From 6a4fd0b63aa522cb389f09f084dc089a9c5ba4fd Mon Sep 17 00:00:00 2001 From: neohiro <140953308+neohiro@users.noreply.github.com> Date: Sat, 10 Oct 2026 08:51:37 +0200 Subject: [PATCH] docs+ui: disambiguate the two attack-surface controls OptimizeLinuxASR.sh and the built-in attack_surface step were both presented as 'Attack Surface Reduction', which reads as duplicated functionality. They are not: the script stops/masks daemons and writes no config; the step writes kernel/config hardening and stops no service. - Renamed UI surfaces to 'ASR: disable unneeded services' and 'ASR: kernel + config hardening', and the stale 'network/disk tweaks' preview now says what the script actually does. - Main menu option 9 now points at the built-in step for kernel/config hardening, so the two paths are discoverable from one screen. - README documents the split in a table and records the squashfs/snap ordering interaction: disabling snapd first means a later attack_surface run blacklists squashfs, which breaks live media and squashfs images. --- README.md | 23 +++++++++++++++++++++-- linuxinstall.sh | 21 +++++++++++---------- 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 2a2c99c..c8a84a0 100644 --- a/README.md +++ b/README.md @@ -787,8 +787,20 @@ Notes: ### Attack surface reduction (built-in) -The `attack_surface` step (`--step attack_surface`) applies, all backed up and -logged to the rollback log first: +There are **two** attack-surface controls, and they do not overlap: + +| Part | Entry point | Mechanism | Writes config? | +|---|---|---|---| +| **Services** | `OptimizeLinuxASR.sh` (profile 9, maintenance, `run_remote_script`) | `systemctl stop/disable/mask` per daemon | No | +| **Kernel + config** | `attack_surface` step (`--step attack_surface`) | writes sysctl/modprobe/sshd/login/limits files | Yes | + +`OptimizeLinuxASR.sh` removes *running software* (rpcbind, samba, ftp, telnet, +snapd, …) and touches no configuration file. The `attack_surface` step +hardens the *kernel and configuration surface* and touches no service. Run +both for full coverage; neither substitutes for the other. + +The `attack_surface` step applies, all backed up and logged to the rollback log +first: - **Filesystem blacklist** — `cramfs`, `freevxfs`, `jffs2`, `hfs`, `hfsplus`, `udf`, plus `squashfs` when no snap runtime is present. Written to @@ -803,6 +815,13 @@ logged to the rollback log first: - **Core dumps** — `* hard core 0` and `* soft core 0` in `/etc/security/limits.conf`. +> **Ordering note:** the `squashfs` carve-out keys off a snap runtime being +> present. If you disable `snapd` via `OptimizeLinuxASR.sh` first, a later +> `attack_surface` run will blacklist `squashfs`. That is intended (no snap, no +> need for squashfs) but breaks live media and some container storage — review +> `/etc/modprobe.d/blacklist-filesystems.conf` if you boot ISOs or use squashfs +> images. + ### Mandatory Access Control: AppArmor vs SELinux | Family | MAC system | Status | Script action | diff --git a/linuxinstall.sh b/linuxinstall.sh index e4f0025..18f2a78 100755 --- a/linuxinstall.sh +++ b/linuxinstall.sh @@ -1531,9 +1531,9 @@ CHECKLIST_LABEL_ipv6="Disable IPv6" CHECKLIST_LABEL_sysctl="Kernel/sysctl hardening" CHECKLIST_LABEL_apparmor="AppArmor" CHECKLIST_LABEL_pam="Password & lockout policy" -CHECKLIST_LABEL_attack_surface="Attack surface reduction (built-in)" -CHECKLIST_LABEL_optimize="OptimizeLinuxASR.sh (ASR)" -CHECKLIST_LABEL_optimize_asr="OptimizeLinuxASR.sh (ASR)" +CHECKLIST_LABEL_attack_surface="ASR: kernel + config hardening" +CHECKLIST_LABEL_optimize="ASR: disable unneeded services" +CHECKLIST_LABEL_optimize_asr="ASR: disable unneeded services" CHECKLIST_LABEL_deepclean="DeepClean.sh (cleanup)" CHECKLIST_LABEL_other_scripts="Other helpers (Shadowsocks / server extras)" CHECKLIST_LABEL_summary="Print run summary" @@ -1609,9 +1609,9 @@ _STEP_PREVIEWS["ipv6"]="disable IPv6 system-wide (kernel + sysctl). Warned: may _STEP_PREVIEWS["sysctl"]="apply hardened kernel/network sysctls (no IPv4 icmp-echo-block on deny)." _STEP_PREVIEWS["apparmor"]="enable AppArmor; enforce default profiles." _STEP_PREVIEWS["pam"]="tighten pam_faillock: 5 retries / 15 min lockout." -_STEP_PREVIEWS["attack_surface"]="filesystem blacklist, SSH crypto hardening, login.defs aging, core dumps disabled." -_STEP_PREVIEWS["optimize"]="run OptimizeLinuxASR.sh (network/disk tweaks). Reversible." -_STEP_PREVIEWS["optimize_asr"]="run OptimizeLinuxASR.sh (network/disk tweaks). Reversible." +_STEP_PREVIEWS["attack_surface"]="filesystem blacklist, SSH crypto, login.defs aging, core dumps disabled." +_STEP_PREVIEWS["optimize"]="stop/mask unneeded daemons via OptimizeLinuxASR.sh (interactive)." +_STEP_PREVIEWS["optimize_asr"]="stop/mask unneeded daemons via OptimizeLinuxASR.sh (interactive)." _STEP_PREVIEWS["deepclean"]="run DeepClean.sh (apt cache, journal, old kernels). Safe but uses disk." _CHECKLIST_ORDER="tmux_wrap env_detect apt_https system_update dnscrypt firewall tor ssh_hardening fail2ban unattended ipv6 sysctl apparmor pam attack_surface optimize_asr deepclean other_scripts summary" @@ -1882,8 +1882,9 @@ ask_profile() { printf ' %s %s\n' "$(_c '1;32m' '8) DeepClean')" "$(_c '1;37m' 'Run DeepClean.sh: journal, logs, apt/dnf/pacman cache,')" printf ' %s %s\n' "" "$(_c '1;30m' 'snap/dock/flatpak cleanup, systemd coredump, logrotate.')" printf '\n' - printf ' %s %s\n' "$(_c '1;32m' '9) Attack Surface Reduction')" "$(_c '1;37m' 'Run OptimizeLinuxASR.sh: disable unused services interactively.')" - printf ' %s %s\n' "" "$(_c '1;30m' 'Categories: hardware, networking, legacy protocols, etc.')" + printf ' %s %s\n' "$(_c '1;32m' '9) Attack Surface Reduction (services)')" "$(_c '1;37m' 'Run OptimizeLinuxASR.sh: disable unused services interactively.')" + printf ' %s %s\n' "" "$(_c '1;30m' 'Stops/masks daemons only. Kernel + config hardening is the')" + printf ' %s %s\n' "" "$(_c '1;30m' 'built-in attack_surface step (--step attack_surface).')" printf '\n' printf ' %s %s\n' "$(_c '1;32m' '10) Updates only')" "$(_c '1;37m' 'System update + kernel prune. Install (do not enable)')" printf ' %s %s\n' "" "$(_c '1;30m' 'tor / fail2ban / shadowsocks / dnscrypt. Auto-update opt-in.')" @@ -2185,7 +2186,7 @@ maintenance_menu() { "Kernel/sysctl hardening" \ "AppArmor" \ "Password & lockout policy" \ - "OptimizeLinuxASR (attack-surface reduction)" \ + "OptimizeLinuxASR (attack-surface reduction: disable services)" \ "DeepClean (cleanup + auto-prune)" \ "SSH diagnostics & lockout fix (restore_ssh_mode)" \ "Authorized keys (list + inspect)" \ @@ -4762,7 +4763,7 @@ USAGE _run_step sysctl "Kernel/sysctl hardening profile" "" harden_sysctl n _run_step apparmor "AppArmor" "" setup_apparmor n _run_step pam "Password & lockout policy" "" harden_passwords n - _run_step attack_surface "Attack surface reduction (built-in)" "" harden_attack_surface n + _run_step attack_surface "ASR: kernel + config hardening" "" harden_attack_surface n _run_step deepclean "Run DeepClean.sh (new helper)" "" run_deepclean n if [ "$USE_REMOTE_SSH" = "yes" ]; then