# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/F-noldap,v 1.6 2025/03/21 15:19:26 mas90 Exp $
# No LDAP (so no nsswich etc), but may be a (e.g. DMZ) Managed Lab Machine (generic etc should be in F-alien)
@F-alien
P-rwho-nosuchuser
P-firefox-jdk
# "really" replacement: target (i.e. root) PW used
# use sudoers.d/ P-sudoers-targetpw
# make sudo pass through XAUTHORITY so that xsudo can work
# use sudoers.d/ P-sudoers-env_keep_XAUTHORITY
# Allow anyone to run cl-ascondor
# use sudoers.d/ P-sudoers-cl-ascondor
# DIS-Allow host based ssh access using /etc/ssh/ files only
P-sshd_config-allow-hostbased
P-sshd_config-allow-hostbased-ubuntu
P-sshd_config-allow-hostbased-U18
# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html - RT#94078
P-sshd_config-Kex-Ciphers-MACs
P-sshd_config-Kex-Ciphers-MACs-undo_U12
P-sshd_config-ServerKeyBits-4096
# Block access to members of group nossh
P-sshd_config-DenyGroups-nossh
# Use en_GB.UTF-8
P-i18n-en_GB.UTF-8
# Block repeated ssh calss (3 / 80s) from outside 128.232.0.0/17
P-iptables-recent-ssh
P-iptables-recent-ssh-F9
P-iptables-recent-ssh-COS6
# NO IPv6 RECENT MODULE YET - P-ip6tables-recent-ssh
# Disable incoming IPv6 IPSEC
P-ip6tables-disable-IPSEC
P-ip6tables-disable-IPSEC-F8
# Disable incoming IPv6 mdns
P-ip6tables-disable-mdns
# Fix suspected typo which allowed *src* port of 22
P-ip6tables-block-src-22
# Fix suspected typo which did not allow ESTABLISHED connections
P-ip6tables-allow-ESTABLISHED
# Disable incoming IPv6 CUPS by default (re-enabled on CUPS servers)
P-ip6tables-disable-CUPS
# Do not by default allow ports 32768-61000
P-ip6tables-dont-allow-32768-61000
P-ip6tables-dont-allow-32768-61000-syn
P-ip6tables-dont-allow-32768-61000+syn
# Avoid livna / freshrpm clash over faad2
# make /usr/sbin/xe-update-guest-attrs report free+cached memory
P-xe-uga-cache
P-yum-freshrpm-faad2
P-grub.d-10_linux-eth0
P-init-failsafe.conf-faster  
# RT#123559 One-off patch for duff localadmin PW 2022-04-08 - can be removed once done
P-etc_shadow-fix-localadmin-2022
P-etc_shadow-fix-localadmin-2022-DUFF
