of employment
- Change in job duties
- Suspicion of security compromise
- Completion of assigned project
2.5.2 Access revocation must be logged and audited
2.5.3 Immediate supervisors must be notified of access revocation
---
## 3. Network Security Policy
### 3.1 Purpose
To establish network security controls for protecting CUI during transmission.
### 3.2 Network Architecture
3.2.1 The system implements a **WireGuard-only networking model**:
- All outbound network traffic MUST pass through a WireGuard VPN tunnel
- Direct network access from the physical interface (eth0) is BLOCKED
- Only traffic to the configured WireGuard endpoint is permitted on eth0
- Inbound traffic from the internet is BLOCKED (except WireGuard keepalives)
3.2.2 **Permitted Traffic**:
- WireGuard VPN traffic to configured endpoint (UDP only)
- DHCP for initial IP acquisition
- All traffic through the WireGuard tunnel (wg0)
3.2.3 **Prohibited Traffic**:
- Direct internet access
- SSH, Telnet, or other remote access protocols
- File sharing protocols (NFS, SMB)
- Email protocols (SMTP, IMAP, POP)
- Web server traffic
- Any traffic not explicitly permitted
### 3.3 Network Isolation
3.3.1 The system is **networkly isolated** from the public internet
3.3.2 All CUI transmission occurs only through the encrypted WireGuard tunnel
3.3.3 The system has no inbound network services
### 3.4 Remote Access Prohibition
3.4.1 **Remote access is STRICTLY PROHIBITED**:
- No SSH server
- No Telnet server
- No RDP server
- No VNC server
- No remote administration capabilities
3.4.2 Local console access is the ONLY permitted administrative method
3.4.3 Any remote access tools are removed from the system
---
## 4. Incident Response Policy
### 4.1 Purpose
To establish procedures for detecting, responding to, and recovering from security incidents.
### 4.2 Incident Classification
4.2.1 **Category I - Emergency**
- Active compromise or attack in progress
- Data breach suspected or confirmed
- System availability critical
**Response Time**: Immediate (within 15 minutes)
4.2.2 **Category II - Urgent**
- Suspicious activity detected
- Potential compromise
- Security control failure
**Response Time**: Within 1 hour
4.2.3 **Category III - Routine**
- Policy violation
- Minor security event
- Required reporting
**Response Time**: Within 24 hours
### 4.3 Incident Detection
4.3.1 All security incidents are detected via:
- Automated monitoring alerts
- Audit log review
- User reports
- Vulnerability scan results
4.3.2 The following events trigger incident response:
- Failed login attempts (5+ within 15 minutes)
- Unauthorized system changes
- File integrity monitoring alerts
- Security control failures
- Suspicious network activity
### 4.4 Incident Response Process
4.4.1 **Detection and Reporting**
- Incident is detected and reported immediately
- Incident is classified by security team
- Response team is notified
4.4.2 **Containment**
- System is isolated if necessary
- Affected systems are identified
- Incident scope is determined
4.4.3 **Eradication**
- Root cause is identified
- Malicious artifacts are removed
- Vulnerabilities are remediated
4.4.4 **Recovery**
- Systems are restored from clean backups
- Normal operations resume
- Post-incident monitoring is implemented
4.4.5 **Lessons Learned**
- Post-incident review is conducted within 7 days
- Root cause analysis is documented
- Procedures are updated if necessary
- Findings are communicated to stakeholders
### 4.5 Incident Notification
4.5.1 **Internal Notification**
- Security team: Immediate
- Management: Within 1 hour
- Affected users: Within 4 hours
4.5.2 **External Notification**
- If CUI breach: Within 72 hours
- If personal data breach: Within 72 hours
- If law enforcement required: As soon as practicable
---
## 5. Change Management Policy
### 5.1 Purpose
To establish procedures for managing changes to the Football Secure Access System.
### 5.2 Change Categories
5.2.1 **Standard Changes**
- Pre-authorized changes with low risk
- Routine security updates
- Configuration adjustments within approved parameters
5.2.2 **Normal Changes**
- Non-standard changes with moderate risk
- New security controls
- System upgrades
5.2.3 **Emergency Changes**
- Critical security patches
- Incident response actions
- System availability issues
### 5.3 Change Management Process
5.3.1 **Request**
- Change request is submitted
- Change category is determined
- Risk assessment is conducted
5.3.2 **Review and Approval**
- Change request is reviewed by security team
- Impact analysis is conducted
- Change is approved or rejected
5.3.3 **Testing**
- Change is tested in non-production environment
- Back-out plan is verified
- Test results are documented
5.3.4 **Implementation**
- Change is scheduled (except emergency)
- Change is implemented
- System is verified
5.3.5 **Post-Implementation**
- System is monitored for issues
- Change is documented
- Procedures are updated if necessary
### 5.4 Change Controls
5.4.1 All changes must be approved prior to implementation
5.4.2 All changes must be tested before implementation
5.4.3 All changes must be documented
5.4.4 All changes must be auditable
5.4.5 Back-out plans must be prepared for all changes
---
## 6. Audit and Logging Policy
### 6.1 Purpose
To establish requirements for system auditing and log management.
### 6.2 Audit Scope
6.2.1 The following events MUST be audited:
- All login attempts (successful and failed)
- All administrative actions
- All privilege escalations (sudo usage)
- All file access and modifications to CUI
- All system configuration changes
- All network connection attempts
- All security control modifications
### 6.3 Audit Requirements
6.3.1 Audit logs must capture:
- Timestamp
- User identity
- Event type
- Source address
- Object accessed
- Action taken
- Event outcome
6.3.2 Audit logs must be:
- Generated automatically
- Protected from unauthorized modification
- Retained for 365 days
- Available for review within 24 hours
### 6.4 Log Retention
6.4.1 Audit logs: 365 days
6.4.2 System logs: 365 days
6.4.3 Security logs: 365 days
6.4.4 Firewall logs: 90 days
6.4.5 Network logs: 90 days
### 6.5 Log Review
6.5.1 Audit logs are reviewed:
- Daily: Critical security events
- Weekly: Failed access attempts
- Monthly: Administrative activity
- Quarterly: Full audit review
6.5.2 Review findings are documented and tracked
6.5.3 Review findings result in corrective actions when necessary
---
## 7. Password Policy
### 7.1 Purpose
To establish requirements for password creation and management.
### 7.2 Password Requirements
7.2.1 **Minimum Length**: 14 characters
7.2.2 **Complexity Requirements**:
- At least 1 uppercase letter (A-Z)
- At least 1 lowercase letter (a-z)
- At least 1 digit (0-9)
- At least 1 special character (!@#$%^&*)
7.2.3 **Prohibited Characteristics**:
- Default passwords (e.g., "changeme", "password")
- Dictionary words
- Personal information (name, birthdate)
- Repeating characters (e.g., "aaaaaa")
- Sequential characters (e.g., "123456")
- Previous passwords
7.2.4 **Maximum Age**: 90 days
7.2.5 **Minimum Age**: 1 day (prevent immediate re-use)
7.2.6 **Expiration Warning**: 7 days
7.2.7 **Failed Login Attempts**: 5 attempts before lockout
7.2.8 **Lockout Duration**: 15 minutes
### 7.3 Password Management
7.3.1 Default passwords must be changed immediately upon first login
7.3.2 Passwords must not be shared
7.3.3 Passwords must not be written down or stored insecurely
7.3.4 Passwords must not be transmitted via email or chat
7.3.5 Suspicious password reset requests must be verified
---
## 8. Acceptable Use Policy
### 8.1 Purpose
To define acceptable use of the Football Secure Access System.
### 8.2 Authorized Use
8.2.1 The system is authorized for:
- Remote access to Privileged Access Workstations (PAW)
- Connecting to approved remote systems via Remmina
- Accessing necessary applications for job duties
### 8.3 Prohibited Use
8.3.1 The following uses are STRICTLY PROHIBITED:
- Personal activities
- Social media access
- Personal email access
- Downloading unauthorized software
- Storing personal data
- Sharing credentials
- Bypassing security controls
- Unauthorized data transfer
8.3.2 Prohibited activities include:
- Intentional disruption of system availability
- Unauthorized modification of system configuration
- Accessing systems without authorization
- Introducing malware or malicious code
- Interfering with security monitoring
- Violating privacy of other users
### 8.4 Monitoring
8.4.1 All system activity is monitored and logged
8.4.2 No expectation of privacy exists on this system
8.4.3 Monitoring data may be used for:
- Security investigations
- Compliance verification
- Performance analysis
- Incident response
---
## 9. Physical Security Policy
### 9.1 Purpose
To establish physical security controls for the Football Secure Access System.
### 9.2 Physical Access Controls
9.2.1 Systems must be located in secure, access-controlled areas
9.2.2 Physical access must be limited to authorized personnel
9.2.3 All physical access must be logged
9.2.4 Visitor access must be escorted
### 9.3 Device Security
9.3.1 Systems must be physically secured (locked)
9.3.2 Physical ports must be disabled or blocked when not in use:
- USB ports
- Ethernet ports
- Serial ports
- DisplayPort/HDMI ports
9.3.3 Systems must be monitored for physical tampering
9.3.4 Media devices must be controlled:
- USB storage devices must be blocked
- External drives must not be connected
- Optical drives must be disabled
### 9.4 System Disposal
9.4.1 Disposal must include:
- Complete data sanitization
- Destruction of storage media
- Removal of all labels and markings
- Documentation of disposal
9.4.2 Disposal must be approved by security team
### 9.5 Theft and Loss
9.5.1 Physical theft or loss must be reported immediately
9.5.2 Lost or stolen systems must be:
- Reported to security team within 1 hour
- Disabled from the network immediately
- Account credentials revoked immediately
- Investigated for data compromise
---
## 10. Data Classification Policy
### 10.1 Purpose
To establish classification requirements for data stored on or transmitted through the system.
### 10.2 Data Classification Levels
10.2.1 **Controlled Unclassified Information (CUI)**
- Information that requires safeguarding
- Information subject to CMMC/FedRAMP controls
- Information subject to export controls
10.2.2 **Unclassified**
- Information that does not require safeguarding
- Public information
- Routine administrative data
### 10.3 CUI Marking Requirements
10.3.1 All CUI must be marked with:
- "CUI" designation
- Distribution statement
- Handling instructions
- Exemption citation (if applicable)
10.3.2 CUI marking must be visible at all times
### 10.4 CUI Handling Requirements
10.4.1 All CUI must be:
- Encrypted at rest
- Encrypted in transit
- Accessible only to authorized personnel
- Protected from unauthorized disclosure
10.4.2 CUI must not be:
- Stored on unencrypted removable media
- Transmitted via unencrypted channels
- Shared with unauthorized individuals
- Disclosed outside approved channels
### 10.5 Data Retention
10.5.1 CUI must be retained according to:
- Legal requirements
- Contract requirements
- Operational needs
- Compliance requirements
10.5.2 CUI must be securely deleted when no longer required
---
## Policy Violations
### Violation Reporting
All suspected policy violations must be reported to:
- Security Team: security@knel.org
- Immediate Supervisor: Per organizational chart
- Incident Response Team: incidents@knel.org
### Violation Consequences
Policy violations may result in:
- Access revocation
- Disciplinary action
- Legal action
- Criminal charges (if warranted)
### Violation Investigation
All violations are investigated to:
- Determine root cause
- Assess impact
- Identify responsible parties
- Recommend corrective actions
- Update procedures if necessary
---
## Policy Review and Updates
### Review Schedule
All policies are reviewed:
- **Annually**: Comprehensive review
- **As Needed**: For compliance updates or changes
### Update Process
Policy updates require:
- Security team review
- Management approval
- Documentation of changes
- Communication to affected parties
- Training on updated policies
---
## Compliance References
This policy implements controls from:
- **CIS Debian 13 Benchmark**: Version 3.0.0
- **CMMC Level 3**: Department of Defense
- **FedRAMP Moderate**: Federal Risk and Authorization Management Program
- **NIST SP 800-53**: Security and Privacy Controls for Information Systems and Organizations
- **NIST SP 800-171**: Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations
---
## Contact Information
For policy questions or clarifications:
- **Security Team**: security@knel.org
- **Compliance Officer**: compliance@knel.org
- **Infrastructure Security**: security@knel.org
---
**Document Control**
- **Owner**: Infrastructure Security Team
- **Approver**: CISO
- **Distribution**: Need-to-know
- **Classification**: CUI
- **Version**: 1.0
- **Effective Date**: 2024-01-13
- **Next Review**: 2025-01-13
---
**End of Document**

276
scripts/build-iso.sh
View File

@@ -1,276 +0,0 @@
#!/bin/bash
# Football ISO Build Script
# Creates Debian 13 ISO with embedded preseed configuration
# ALL work done in Docker container - no host operations
set -euo pipefail
BUILD_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$BUILD_DIR/output"
echo "================================================"
echo "Football ISO Build (Docker-only)"
echo "================================================"
echo ""
# Create output directory only (everything else in Docker)
mkdir -p "$OUTPUT_DIR"
# ============================================================================
# Run entire build process in single Docker container
# ============================================================================
docker run --rm \
--name football-iso-build \
-v "$BUILD_DIR:/build" \
debian:trixie \
bash -c '
set -e
echo "================================================"
echo "Football ISO Build"
echo "================================================"
echo ""
# ============================================================================
# Step 1: Download Debian ISO
# ============================================================================
echo "[1/5] Downloading Debian 13 Netboot ISO..."
# Create temporary directory inside container
ISO_DIR="/build/iso-tmp"
mkdir -p "$ISO_DIR"
cd "$ISO_DIR"
# Install required tools
echo "Installing required tools..."
apt-get update -qq
apt-get install -y -qq wget xorriso rsync isolinux
echo ""
echo "Downloading Debian 13.3.0 (trixie) Stable Netboot ISO..."
# Download Debian 13.3.0 (trixie) stable ISO
wget -q --show-progress \
-O debian-13.3.0-amd64-netinst.iso \
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-13.3.0-amd64-netinst.iso
echo ""
echo "✅ ISO downloaded"
ls -lh "$ISO_DIR"/*.iso
echo ""
echo "✅ Step 1 complete"
echo ""
# ============================================================================
# Step 2: Extract ISO
# ============================================================================
echo "[2/5] Extracting ISO..."
echo "Extracting ISO contents..."
mkdir -p extracted
cd extracted
xorriso -osirrox on \
-indev "$ISO_DIR/debian-13.3.0-amd64-netinst.iso" \
-extract / ./
echo ""
echo "✅ ISO extracted"
echo "Files in extracted:"
ls -la | head -20
echo ""
echo "✅ Step 2 complete"
echo ""
# ============================================================================
# Step 3: Inject Preseed Configuration and Scripts
# ============================================================================
echo "[3/5] Injecting preseed configuration and scripts..."
echo "Copying preseed file..."
cp /build/config/preseed.cfg /build/iso-tmp/extracted/preseed.cfg
echo ""
echo "Copying verification and configuration scripts..."
# Create scripts and config directories on ISO
mkdir -p scripts config
# Copy scripts to ISO
cp /build/scripts/verify-system.sh scripts/
cp /build/config/disable-wifi-bt.sh config/
cp /build/config/security-config.sh config/
cp /build/config/football-first-boot.service config/
# Make scripts executable
chmod +x scripts/verify-system.sh
chmod +x config/disable-wifi-bt.sh
chmod +x config/security-config.sh
echo ""
echo "Modifying boot menu to use preseed..."
# Create preseed-enabled boot entry
if [ -f isolinux/isolinux.cfg ]; then
echo "Updating isolinux.cfg..."
# Back up original
cp isolinux/isolinux.cfg isolinux/isolinux.cfg.bak
# Add auto-install with preseed entry at top
cat > isolinux/isolinux-auto.cfg <<EOF
default football
timeout 5
label football
menu label ^Install Football Secure Access System
kernel /install.amd/vmlinuz
append vga=788 initrd=/install.amd/initrd.gz auto=true priority=critical file=/cdrom/preseed.cfg -- quiet
label manual
menu label ^Manual Install
kernel /install.amd/vmlinuz
append vga=788 initrd=/install.amd/initrd.gz -- quiet
label expert
menu label ^Expert Mode
kernel /install.amd/vmlinuz
append vga=788 initrd=/install.amd/initrd.gz priority=low -- quiet
label rescue
menu label ^Rescue Mode
kernel /install.amd/vmlinuz
append vga=788 initrd=/install.amd/initrd.gz rescue/enable=true -- quiet
EOF
# Copy to main cfg
cp isolinux/isolinux-auto.cfg isolinux/isolinux.cfg
echo "✅ Boot configuration updated"
fi
# Update GRUB for UEFI boot
if [ -f boot/grub/grub.cfg ]; then
echo "Updating grub.cfg for preseed..."
cp boot/grub/grub.cfg boot/grub/grub.cfg.bak
cat > boot/grub/grub-preseed.cfg <<EOF
set timeout=5
set default=0
menuentry "Install Football Secure Access System" {
linux /install.amd/vmlinuz auto=true priority=critical file=/cdrom/preseed.cfg
initrd /install.amd/initrd.gz
}
menuentry "Manual Install" {
linux /install.amd/vmlinuz
initrd /install.amd/initrd.gz
}
EOF
cp boot/grub/grub-preseed.cfg boot/grub/grub.cfg
echo "✅ GRUB configuration updated"
fi
echo ""
echo "✅ Preseed and scripts injected"
echo "Contents of scripts/:"
ls -la scripts/
echo ""
echo "Contents of config/:"
ls -la config/
echo ""
echo "✅ Step 3 complete"
echo ""
# ============================================================================
# Step 4: Create New ISO
# ============================================================================
echo "[4/5] Creating new ISO with preseed..."
# Ensure output directory exists
mkdir -p /build/output
# Create new ISO with preseed and scripts
xorriso -as mkisofs \
-r -V "Football Secure System" \
-o /build/output/football-installer.iso \
-J -l \
-b isolinux/isolinux.bin \
-c isolinux/boot.cat \
-no-emul-boot \
-boot-load-size 4 \
-boot-info-table \
-isohybrid-mbr /usr/lib/ISOLINUX/isohdpfx.bin \
-eltorito-alt-boot \
-e boot/grub/efi.img \
-no-emul-boot \
-isohybrid-gpt-basdat \
.
echo ""
echo "✅ ISO created"
ls -lh /build/output/football-installer.iso
echo ""
echo "✅ Step 4 complete"
echo ""
# ============================================================================
# Step 5: Verify ISO
# ============================================================================
echo "[5/5] Verifying ISO..."
echo "ISO information:"
file /build/output/football-installer.iso
echo ""
echo "ISO size:"
ls -lh /build/output/football-installer.iso
echo ""
echo "✅ Step 5 complete"
echo ""
# ============================================================================
# Cleanup
# ============================================================================
echo "Cleaning up temporary directories..."
cd /build
rm -rf "$ISO_DIR"
echo ""
echo "================================================"
echo "ISO BUILD COMPLETE"
echo "================================================"
echo ""
echo "Output file:"
echo " 📁 /build/output/football-installer.iso"
echo ""
echo "Usage:"
echo " 1. Write ISO to USB: sudo dd if=/build/output/football-installer.iso of=/dev/sdX bs=4M status=progress"
echo " 2. Boot from USB"
echo " 3. Installer will automatically use preseed configuration"
echo " 4. User only needs to provide:"
echo " - Username"
echo " - User password (min 12 chars, mixed case, numbers, special chars)"
echo " - Root password (min 12 chars, mixed case, numbers, special chars)"
echo " - Target disk for installation"
echo ""
echo "✅ BUILD COMPLETE!"
echo ""
'
echo ""
echo "================================================"
echo "Build finished on host"
echo "================================================"
echo ""
echo "ISO Location: $OUTPUT_DIR/football-installer.iso"
ls -lh "$OUTPUT_DIR/football-installer.iso"
echo ""

191
scripts/qvm.sh
View File

@@ -1,191 +0,0 @@
#!/bin/bash
# Football VM Control Script (libvirt/virsh)
# Manages QEMU VM for testing Football ISO
set -euo pipefail
BUILD_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
ISO_FILE="$BUILD_DIR/output/football-installer.iso"
DISK_FILE="$BUILD_DIR/output/football-vm-disk.qcow2"
VM_NAME="football-test"
XML_FILE="$BUILD_DIR/output/${VM_NAME}.xml"
# Create directories
mkdir -p "$(dirname "$ISO_FILE")"
mkdir -p "$(dirname "$DISK_FILE")"
mkdir -p "$(dirname "$XML_FILE")"
case "$1" in
define)
echo "Defining VM in libvirt..."
# Create disk if it doesn't exist
if [ ! -f "$DISK_FILE" ]; then
echo "Creating VM disk (8GB)..."
qemu-img create -f qcow2 "$DISK_FILE" 8G
fi
# Create libvirt XML
cat > "$XML_FILE" <<EOF
<domain type='kvm'>
<name>$VM_NAME</name>
<metadata>
<libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/qemu/libosinfo/1.0">
<libosinfo:os id="http://debian.org/debian/13"/>
</libosinfo:libosinfo>
</metadata>
<memory unit='KiB'>2097152</memory>
<currentMemory unit='KiB'>2097152</currentMemory>
<vcpu placement='static'>2</vcpu>
<os>
<type arch='x86_64' machine='pc'>hvm</type>
<boot dev='cdrom'/>
</os>
<features>
<acpi/>
<apic/>
</features>
<cpu mode='host-passthrough' check='none' migratable='on'/>
<clock offset='utc'/>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<source file='$ISO_FILE'/>
<target dev='sda' bus='sata'/>
<readonly/>
</disk>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='$DISK_FILE'/>
<target dev='sdb' bus='sata'/>
</disk>
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>
</controller>
<interface type='user'>
<mac address='52:54:00:00:00:01'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
</interface>
<graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1'>
<listen type='address' address='127.0.0.1'/>
</graphics>
<video>
<model type='cirrus' vram='16384' heads='1' primary='yes'/>
</video>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
</memballoon>
</devices>
</domain>
EOF
# Define VM in libvirt
virsh define "$XML_FILE"
echo "VM defined in libvirt"
echo ""
echo "Manage with:"
echo " virsh start $VM_NAME"
echo " virsh stop $VM_NAME"
echo " virt-manager (view in GUI)"
;;
undefine)
echo "Undefining VM from libvirt..."
virsh shutdown "$VM_NAME" 2>/dev/null || true
sleep 2
virsh undefine "$VM_NAME" && echo "VM undefined"
;;
start)
echo "Starting VM..."
virsh start "$VM_NAME"
echo ""
virsh list
echo ""
echo "VM is running. View in:"
echo " 1. virt-manager"
echo " 2. vncviewer localhost:5900"
;;
stop)
echo "Stopping VM..."
virsh shutdown "$VM_NAME" 2>/dev/null || true
# Wait for VM to actually stop (up to 30 seconds)
for _ in {1..30}; do
if ! virsh list --name | grep -q "^${VM_NAME}$"; then
echo "VM stopped"
break
fi
sleep 1
done
# If still running, force destroy
if virsh list --name | grep -q "^${VM_NAME}$"; then
virsh destroy "$VM_NAME" && echo "VM destroyed"
fi
;;
reboot)
echo "Rebooting VM..."
virsh reboot "$VM_NAME"
;;
status)
echo "Checking VM status..."
virsh list --all | grep -E "Name|$VM_NAME"
;;
console)
echo "Opening VNC console..."
if command -v vncviewer &> /dev/null; then
vncviewer localhost:5900
elif command -v remote-viewer &> /dev/null; then
remote-viewer vnc://localhost:5900
else
echo "Error: No VNC viewer found"
echo "Install: sudo apt-get install tigervnc-viewer virt-viewer"
fi
;;
delete)
echo "Deleting VM, disk, and ISO..."
# Stop VM
virsh destroy "$VM_NAME" 2>/dev/null || true
virsh undefine "$VM_NAME" 2>/dev/null || true
# Delete files
rm -f "$DISK_FILE"
rm -f "$ISO_FILE"
rm -f "$XML_FILE"
echo "VM, disk, and ISO deleted"
;;
*)
echo "Football VM Control Script (libvirt)"
echo ""
echo "Usage: $0 {define|undefine|start|stop|reboot|status|console|delete}"
echo ""
echo "Commands:"
echo " define - Create VM definition in libvirt"
echo " undefine - Remove VM from libvirt"
echo " start - Start VM"
echo " stop - Stop VM"
echo " reboot - Reboot VM"
echo " status - Check VM status"
echo " console - Open VNC console viewer"
echo " delete - Delete VM, disk, and ISO (CAUTION!)"
echo ""
echo "VM Details:"
echo " Name: $VM_NAME"
echo " Disk: $DISK_FILE"
echo " ISO: $ISO_FILE"
echo " XML: $XML_FILE"
;;
esac

180
scripts/test-iso.sh
View File

@@ -1,180 +0,0 @@
#!/bin/bash
# Football ISO Test Script
# Boots QEMU VM from ISO to test installation
# All work done in Docker container
set -euo pipefail
BUILD_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ISO_PATH="$BUILD_DIR/output/football-installer.iso"
DISK_PATH="$BUILD_DIR/output/test-vm-disk.qcow2"
CONSOLE_LOG="$BUILD_DIR/output/vm-console.log"
VM_PID_FILE="$BUILD_DIR/output/vm.pid"
echo "================================================"
echo "Football ISO Test - VM Boot"
echo "================================================"
echo ""
# ============================================================================
# Step 1: Verify ISO Exists
# ============================================================================
echo "[1/4] Verifying ISO..."
if [ ! -f "$ISO_PATH" ]; then
echo "❌ ISO not found: $ISO_PATH"
echo "Run ./build-iso.sh first"
exit 1
fi
docker run --rm \
-v "$BUILD_DIR:/build" \
debian:trixie \
bash -c "
echo 'ISO information:'
file /build/output/football-installer.iso
echo ''
echo 'ISO size:'
ls -lh /build/output/football-installer.iso
"
echo ""
echo "✅ ISO verified"
echo ""
# ============================================================================
# Step 2: Create Test Disk
# ============================================================================
echo "[2/4] Creating test disk..."
mkdir -p "$BUILD_DIR/output"
docker run --rm \
-v "$BUILD_DIR:/build" \
debian:trixie \
bash -c '
set -e
echo "Installing qemu-utils..."
apt-get update -qq
apt-get install -y -qq qemu-utils
echo ""
echo "Creating 16GB QCOW2 disk..."
cd /build/output
qemu-img create -f qcow2 test-vm-disk.qcow2 16G
echo ""
echo "✅ Test disk created"
ls -lh /build/output/test-vm-disk.qcow2
'
echo ""
echo "✅ Step 2 complete"
echo ""
# ============================================================================
# Step 3: Boot VM from ISO
# ============================================================================
echo "[3/4] Booting VM from ISO..."
echo ""
echo "VM Configuration:"
echo " CPU: 2 cores"
echo " RAM: 2GB"
echo " Disk: 16GB"
echo " Boot: $ISO_PATH"
echo ""
echo "NOTE: VM will boot in background mode"
echo "Console output will be saved to: $CONSOLE_LOG"
echo "To monitor console: tail -f $CONSOLE_LOG"
echo ""
# Start VM with QEMU using screen session
# Using screen to manage long-running QEMU process
screen -dmS football-iso-test \
qemu-system-x86_64 \
-m 2048 \
-smp 2 \
-drive file="$DISK_PATH",format=qcow2 \
-drive file="$ISO_PATH",media=cdrom,readonly=on \
-boot d \
-nographic \
-serial file:"$CONSOLE_LOG" \
-display none
# Save QEMU PID for later use
pgrep -f "qemu-system-x86_64.*$DISK_PATH" | head -1 > "$VM_PID_FILE"
echo "✅ VM started (PID: $(cat "$VM_PID_FILE" 2>/dev/null || echo 'unknown'))"
echo ""
# ============================================================================
# Step 4: Monitor Boot
# ============================================================================
echo "[4/4] Monitoring boot (waiting 120 seconds)..."
echo ""
for _ in {1..120}; do
if [ -f "$CONSOLE_LOG" ]; then
# Check for installation prompts
if grep -q "Choose the country" "$CONSOLE_LOG" 2>/dev/null; then
echo "🟢 Installer running - Country selection detected"
break
fi
# Check for errors
if grep -qi "error\|panic\|fatal" "$CONSOLE_LOG" 2>/dev/null; then
echo "⚠️ Error detected in console"
tail -20 "$CONSOLE_LOG"
break
fi
fi
sleep 1
done
echo ""
echo "==========================================="
echo "VM Status"
echo "==========================================="
echo ""
if [ -f "$VM_PID_FILE" ]; then
VM_PID=$(cat "$VM_PID_FILE" 2>/dev/null || echo 'unknown')
if kill -0 "$VM_PID" 2>/dev/null; then
echo "🟢 VM is running (PID: $VM_PID)"
else
echo "🔴 VM has stopped"
fi
fi
echo ""
echo "Recent console output (last 30 lines):"
if [ -f "$CONSOLE_LOG" ]; then
tail -30 "$CONSOLE_LOG"
else
echo "No console output yet"
fi
echo ""
echo "==========================================="
echo "Manual Access"
echo "==========================================="
echo ""
echo "To access VM console interactively:"
echo " 1. Stop current VM: kill \$(cat $VM_PID_FILE)"
echo " 2. Remove -nographic flag:"
echo " qemu-system-x86_64 \\"
echo " -m 4096 -smp 2 \\"
echo " -drive file=$DISK_PATH,format=qcow2 \\"
echo " -drive file=$ISO_PATH,media=cdrom,readonly=on \\"
echo " -boot d"
echo ""
echo "To stop VM:"
echo " kill \$(cat $VM_PID_FILE)"
echo ""
echo "Console log location: $CONSOLE_LOG"
echo ""

412
scripts/verify-system.sh
View File

@@ -1,412 +0,0 @@
#!/bin/bash
# Football System First-Boot Verification
# Verifies all functional requirements are met after installation
# Runs automatically on first boot
set -euo pipefail
LOG_FILE="/var/log/football-first-boot-verification.log"
STATUS_FILE="/var/lib/football/verification-status"
# Color codes for console output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
# Logging function
log() {
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}
# Pass function
pass() {
echo -e "${GREEN}[PASS]${NC} $1" | tee -a "$LOG_FILE"
return 0
}
# Fail function
fail() {
echo -e "${RED}[FAIL]${NC} $1" | tee -a "$LOG_FILE"
return 1
}
# Warn function
warn() {
echo -e "${YELLOW}[WARN]${NC} $1" | tee -a "$LOG_FILE"
return 0
}
# Check if this is first boot
check_first_boot() {
if [ -f "$STATUS_FILE" ]; then
log "Verification already completed. Skipping."
echo -e "${YELLOW}Skipping first-boot verification (already completed)${NC}"
return 1
fi
return 0
}
# Create status file to prevent re-running
mark_completed() {
mkdir -p "$(dirname "$STATUS_FILE")"
echo "Completed: $(date '+%Y-%m-%d %H:%M:%S')" > "$STATUS_FILE"
log "Verification marked as completed"
}
# ============================================================================
# Verification Functions
# ============================================================================
# FR-1: Remote Access to Privileged Infrastructure
verify_remote_access() {
log "FR-1: Verifying Remote Access to Privileged Infrastructure"
# Check Remmina is installed
if dpkg -l | grep -q remmina; then
pass "FR-1.1: Remmina is installed"
else
fail "FR-1.1: Remmina is NOT installed"
return 1
fi
# Check WireGuard is installed
if dpkg -l | grep -q wireguard-tools; then
pass "FR-1.2: WireGuard tools are installed"
else
fail "FR-1.2: WireGuard tools are NOT installed"
return 1
fi
# Check IceWM is installed
if dpkg -l | grep -q icewm; then
pass "FR-1.3: IceWM is installed"
else
fail "FR-1.3: IceWM is NOT installed"
return 1
fi
}
# FR-2: Network Isolation
verify_network_isolation() {
log "FR-2: Verifying Network Isolation"
# Check SSH is disabled
if systemctl is-enabled ssh >/dev/null 2>&1; then
fail "FR-2.1: SSH service is ENABLED (should be disabled)"
else
pass "FR-2.1: SSH service is disabled"
fi
if systemctl is-enabled sshd >/dev/null 2>&1; then
fail "FR-2.2: SSHD service is ENABLED (should be disabled)"
else
pass "FR-2.2: SSHD service is disabled"
fi
# Check firewall exists
if [ -f /etc/iptables/rules.v4 ] || [ -f /etc/nftables.conf ]; then
pass "FR-2.3: Firewall configuration exists"
else
fail "FR-2.3: Firewall configuration missing"
return 1
fi
# Check WireGuard config exists (in overlay)
if [ -f /etc/wireguard/wg0.conf ]; then
pass "FR-2.4: WireGuard configuration exists"
else
warn "FR-2.4: WireGuard configuration not found (user must configure)"
fi
}
# FR-3: Minimal User Interface
verify_minimal_ui() {
log "FR-3: Verifying Minimal User Interface"
# Check IceWM is default window manager
if [ -f /etc/X11/default-display-manager ]; then
pass "FR-3.1: Display manager configured"
else
pass "FR-3.1: Using default X session"
fi
# Check Remmina is in autostart
if [ -f /home/user/.config/autostart/remmina.desktop ] || \
grep -q "remmina" /home/user/.xinitrc 2>/dev/null || \
grep -q "remmina" /home/user/.bash_profile 2>/dev/null; then
pass "FR-3.2: Remmina configured to auto-start"
else
warn "FR-3.3: Remmina auto-start may not be configured"
fi
}
# FR-5: Zero Remote Administration
verify_no_remote_admin() {
log "FR-5: Verifying Zero Remote Administration"
# Check SSH is masked
if systemctl is-enabled ssh >/dev/null 2>&1 || \
systemctl is-enabled sshd >/dev/null 2>&1; then
fail "FR-5.1: SSH or SSHD is enabled (should be disabled)"
else
pass "FR-5.1: SSH and SSHD are disabled"
fi
# Check telnet is not installed
if ! dpkg -l | grep -q telnet; then
pass "FR-5.2: Telnet is NOT installed"
else
fail "FR-5.2: Telnet IS installed (security issue)"
return 1
fi
}
# FR-6: System Hardening
verify_system_hardening() {
log "FR-6: Verifying System Hardening"
# Check AppArmor is installed
if dpkg -l | grep -q apparmor; then
pass "FR-6.1: AppArmor is installed"
else
fail "FR-6.1: AppArmor is NOT installed"
return 1
fi
# Check auditd is installed
if dpkg -l | grep -q auditd; then
pass "FR-6.2: Auditd is installed"
else
fail "FR-6.2: Auditd is NOT installed"
return 1
fi
# Check AIDE is installed
if dpkg -l | grep -q aide; then
pass "FR-6.3: AIDE is installed"
else
fail "FR-6.3: AIDE is NOT installed"
return 1
fi
# Check Secure Boot files exist
if [ -f /usr/lib/ISOLINUX/isohdpfx.bin ] || \
[ -f /usr/share/grub/x86_64-efi-signed/grubx64.efi ]; then
pass "FR-6.4: Secure Boot components present"
else
warn "FR-6.4: Secure Boot verification skipped"
fi
}
# FR-7: Integrity Verification
verify_integrity() {
log "FR-7: Verifying Integrity Verification"
# Check AIDE database exists
if [ -f /var/lib/aide/aide.db ] || [ -f /var/lib/aide/aide.db.new ]; then
pass "FR-7.1: AIDE database exists"
else
warn "FR-7.1: AIDE database not found (may need initialization)"
fi
# Check AIDE config exists
if [ -f /etc/aide.conf ]; then
pass "FR-7.2: AIDE configuration exists"
else
fail "FR-7.2: AIDE configuration missing"
return 1
fi
}
# FR-8: Firewall Configuration
verify_firewall() {
log "FR-8: Verifying Firewall Configuration"
# Check nftables or iptables is installed
if dpkg -l | grep -q nftables || dpkg -l | grep -q iptables; then
pass "FR-8.1: Firewall tools are installed"
else
fail "FR-8.1: Firewall tools NOT installed"
return 1
fi
# Check firewall service is enabled
if systemctl is-enabled nftables >/dev/null 2>&1 || \
systemctl is-enabled iptables-persistent >/dev/null 2>&1; then
pass "FR-8.2: Firewall service is enabled"
else
warn "FR-8.2: Firewall service may not be enabled"
fi
}
# FR-9: Boot Configuration
verify_boot_config() {
log "FR-9: Verifying Boot Configuration"
# Check GRUB is installed
if dpkg -l | grep -q grub-pc || dpkg -l | grep -q grub-efi-amd64; then
pass "FR-9.1: GRUB bootloader is installed"
else
fail "FR-9.1: GRUB bootloader NOT installed"
return 1
fi
# Check kernel is installed
if dpkg -l | grep -q linux-image; then
pass "FR-9.2: Linux kernel is installed"
else
fail "FR-9.2: Linux kernel NOT installed"
return 1
fi
}
# FR-10: Storage Configuration
verify_storage_config() {
log "FR-10: Verifying Storage Configuration"
# Check LVM is installed
if dpkg -l | grep -q lvm2; then
pass "FR-10.1: LVM is installed"
else
fail "FR-10.1: LVM is NOT installed"
return 1
fi
# Check root filesystem exists
if mount | grep -q " on / "; then
pass "FR-10.2: Root filesystem is mounted"
else
fail "FR-10.2: Root filesystem not mounted (CRITICAL)"
return 1
fi
}
# FR-11: System Updates
verify_system_updates() {
log "FR-11: Verifying System Updates"
# Check APT is configured
if [ -f /etc/apt/sources.list ]; then
pass "FR-11.1: APT is configured"
else
fail "FR-11.1: APT configuration missing"
return 1
fi
# Check development tools are NOT installed
if dpkg -l | grep -q build-essential || dpkg -l | grep -q gcc; then
fail "FR-11.2: Development tools ARE installed (should not be)"
return 1
else
pass "FR-11.2: Development tools are NOT installed"
fi
}
# FR-12: Logging and Monitoring
verify_logging() {
log "FR-12: Verifying Logging and Monitoring"
# Check rsyslog is installed
if dpkg -l | grep -q rsyslog; then
pass "FR-12.1: Rsyslog is installed"
else
fail "FR-12.1: Rsyslog NOT installed"
return 1
fi
# Check logrotate is installed
if dpkg -l | grep -q logrotate; then
pass "FR-12.2: Logrotate is installed"
else
fail "FR-12.2: Logrotate NOT installed"
return 1
fi
# Check audit log exists
if [ -f /var/log/audit/audit.log ] || [ -d /var/log/audit ]; then
pass "FR-12.3: Audit logging is configured"
else
warn "FR-12.3: Audit log directory may not exist"
fi
}
# ============================================================================
# Main Execution
# ============================================================================
main() {
echo "================================================"
echo "Football First-Boot Verification"
echo "================================================"
echo ""
log "Starting first-boot verification"
# Check if this is first boot
if ! check_first_boot; then
exit 0
fi
# Track results
TOTAL=0
PASSED=0
FAILED=0
WARNED=0
# Run all verifications
verify_remote_access || true
verify_network_isolation || true
verify_minimal_ui || true
verify_no_remote_admin || true
verify_system_hardening || true
verify_integrity || true
verify_firewall || true
verify_boot_config || true
verify_storage_config || true
verify_system_updates || true
verify_logging || true
# Calculate results
TOTAL=$((PASSED + FAILED + WARNED))
PERCENTAGE=$((PASSED * 100 / TOTAL))
# Summary
echo ""
echo "================================================"
echo "Verification Summary"
echo "================================================"
echo ""
echo "Total Checks: $TOTAL"
echo -e "${GREEN}Passed: $PASSED${NC}"
echo -e "${RED}Failed: $FAILED${NC}"
echo -e "${YELLOW}Warnings: $WARNED${NC}"
echo ""
echo "Compliance: $PERCENTAGE%"
echo ""
# Overall status
if [ $FAILED -eq 0 ] && [ $PERCENTAGE -ge 95 ]; then
echo -e "${GREEN}✓ SYSTEM MEETS ALL FUNCTIONAL REQUIREMENTS${NC}"
echo ""
echo "The Football Secure Access System is properly configured."
echo "All functional requirements have been verified."
mark_completed
exit 0
elif [ $FAILED -eq 0 ]; then
echo -e "${YELLOW}⚠ SYSTEM MOSTLY COMPLIANT${NC}"
echo ""
echo "The system meets most functional requirements."
echo "Review warnings before production use."
mark_completed
exit 0
else
echo -e "${RED}✗ SYSTEM HAS CRITICAL ISSUES${NC}"
echo ""
echo "The system has failed functional requirements."
echo "Review failed checks and reconfigure before production use."
exit 1
fi
}
# Run main function
main

600
tests/compliance-test.sh
View File

@@ -1,600 +0,0 @@
#!/bin/bash
# Football Security and Compliance Test Suite
# Tests all security controls and compliance requirements
# Usage: ./tests/compliance-test.sh
set -e
# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Test counters
TOTAL_TESTS=0
PASSED_TESTS=0
FAILED_TESTS=0
SKIPPED_TESTS=0
WARNINGS=0
# Arrays for results
declare -a FAILED_TESTS_LIST
declare -a WARNING_LIST
# ============================================================================
# HELPER FUNCTIONS
# ============================================================================
log_test() {
echo -n "Testing: $1 ... "
((TOTAL_TESTS++))
}
pass_test() {
echo -e "${GREEN}PASS${NC}"
((PASSED_TESTS++))
}
fail_test() {
echo -e "${RED}FAIL${NC}"
((FAILED_TESTS++))
FAILED_TESTS_LIST+=("$1")
}
warn_test() {
echo -e "${YELLOW}WARNING${NC}"
((WARNINGS++))
WARNING_LIST+=("$1")
}
skip_test() {
echo -e "${BLUE}SKIP${NC}"
((SKIPPED_TESTS++))
}
section() {
echo ""
echo -e "${BLUE}========================================${NC}"
echo -e "${BLUE}$1${NC}"
echo -e "${BLUE}========================================${NC}"
echo ""
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 1: FILESYSTEMS
# ============================================================================
test_filesystems() {
section "CIS Benchmark 1: Filesystem Configuration"
# 1.1.1 Disable unused filesystems
log_test "1.1.1 Ensure unused filesystems are disabled"
if [ -f /etc/modprobe.d/no-network-fs.conf ]; then
if grep -q "install nfs /bin/true" /etc/modprobe.d/no-network-fs.conf; then
pass_test
else
fail_test "1.1.1: NFS not disabled in modprobe.d"
fi
else
fail_test "1.1.1: no-network-fs.conf not found"
fi
# 1.1.3 Ensure /tmp is configured
log_test "1.1.3 Ensure /tmp partition configured"
if [ -d /tmp ]; then
if stat -c "%a" /tmp | grep -q "1777\|0777\|0755"; then
pass_test
else
warn_test "1.1.3: /tmp permissions may not be correct"
fi
else
fail_test "1.1.3: /tmp directory not found"
fi
# 1.1.19 Ensure sticky bit on world-writable directories
log_test "1.1.19 Ensure sticky bit on /tmp"
if stat -c "%a" /tmp | grep -q "1777"; then
pass_test
else
warn_test "1.1.19: /tmp may not have sticky bit"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 3: NETWORK
# ============================================================================
test_network() {
section "CIS Benchmark 3: Network Configuration"
# 3.1.1 Ensure IP forwarding is disabled
log_test "3.1.1 Ensure IP forwarding is disabled"
if sysctl net.ipv4.ip_forward 2>/dev/null | grep -q "net.ipv4.ip_forward = 0"; then
pass_test
else
fail_test "3.1.1: IP forwarding not disabled"
fi
# 3.1.2 Ensure packet redirect sending is disabled
log_test "3.1.2 Ensure packet redirect sending is disabled"
if sysctl net.ipv4.conf.all.send_redirects 2>/dev/null | grep -q "net.ipv4.conf.all.send_redirects = 0"; then
pass_test
else
fail_test "3.1.2: Packet redirects not disabled"
fi
# 3.2.1 Ensure source routed packets are not accepted
log_test "3.2.1 Ensure source routed packets are not accepted"
if sysctl net.ipv4.conf.all.accept_source_route 2>/dev/null | grep -q "net.ipv4.conf.all.accept_source_route = 0"; then
pass_test
else
fail_test "3.2.1: Source routing not disabled"
fi
# 3.2.2 Ensure ICMP redirects are not accepted
log_test "3.2.2 Ensure ICMP redirects are not accepted"
if sysctl net.ipv4.conf.all.accept_redirects 2>/dev/null | grep -q "net.ipv4.conf.all.accept_redirects = 0"; then
pass_test
else
fail_test "3.2.2: ICMP redirects not disabled"
fi
# 3.2.8 Ensure TCP SYN Cookies is enabled
log_test "3.2.8 Ensure TCP SYN Cookies is enabled"
if sysctl net.ipv4.tcp_syncookies 2>/dev/null | grep -q "net.ipv4.tcp_syncookies = 1"; then
pass_test
else
fail_test "3.2.8: TCP SYN cookies not enabled"
fi
# 3.3.1 Ensure IPv6 router advertisements are not accepted
log_test "3.3.1 Ensure IPv6 router advertisements are not accepted"
if sysctl net.ipv6.conf.all.accept_ra 2>/dev/null | grep -q "net.ipv6.conf.all.accept_ra = 0\|not found"; then
pass_test
else
warn_test "3.3.1: IPv6 may accept router advertisements"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 4: LOGGING AND AUDITING
# ============================================================================
test_auditing() {
section "CIS Benchmark 4: Logging and Auditing"
# 4.1.1.3 Ensure rsyslog is installed
log_test "4.1.1.3 Ensure rsyslog is installed"
if command -v rsyslogd >/dev/null 2>&1 || systemctl is-active rsyslog >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.1.3: rsyslog not installed or not running"
fi
# 4.1.1.4 Ensure rsyslog service is enabled
log_test "4.1.1.4 Ensure rsyslog service is enabled"
if systemctl is-enabled rsyslog >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.1.4: rsyslog not enabled"
fi
# 4.1.2.1 Ensure system is configured to log audit records
log_test "4.1.2.1 Ensure system logs audit records"
if systemctl is-active auditd >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.2.1: auditd not running"
fi
# 4.1.2.2 Ensure auditd service is enabled
log_test "4.1.2.2 Ensure auditd service is enabled"
if systemctl is-enabled auditd >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.2.2: auditd not enabled"
fi
# 4.1.2.7 Ensure audit records are stored
log_test "4.1.2.7 Ensure audit records are stored"
if [ -d /var/log/audit ]; then
pass_test
else
fail_test "4.1.2.7: /var/log/audit directory not found"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 5: ACCESS CONTROL
# ============================================================================
test_access_control() {
section "CIS Benchmark 5: Access Control"
# 5.1.1 Ensure cron daemon is enabled and running
log_test "5.1.1 Ensure cron daemon is enabled"
if systemctl is-enabled cron >/dev/null 2>&1; then
pass_test
else
fail_test "5.1.1: cron not enabled"
fi
# 5.2.1 Ensure SSH server is not installed
log_test "5.2.1 Ensure SSH server is not installed"
if ! command -v sshd >/dev/null 2>&1 && ! systemctl list-unit-files | grep -q "sshd"; then
pass_test
else
if systemctl is-active sshd >/dev/null 2>&1; then
fail_test "5.2.1: SSH server is running"
else
warn_test "5.2.1: SSH installed but not running"
fi
fi
# 5.4.1.1 Ensure password creation requirements are configured
log_test "5.4.1.1 Ensure password creation requirements are configured"
if [ -f /etc/security/pwquality.conf ]; then
pass_test
else
fail_test "5.4.1.1: pwquality.conf not found"
fi
# 5.4.2 Ensure password hashing algorithm is SHA-512
log_test "5.4.2 Ensure password hashing algorithm is SHA-512"
if grep -q "ENCRYPT_METHOD SHA512" /etc/login.defs; then
pass_test
else
fail_test "5.4.2: Password hashing not set to SHA-512"
fi
# 5.4.3 Ensure system accounts are secured
log_test "5.4.3 Ensure system accounts are secured"
local unsecured_accounts=0
for user in daemon bin sys sync man lp mail news uucp; do
if id "$user" >/dev/null 2>&1; then
if ! passwd -S "$user" 2>/dev/null | grep -q "L"; then
((unsecured_accounts++))
fi
fi
done
if [ $unsecured_accounts -eq 0 ]; then
pass_test
else
fail_test "5.4.3: $unsecured_accounts system accounts not locked"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 6: MAINTENANCE
# ============================================================================
test_maintenance() {
section "CIS Benchmark 6: System Maintenance"
# 6.1.1 Ensure system accounts are non-login
log_test "6.1.1 Ensure system accounts are non-login"
local login_accounts=0
for user in daemon bin sys sync man lp mail news uucp; do
if id "$user" >/dev/null 2>&1; then
if [ -n "$(getent passwd "$user" | cut -d: -f7)" ]; then
shell=$(getent passwd "$user" | cut -d: -f7)
if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then
((login_accounts++))
fi
fi
fi
done
if [ $login_accounts -eq 0 ]; then
pass_test
else
warn_test "6.1.1: $login_accounts system accounts may have login shells"
fi
}
# ============================================================================
# CMMC AND FEDRAMP COMPLIANCE TESTS
# ============================================================================
test_compliance() {
section "CMMC Level 3 and FedRAMP Moderate Compliance"
# AC.6: Least privilege
log_test "AC.6: Ensure sudo configuration enforces least privilege"
if [ -f /etc/sudoers.d/cis-hardening ]; then
pass_test
else
fail_test "AC.6: CIS sudoers configuration not found"
fi
# AU.2: Audit events
log_test "AU.2: Ensure comprehensive audit rules are configured"
if [ -f /etc/audit/rules.d/cis-audit.rules ]; then
pass_test
else
fail_test "AU.2: CIS audit rules not found"
fi
# CM.6: Automated monitoring
log_test "CM.6: Ensure AIDE is configured for automated monitoring"
if [ -f /etc/aide.conf ] && command -v aide >/dev/null 2>&1; then
pass_test
else
fail_test "CM.6: AIDE not configured"
fi
# SC.8: Transmission confidentiality and integrity
log_test "SC.8: Ensure WireGuard is configured for encrypted transmission"
if [ -f /etc/wireguard/wg0.conf ]; then
pass_test
else
warn_test "SC.8: WireGuard configuration not found (may be in overlay)"
fi
# SI.7: Software and firmware integrity checking
log_test "SI.7: Ensure file integrity checking is scheduled"
if systemctl is-enabled aide-check.timer >/dev/null 2>&1; then
pass_test
else
warn_test "SI.7: AIDE check timer not enabled"
fi
}
# ============================================================================
# SECURITY CONFIGURATION TESTS
# ============================================================================
test_security_config() {
section "Security Configuration Tests"
# Firewall configuration
log_test "Ensure firewall rules are configured (WireGuard only)"
if [ -f /etc/iptables/rules.v4 ]; then
pass_test
else
warn_test "Firewall rules file not found (may be applied during boot)"
fi
# Kernel hardening
log_test "Ensure kernel hardening parameters are applied"
if [ -f /etc/sysctl.d/99-cis-hardening.conf ]; then
pass_test
else
fail_test "Kernel hardening configuration not found"
fi
# AppArmor status
log_test "Ensure AppArmor is enabled"
if systemctl is-active apparmor >/dev/null 2>&1 || [ -f /sys/kernel/security/apparmor/profiles ]; then
pass_test
else
warn_test "AppArmor may not be enabled"
fi
# Core dumps disabled
log_test "Ensure core dumps are disabled"
if grep -q "hard core 0" /etc/security/limits.conf; then
pass_test
else
fail_test "Core dumps not disabled in limits.conf"
fi
}
# ============================================================================
# NETWORK ISOLATION TESTS
# ============================================================================
test_network_isolation() {
section "Network Isolation Tests"
# SSH disabled
log_test "Ensure SSH is disabled"
if ! systemctl is-active sshd >/dev/null 2>&1 && ! systemctl is-active ssh >/dev/null 2>&1; then
pass_test
else
fail_test "SSH is running (should be disabled)"
fi
# Telnet disabled
log_test "Ensure Telnet is disabled"
if ! command -v telnetd >/dev/null 2>&1; then
pass_test
else
fail_test "Telnet server installed (should be removed)"
fi
# Bluetooth disabled
log_test "Ensure Bluetooth is disabled"
if systemctl is-active bluetooth 2>&1 | grep -q "inactive\|not found"; then
pass_test
else
fail_test "Bluetooth is active (should be disabled)"
fi
# Wireless disabled
log_test "Ensure wireless is disabled via kernel modules"
if [ -f /etc/modprobe.d/disable-wireless.conf ]; then
pass_test
else
fail_test "Wireless not disabled in modprobe.d"
fi
}
# ============================================================================
# LOGGING AND MONITORING TESTS
# ============================================================================
test_logging() {
section "Logging and Monitoring Tests"
# Audit logs exist
log_test "Ensure audit log directory exists"
if [ -d /var/log/audit ]; then
pass_test
else
fail_test "Audit log directory not found"
fi
# Security logs exist
log_test "Ensure security log directory exists"
if [ -d /var/log/security ] || [ -d /var/log ]; then
pass_test
else
warn_test "Security log directory not found"
fi
# Logrotate configured
log_test "Ensure logrotate is configured for security logs"
if [ -f /etc/logrotate.d/cis-logs ]; then
pass_test
else
warn_test "CIS logrotate configuration not found"
fi
# Audit rules loaded
log_test "Ensure audit rules are loaded"
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l 2>/dev/null | grep -q "\-a\|\-w"; then
pass_test
else
warn_test "Audit rules may not be loaded"
fi
else
skip_test "auditctl command not available"
fi
}
# ============================================================================
# COMPREHENSIVE COMPLIANCE VERIFICATION
# ============================================================================
verify_compliance() {
section "Compliance Verification Summary"
echo "CIS Debian 13 Benchmark: Verifying implementation..."
echo "CMMC Level 3: Verifying implementation..."
echo "FedRAMP Moderate: Verifying implementation..."
echo "NIST SP 800-171: Verifying implementation..."
local cis_controls=180
local cis_implemented=$(find /etc -name "*.conf" -o -name "*.rules" | grep -c "cis\|hardening" 2>/dev/null || echo 0)
echo ""
echo "Implementation Status:"
echo " CIS Controls Configured: $cis_implemented / 180"
echo " Kernel Parameters Applied: $(grep -r "^[a-z]" /etc/sysctl.d/*.conf 2>/dev/null | wc -l)"
echo " Audit Rules Defined: $(grep -r "^-a\|^-w" /etc/audit/rules.d/*.conf 2>/dev/null | wc -l)"
echo " Log Files Configured: $(ls -1 /etc/logrotate.d/ 2>/dev/null | wc -l)"
echo " Security Services Enabled: $(systemctl list-unit-files | grep -c "enabled" | head -1 || echo 0)"
echo ""
if [ $cis_implemented -gt 10 ]; then
echo -e "${GREEN}✓ CIS Benchmark implementation appears comprehensive${NC}"
else
echo -e "${YELLOW}⚠ CIS Benchmark implementation may be incomplete${NC}"
fi
}
# ============================================================================
# GENERATE REPORT
# ============================================================================
generate_report() {
section "TEST RESULTS SUMMARY"
echo -e "Total Tests: $TOTAL_TESTS"
echo -e "${GREEN}Passed: $PASSED_TESTS${NC}"
echo -e "${RED}Failed: $FAILED_TESTS${NC}"
echo -e "${YELLOW}Warnings: $WARNINGS${NC}"
echo -e "${BLUE}Skipped: $SKIPPED_TESTS${NC}"
echo ""
# Calculate pass rate
local pass_rate=0
if [ $TOTAL_TESTS -gt 0 ]; then
pass_rate=$((PASSED_TESTS * 100 / TOTAL_TESTS))
fi
echo "Pass Rate: $pass_rate%"
echo ""
# Display failed tests
if [ $FAILED_TESTS -gt 0 ]; then
echo -e "${RED}Failed Tests:${NC}"
for test in "${FAILED_TESTS_LIST[@]}"; do
echo -e " - $test"
done
echo ""
fi
# Display warnings
if [ $WARNINGS -gt 0 ]; then
echo -e "${YELLOW}Warnings:${NC}"
for warning in "${WARNING_LIST[@]}"; do
echo -e " - $warning"
done
echo ""
fi
# Compliance status
if [ $FAILED_TESTS -eq 0 ]; then
echo -e "${GREEN}✓ ALL CRITICAL TESTS PASSED${NC}"
echo ""
echo "The system meets compliance requirements for:"
echo " - CIS Debian 13 Benchmark"
echo " - CMMC Level 3"
echo " - FedRAMP Moderate"
echo " - NIST SP 800-171"
else
echo -e "${RED}✗ SOME CRITICAL TESTS FAILED${NC}"
echo ""
echo "The system does not meet all compliance requirements."
echo "Review failed tests and warnings above."
fi
}
# ============================================================================
# MAIN EXECUTION
# ============================================================================
main() {
echo "================================================"
echo "Football Security and Compliance Test Suite"
echo "================================================"
echo ""
# Check if running as root
if [ "$EUID" -ne 0 ]; then
echo -e "${YELLOW}Warning: Running as non-root user. Some tests may fail.${NC}"
echo "Run with sudo for complete results."
echo ""
fi
# Run all test suites
test_filesystems
test_network
test_auditing
test_access_control
test_maintenance
test_compliance
test_security_config
test_network_isolation
test_logging
# Verify compliance
verify_compliance
# Generate report
generate_report
# Exit with appropriate code
if [ $FAILED_TESTS -gt 0 ]; then
exit 1
else
exit 0
fi
}
# Run main function
main "$@"

323
tests/verify-compliance.sh
View File

@@ -1,323 +0,0 @@
#!/bin/bash
# Automated Compliance Verification Script
# Verifies all compliance controls are properly implemented
set -e
# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
# Results tracking
TOTAL=0
COMPLIANT=0
NON_COMPLIANT=0
PARTIALLY_COMPLIANT=0
log() {
echo -e "${BLUE}[INFO]${NC} $1"
}
pass() {
echo -e "${GREEN}[PASS]${NC} $1"
((TOTAL++))
((COMPLIANT++))
}
fail() {
echo -e "${RED}[FAIL]${NC} $1"
((TOTAL++))
((NON_COMPLIANT++))
}
warn() {
echo -e "${YELLOW}[WARN]${NC} $1"
((TOTAL++))
((PARTIALLY_COMPLIANT++))
}
check_file() {
local file=$1
if [ -f "$file" ]; then
return 0
else
return 1
fi
}
check_service() {
local service=$1
local state=$2 # enabled, disabled, active, inactive
case $state in
enabled)
systemctl is-enabled "$service" >/dev/null 2>&1
return $?
;;
disabled)
systemctl is-enabled "$service" >/dev/null 2>&1
[ $? -ne 0 ]
return $?
;;
active)
systemctl is-active "$service" >/dev/null 2>&1
return $?
;;
inactive)
systemctl is-active "$service" >/dev/null 2>&1
[ $? -ne 0 ]
return $?
;;
esac
}
check_file_content() {
local file=$1
local pattern=$2
grep -q "$pattern" "$file" 2>/dev/null
return $?
}
echo "================================================"
echo "Automated Compliance Verification"
echo "================================================"
echo ""
# ============================================================================
# CIS DEBIAN 13 BENCHMARK VERIFICATION
# ============================================================================
echo "Verifying CIS Debian 13 Benchmark Implementation..."
echo ""
# Section 1: Filesystems
echo "Section 1: Filesystems Configuration"
check_file /etc/modprobe.d/no-network-fs.conf && \
pass "1.1.1: Network filesystems disabled in modprobe" || \
fail "1.1.1: Network filesystems not disabled"
check_file_content /etc/modprobe.d/no-network-fs.conf "install nfs /bin/true" && \
pass "1.1.1: NFS specifically disabled" || \
fail "1.1.1: NFS not disabled"
# Section 3: Network Configuration
echo ""
echo "Section 3: Network Configuration"
check_file /etc/sysctl.d/99-cis-hardening.conf && \
pass "3.x: Kernel hardening configuration present" || \
fail "3.x: Kernel hardening configuration missing"
check_file_content /etc/sysctl.d/99-cis-hardening.conf "net.ipv4.ip_forward = 0" && \
pass "3.1.1: IP forwarding disabled" || \
fail "3.1.1: IP forwarding not disabled"
check_file_content /etc/sysctl.d/99-cis-hardening.conf "net.ipv4.tcp_syncookies = 1" && \
pass "3.2.8: TCP SYN cookies enabled" || \
fail "3.2.8: TCP SYN cookies not enabled"
# Section 4: Logging and Auditing
echo ""
echo "Section 4: Logging and Auditing"
check_file /etc/audit/rules.d/cis-audit.rules && \
pass "4.1.2: Comprehensive audit rules configured" || \
fail "4.1.2: Audit rules not configured"
check_file /etc/rsyslog.d/50-cis-logging.conf && \
pass "4.1.1: Rsyslog security logging configured" || \
fail "4.1.1: Rsyslog logging not configured"
check_file /etc/logrotate.d/cis-logs && \
pass "4.1.1.7: Log rotation configured" || \
fail "4.1.1.7: Log rotation not configured"
# Section 5: Access Control
echo ""
echo "Section 5: Access Control"
check_file /etc/security/pwquality.conf && \
pass "5.4.1.1: Password quality requirements configured" || \
fail "5.4.1.1: Password quality not configured"
check_file /etc/login.defs && \
pass "5.4.2: Login configuration present" || \
fail "5.4.2: Login configuration missing"
check_file_content /etc/login.defs "ENCRYPT_METHOD SHA512" && \
pass "5.4.2: Password hashing set to SHA-512" || \
fail "5.4.2: Password hashing not SHA-512"
check_file /etc/pam.d/common-password-cis && \
pass "5.4.1: PAM password hardening configured" || \
fail "5.4.1: PAM password hardening missing"
check_file /etc/sudoers.d/cis-hardening && \
pass "5.5: Sudo hardening configured" || \
fail "5.5: Sudo hardening missing"
# ============================================================================
# CMMC LEVEL 3 VERIFICATION
# ============================================================================
echo ""
echo "Verifying CMMC Level 3 Implementation..."
echo ""
# AC - Access Control
echo "AC Domain: Access Control"
check_file /etc/sudoers.d/cis-hardening && \
pass "AC.6: Least privilege sudo configuration" || \
fail "AC.6: Least privilege not configured"
# AU - Audit and Accountability
echo "AU Domain: Audit and Accountability"
check_file /etc/audit/rules.d/cis-audit.rules && \
pass "AU.2: Comprehensive audit rules" || \
fail "AU.2: Audit rules not implemented"
check_service auditd enabled && \
pass "AU.x: Auditd service enabled" || \
fail "AU.x: Auditd not enabled"
# CM - Configuration Management
echo "CM Domain: Configuration Management"
check_file /etc/aide.conf && \
pass "CM.6: File integrity monitoring configured" || \
fail "CM.6: File integrity monitoring not configured"
# SC - System and Communications Protection
echo "SC Domain: System and Communications Protection"
check_file /etc/wireguard/wg0.conf 2>/dev/null || \
pass "SC.8: WireGuard VPN configured (in overlay)" || \
warn "SC.8: WireGuard config not in overlay"
check_file /etc/iptables/rules.v4 && \
pass "SC.7: Firewall rules configured" || \
fail "SC.7: Firewall rules not configured"
# SI - System and Information Integrity
echo "SI Domain: System and Information Integrity"
check_file /etc/aide.conf && \
pass "SI.7: File integrity checking tools" || \
fail "SI.7: FIM not configured"
# ============================================================================
# FEDRAMP MODERATE VERIFICATION
# ============================================================================
echo ""
echo "Verifying FedRAMP Moderate Implementation..."
echo ""
# AC-2: Account Management
check_file /etc/security/faillock.conf 2>/dev/null || \
check_file /etc/pam.d/common-password-cis && \
pass "AC-2: Account management controls" || \
fail "AC-2: Account management not configured"
# AU-6: Audit Review
check_file /etc/rsyslog.d/50-cis-logging.conf && \
pass "AU-6: Audit logging and review capability" || \
fail "AU-6: Audit review not configured"
# CM-2: Baseline Configuration
check_file /etc/sysctl.d/99-cis-hardening.conf && \
pass "CM-2: Security baseline configuration" || \
fail "CM-2: Security baseline not configured"
# SI-2: Flaw Remediation
check_file /etc/apt/sources.list && \
pass "SI-2: Package management for updates" || \
fail "SI-2: Package management not configured"
# ============================================================================
# SECURITY CONTROL VERIFICATION
# ============================================================================
echo ""
echo "Verifying Security Controls..."
echo ""
# Service States
echo "Service Configuration"
check_service ssh disabled && \
pass "SSH service disabled" || \
fail "SSH not disabled"
check_service sshd disabled && \
pass "SSHD service disabled" || \
fail "SSHD not disabled"
check_service auditd enabled && \
pass "Auditd enabled" || \
fail "Auditd not enabled"
check_service rsyslog enabled && \
pass "Rsyslog enabled" || \
fail "Rsyslog not enabled"
# File Permissions
echo ""
echo "File Security"
[ -f /etc/passwd ] && [ $(stat -c "%a" /etc/passwd) = "644" ] && \
pass "Permissions on /etc/passwd correct" || \
warn "/etc/passwd permissions may not be correct"
[ -f /etc/shadow ] && [ $(stat -c "%a" /etc/shadow 2>/dev/null) = "640\|000" ] && \
pass "Permissions on /etc/shadow correct" || \
warn "/etc/shadow permissions may not be correct"
# Kernel Parameters
echo ""
echo "Kernel Hardening"
sysctl net.ipv4.ip_forward 2>/dev/null | grep -q "= 0" && \
pass "IP forwarding disabled (runtime)" || \
fail "IP forwarding not disabled"
sysctl net.ipv4.tcp_syncookies 2>/dev/null | grep -q "= 1" && \
pass "TCP SYN cookies enabled (runtime)" || \
fail "TCP SYN cookies not enabled"
# ============================================================================
# COMPLIANCE SUMMARY
# ============================================================================
echo ""
echo "================================================"
echo "COMPLIANCE VERIFICATION SUMMARY"
echo "================================================"
echo ""
# Calculate compliance percentage
local percentage=0
if [ $TOTAL -gt 0 ]; then
percentage=$((COMPLIANT * 100 / TOTAL))
fi
echo "Total Controls Verified: $TOTAL"
echo -e "${GREEN}Compliant: $COMPLIANT${NC}"
echo -e "${YELLOW}Partially Compliant: $PARTIALLY_COMPLIANT${NC}"
echo -e "${RED}Non-Compliant: $NON_COMPLIANT${NC}"
echo ""
echo "Compliance Percentage: $percentage%"
echo ""
# Overall status
if [ $NON_COMPLIANT -eq 0 ] && [ $percentage -ge 95 ]; then
echo -e "${GREEN}✓ SYSTEM COMPLIANT${NC}"
echo ""
echo "The system meets compliance requirements for:"
echo " ✓ CIS Debian 13 Benchmark"
echo " ✓ CMMC Level 3"
echo " ✓ FedRAMP Moderate"
echo " ✓ NIST SP 800-171"
echo " ✓ NIST SP 800-53 Moderate"
echo ""
echo "Ready for deployment to Tier0 infrastructure."
exit 0
elif [ $NON_COMPLIANT -eq 0 ] && [ $percentage -ge 90 ]; then
echo -e "${GREEN}✓ SYSTEM MOSTLY COMPLIANT${NC}"
echo ""
echo "The system meets most compliance requirements."
echo "Review warnings and address any issues."
echo ""
exit 0
elif [ $NON_COMPLIANT -eq 0 ]; then
echo -e "${YELLOW}⚠ SYSTEM PARTIALLY COMPLIANT${NC}"
echo ""
echo "The system has some partial compliance issues."
echo "Review and address warnings before deployment."
echo ""
exit 1
else
echo -e "${RED}✗ SYSTEM NOT COMPLIANT${NC}"
echo ""
echo "The system has critical non-compliance issues."
echo "Address failed controls before deployment."
echo ""
exit 1
fi