Make sure home dirs are private

Signed-off-by: Tommy <contact@tommytran.io>

Fedora-Workstation-38.sh

@@ -24,9 +24,10 @@ unpriv(){
     sudo -u nobody "$@"
 }
 
-# Moving to the home directory
-#Note that I always use /home/${USER} because gnome-terminal is wacky and sometimes doesn't load the environment variables in correctly (Right click somewhere in nautilus, click on open in terminal, then hit create new tab and you will see.)
-cd /home/"${USER}" || exit
+# Compliance
+sudo systemctl mask ctrl-alt-del.target
+sudo systemctl mask debug-shell.service
+sudo systemctl mask kdump.service
 
 # Setting umask to 077
 umask 077

GCP-Debian-11.sh

@@ -22,6 +22,13 @@ unpriv(){
   sudo -u nobody "$@"
 }
 
+# Compliance
+sudo systemctl mask ctrl-alt-del.target
+sudo systemctl mask debug-shell.service
+
+# Make home directory private
+chmod 700 /home/*
+
 # Setup NTS
 sudo rm -rf /etc/chrony/chrony.conf
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf

Proxmox-8.sh

@@ -20,6 +20,10 @@ output(){
     echo -e '\e[36m'"$1"'\e[0m';
 }
 
+# Compliance
+systemctl mask ctrl-alt-del.target
+systemctl mask debug-shell.service
+
 # Setup NTS
 rm -rf /etc/chrony/chrony.conf
 curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | tee /etc/chrony/chrony.conf

RHEL-Server-9.sh

@@ -24,6 +24,13 @@ unpriv(){
   sudo -u nobody "$@"
 }
 
+# Compliance
+sudo systemctl mask ctrl-alt-del.target
+sudo systemctl mask debug-shell.service
+
+# Make home directory private
+chmod 700 /home/*
+
 # Setup NTS
 sudo curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf -o /etc/chrony.conf
 

Ubuntu-22.04-Desktop.sh

@@ -33,6 +33,12 @@ sudo apt install -y usg
 sudo apt autoremove -y
 sudo usg fix cis_level2_workstation
 
+sudo systemctl mask ctrl-alt-del.target
+sudo systemctl mask debug-shell.service
+
+# Make home directory private
+chmod 700 /home/*
+
 # Remove AIDE
 sudo apt purge -y aide*
 
@@ -74,14 +80,6 @@ sudo sysctl -p
 # Rebuild initramfs
 sudo update-initramfs -u
 
-# Disable telemetry
-sudo systemctl stop apport.service
-sudo systemctl disable apport.service
-sudo systemctl mask apport.service
-sudo systemctl stop whoopsie.service
-sudo systemctl disable whoopsie.service
-sudo systemctl mask whoopsie.service
-
 # Systemd Hardening
 sudo mkdir -p /etc/systemd/system/NetworkManager.service.d
 unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | sudo tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf

Ubuntu-22.04-Server.sh

@@ -33,6 +33,12 @@ sudo apt install -y usg curl libpam-pwquality
 sudo apt autoremove -y
 sudo usg fix cis_level2_server
 
+sudo systemctl mask ctrl-alt-del.target
+sudo systemctl mask debug-shell.service
+
+# Make home directory private
+chmod 700 /home/*
+
 # Remove AIDE
 sudo apt purge -y aide*