Systems Administration | Florian Stosse

chainguard-images

Sat, 25 May 2024 00:00:00 +0000

chainguard-images is a curated collection of secure, minimal, and production-ready container images built on top of Chainguard’s distroless base images (Wolfi/Apko). By stripping out unnecessary tools, shells, package managers, and libraries, these images achieve an extremely small footprint and approach a Zero-CVE status by design.

This collection packages various applications and language runtimes, ensuring secure-by-default execution in modern container orchestration stacks.

Security Benefits of Distroless

Minimizing Attack Surface: Removing standard shell binaries (/bin/sh, /bin/bash) and diagnostic tools prevents attackers from executing arbitrary commands upon compromise.
Vulnerability reduction: Eliminating unused packages results in container images that trigger fewer CVE alerts in security scanners.
Secure Ingestion: Optimized for high-assurance and air-gapped container registries that require signed, low-overhead artifacts.
Reproducible Builds: Compiled using secure and verifiable declarative build files.

openstreetmap-tile-server

Thu, 23 May 2024 00:00:00 +0000

openstreetmap-tile-server is a deployment configuration and guide for hosting a local, offline OpenStreetMap (OSM) tile server. Designed specifically for high-security, air-gapped, or isolated network environments, it enables applications to render mapping data without requesting external web resources.

This stack leverages Docker to simplify deployment, package ingestion, and render pipeline orchestration.

Stack Components

Database: PostgreSQL with PostGIS extensions to manage geographical data.
Ingestion: Osm2pgsql for importing and styling .osm.pbf map files.
Renderer: Mapnik and renderd for rendering vector map data into raster tiles.
Tile Server: Apache with mod_tile to serve pre-rendered or on-the-fly map tiles.
Front-End Integration: Simple Leaflet-based templates for verifying local tile rendering.

Usage Outline

Pre-render tiles or import specific geographical datasets (e.g., country extracts from Geofabrik) to serve them locally within your network. Useful for command-and-control centers, localized flight-tracking platforms, and telemetry dashboards operating in secure perimeters.

exploit-protection-policy

Wed, 22 May 2024 00:00:00 +0000

Exploit-Protection-policy provides a production-hardened Exploit Protection (EP) policy tailored for Windows 10 and Windows 11 systems. It combines multiple industry-standard security baselines with advanced restrictions to maximize security without breaking compatibility with everyday applications.

This policy has been tested in air-gapped systems to protect endpoints from advanced threat vectors while maintaining productivity.

Merged Security Baselines

DISA STIG Exploit Protection v3.
Microsoft Security Baseline Exploit Protection policy (specifically aligned for enterprise systems).
milgradesec’s custom Exploit Protection rule configurations.

Key Protections Enforced

System-Wide Mitigations: Enforces fundamental protections such as Control Flow Guard (CFG), Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Heap Protection by default.
Advanced Payload Controls: Restricts execution vectors using Export Address Filtering (EAF/EAF+), Import Address Filtering (IAF), and Return-Oriented Programming (ROP) mitigations.
Image & Code Integrity Restrictions: Blocks loading of low-integrity or remote images, preventing malicious library injection.
Application-Specific Tuning: Includes pre-configured exceptions and application rules to balance high-security containment with software compatibility.

Security-ADMX

Sun, 19 May 2024 00:00:00 +0000

Security-ADMX is a collection of custom Administrative Templates (.admx and .adml) specifically designed for hardening Windows 10 and Windows 11 workstations. It allows system administrators and security engineers to configure advanced security settings via local or domain Group Policy (GPO) that are otherwise difficult or tedious to manage.

Developed out of the need to streamline security compliance across embedded and workstation deployments, this project packages several security controls into easily manageable policies.