<commit_before># Readme

Performs basic hardening on an Ubuntu host. Tested on 14.04 trusty.

Make sure you have a non-root account provisioned on your server with an authorised ssh key.

## Installing a masterless Minion

The bash script run_salt.sh will add the salt repo to your sources, configure a basic masterless salt-minion and then clone this repo creating the 'base' set of states. Finally it will run salt-minion locally. 

NOTE: It is never a good idea to execute a script on your box without reviewing it first (including all of the states). I would also recommend validating that you're happy with the repo.saltstack.com gpg key.
<commit_msg>updating readme<commit_after># README

Performs basic hardening on an Ubuntu host. Tested on 14.04 trusty.

Make sure you have a non-root / non-ubuntu account provisioned on your server with an authorized key.

## Quickstart

The bash script run_salt.sh will add the salt repo to your sources, configure a masterless salt-minion and clone this repo creating the base environment. Finally it will run salt-minion locally applying the set of states. 

NOTE: It is never a good idea to execute a script on your box without reviewing it first (including all of the states). I would also recommend validating that you're happy with the repo.saltstack.com gpg key.

## Documentation

Hardening is the process of changing the default configuration that an OS ships with to put it in a more secure state. It is focused on closing holes and reducing your attack surface. This repo is a set of Salt states that will harden an Ubuntu server.

It has 2 assumptions:

1. You have already deployed a user account other than root (or the default Ubuntu account that ships with AWS instances).
2. You will update your system and continue to patch it periodically.

### Hardening States

1. ssh

2. iptables

3. purgepackages

4. ubuntuuser

5. sysctl

6. sudo


### Extra States

A few extra states have been included which are not strictly. Classified as hardening.

1. fail2ban

2. ntpd

3. timezone

{'fraction_non_alphanumeric': 0.04064642507345739, 'fraction_numerical': 0.01028403525954946, 'mean_word_length': 3.9829268292682927, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7331837', 'n_tokens_mistral': 572, 'n_tokens_neox': 528, 'n_words': 326}