Harden and watch hosts and clusters

falco watches system calls with eBPF and alerts on suspicious behavior: a shell in a container, reading /etc/shadow, writes below /etc, unexpected network connections. Part of the CKS exam.

$helm install falco falcosecurity/falco -n falco --create-namespace --set driver.kind=modern_ebpf
$kubectl -n falco logs -l app.kubernetes.io/name=falco -f
#falco -V /etc/falco/rules.d/shop.yaml

kube-bench checks API server flags, kubelet settings, etcd and file permissions against the CIS Kubernetes Benchmark, with fix texts.

$kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
#kube-bench run --targets master,node | grep "^\[FAIL\]"

nmap finds hosts, open ports, services and TLS settings — to check that only expected ports are reachable.

$sudo nmap -sS -sV --open 192.168.122.11
$nmap --script ssl-enum-ciphers -p 443 shop.example.com
$ndiff before.xml after.xml

fail2ban-client manages jails that read logs and ban IPs with too many failed logins (SSH, web logins, mail).

#fail2ban-client status sshd
#fail2ban-client set sshd unbanip 203.0.113.25

lynis runs hundreds of local checks and gives a hardening index and concrete suggestions.

#lynis audit system --quick
#grep hardening_index /var/log/lynis-report.dat

oscap checks RHEL hosts and images against CIS, STIG or PCI-DSS profiles and generates Bash or Ansible fixes — evidence for auditors.

#oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
#oscap xccdf generate fix --fix-type ansible --profile xccdf_org.ssgproject.content_profile_cis_server_l1 --output cis-fix.yml /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

aide keeps a baseline of file hashes and permissions and reports every added, removed or changed file.

#aide --init && mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
#aide --check

auditctl adds kernel audit rules (watch /etc/passwd, /etc/sudoers, log user commands); ausearch and aureport read them.

#auditctl -w /etc/sudoers -p wa -k sudoers
#augenrules --load
#ausearch -k sudoers -i --start today

No single tool is enough. Use layers: