Re-re-enabled harden.sh. Tweaked it some. Could probably use some mor…

…e hardness.
nfugal · Sep 29, 2021 · 5415af7 · 5415af7
1 parent 36051ac
commit 5415af7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -10,7 +10,7 @@ RUN rm /etc/ssh/sshd_config
 
 RUN chmod a+r /etc/ssh/ssh_*
 
-RUN adduser -D dev && passwd -d dev && mkdir /home/dev/.ssh && chown dev:nogroup /home/dev/.ssh && chmod 700 /home/dev/.ssh
+RUN adduser --shell /bin/busybox -D dev && passwd -d dev && mkdir /home/dev/.ssh && chown dev:nogroup /home/dev/.ssh && chmod 700 /home/dev/.ssh
 
 VOLUME /home/dev/.ssh
 

diff --git a/harden.sh b/harden.sh
@@ -78,12 +78,14 @@ rm -fr /root
 # Remove fstab since we do not need it.
 rm -f /etc/fstab
 
+# Remove terminfo(s)
+rm -rf /etc/terminfo/[a-y]*
+
 # Remove broken symlinks (because we removed the targets above).
 find $sysdirs -xdev -type l -exec test ! -e {} \; -delete
 
 # Remove all but a handful of admin commands.
 find /usr/bin /bin ! -type d \
-  -a ! -name sh \
-  -a ! -name ssh \
-  -a ! -name busybox \
+  -a ! -wholename "/usr/bin/ssh" \
+  -a ! -wholename "/bin/busybox" \
   -delete