OSハードニング：パッチ適用、ベースライン設定、CISベンチマーク

OSハードニングとは

パッチ管理

# Patch criticality SLA example
CVSS Score     SLA           Notes
----------     ----------    ----------------------
9.0 - 10.0     48 hours      Emergency patch cycle
7.0 - 8.9      7 days        Critical patch cycle
4.0 - 6.9      30 days       Standard patch cycle
0.1 - 3.9      90 days       Routine patch cycle

# Verify patch application:
# Windows: Get-HotFix | Where-Object {$_.HotFixID -eq 'KB5023706'}
# Linux:   dpkg -l | grep package_name

不要なサービスの無効化

# Windows: disable unnecessary service
SC config 'Spooler' start= disabled
SC stop 'Spooler'

# Linux: disable unused services
systemctl disable cups
systemctl stop cups
systemctl disable avahi-daemon
systemctl stop avahi-daemon

# Verify no unnecessary ports are listening:
ss -tulnp  # Linux
netstat -an | findstr LISTENING  # Windows

不要なソフトウェアの削除

# Remove unused packages (Debian/Ubuntu)
apt purge telnet ftp netcat python2 perl
apt autoremove

# Remove unused packages (RHEL/CentOS)
yum remove telnet ftp nmap-ncat

# Check what is installed:
dpkg -l | grep -i 'telnet\|ftp\|netcat'

デフォルトアカウントのセキュリティ確保

# Linux: disable root SSH login
# Edit /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication no
AllowUsers admin_user service_user

# Restart SSH:
systemctl restart sshd

# Windows: disable built-in Administrator
net user Administrator /active:no

# Rename (via Group Policy):
# Computer Config > Windows Settings > Security Settings
# > Local Policies > Security Options
# > 'Accounts: Rename administrator account'

ファイルシステムの権限と最小権限

# Find setuid/setgid binaries (Linux)
find / -perm /4000 -o -perm /2000 2>/dev/null

# Secure web root permissions
chown -R root:www-data /var/www/html
chmod -R 755 /var/www/html
chmod 640 /var/www/html/config.php

# Check overly permissive files
find /etc -perm -o+w 2>/dev/null  # world-writable in /etc

CIS Benchmarks

# CIS Benchmark check example (Linux L1)
# CIS Ubuntu 22.04 - 1.1.1.1 Disable cramfs
modprobe -n -v cramfs 2>&1 | grep -q 'Module cramfs not found'
# Expected: Module cramfs not found OR 'install /bin/false'

# Remediate:
echo 'install cramfs /bin/false' >> /etc/modprobe.d/CIS.conf

# CIS Windows - Account Lockout threshold
# secedit /export /cfg secpol.txt
# Check: LockoutBadCount = 5 (not 0)

ベースライン構成管理

# Ansible hardening playbook snippet
- name: Disable ICMP redirects
  sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: '0'
    state: present
    reload: yes

- name: Enable address space layout randomization
  sysctl:
    name: kernel.randomize_va_space
    value: '2'
    state: present
    reload: yes

監査ログと監視

# Enable Windows audit policy (Group Policy)
auditpol /set /category:'Logon/Logoff' /success:enable /failure:enable
auditpol /set /category:'Process Creation' /success:enable
auditpol /set /subcategory:'Privilege Use' /success:enable /failure:enable

# Linux: configure auditd for privilege use
echo '-a always,exit -F arch=b64 -S execve -k exec_track' >> /etc/audit/rules.d/audit.rules
echo '-w /etc/sudoers -p wa -k priv_change' >> /etc/audit/rules.d/audit.rules
augenrules --load

自動コンプライアンススキャン

# OpenSCAP compliance scan (RHEL/CentOS)
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# Generate remediation script
oscap xccdf generate fix \
  --fix-type bash \
  --result-id '' \
  results.xml > remediation.sh

グループポリシーとセキュリティテンプレート

# Apply security template via secedit
secedit /configure /db %windir%\security\local.sdb \
  /cfg C:\Templates\CIS_Level1_Server2022.inf \
  /log secedit_apply.log

# Analyze current config vs template
secedit /analyze /db %windir%\security\local.sdb \
  /cfg C:\Templates\CIS_Level1_Server2022.inf \
  /log secedit_analysis.log

# View result: settings marked as compliant or non-compliant

クイックチェック

レッスンのまとめ