bed3b07b81
- Fix function name: configure_ssh → configure_ssh_client (matches src/) - Add missing configure_fim call for AIDE File Integrity Monitoring These functions exist in src/security-hardening.sh but the hook was calling the wrong name or missing the FIM call entirely. 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush <crush@charm.land>
37 lines
817 B
Bash
Executable File
37 lines
817 B
Bash
Executable File
#!/bin/bash
|
|
# Security hardening hook for live system
|
|
set -euo pipefail
|
|
|
|
echo "Applying security hardening..."
|
|
|
|
# Apply security hardening functions from proper volume path
|
|
# Note: Source path exists at build time in Docker container
|
|
# shellcheck disable=SC1091
|
|
source /build/src/security-hardening.sh
|
|
|
|
# Create WiFi module blacklist
|
|
create_wifi_blacklist
|
|
|
|
# Create Bluetooth module blacklist
|
|
create_bluetooth_blacklist
|
|
|
|
# Configure SSH client (client only - no server per security requirements)
|
|
configure_ssh_client
|
|
|
|
# Configure password policy
|
|
configure_password_policy
|
|
|
|
# Configure File Integrity Monitoring (AIDE)
|
|
configure_fim
|
|
|
|
# Configure system limits
|
|
configure_system_limits
|
|
|
|
# Configure audit rules
|
|
configure_audit_rules
|
|
|
|
# Enable auditd service
|
|
systemctl enable auditd
|
|
|
|
echo "Security hardening completed."
|