Security Policy

Supported Versions

Our support policy is defined by the project’s release stage: for major releases (x.y.z), we support the current and previous minor versions (x and x-1), excluding forks. For beta or initial development projects (0.x.y), we support only the current minor version (x). For experimental projects (0.0.x), support is strictly limited to the latest patch.

Reporting a Vulnerability

Please do not report a vulnerability via Github issues. Any vulnerability shall be reported by emailing to security@apich.org or via our official website security reporting section (under construction).

We commit to addressing all responsibly disclosed vulnerabilities within 7 days of receipt.

Developer Security Standards (Mandatory for Organization Members and Recommended for Contributors)

I. Authorized Operating Environment

Mandatory OS: Fedora KDE Plasma Desktop
Mandatory IDE: GNU Emacs or Zed
Disk Encryption: LUKS (Linux Unified Key Setup) must be enabled by default during installation.
Mandatory Authentication: Enforce FIDO2-based two-factor authentication (2FA) via biometric fingerprint or PIN/password, and strictly disable direct root logins and root SSH access.

II. Mandatory Security Suite

To ensure system integrity and real-time threat detection, the following tools must be installed and configured:

Endpoint Monitoring: Wazuh-agent and ESET Endpoint Security
Hardening & Auditing: SELinux (set to Enforcing and MLS mode), firewalld, Lynis
Threat Scanning: ClamAV, rkhunter, chkrootkit
System Integrity: AIDE (Advanced Intrusion Detection Environment), unhide
Network Scanning: Daily Nmap scan of the local network (e.g., 192.168.1.0/24)
Security Server Per Team: Wazuh-server (includes Wazuh-dashboard, Wazuh-manager and Wazuh-indexer), Greenbone Community Edition

III. Identity & Access Management

2FA Requirement: Hardware-based authentication via YubiKey 5 FIPS Series (FIPS 140-3) is mandatory for all organizational accounts and SSH access.

Appendix

# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf(5) and sysctl.d(5).

# ==============================================================================
# Linux Kernel Security Hardening Baseline
# ==============================================================================

# --- A. Kernel Self-Protection & Exploit Mitigation ---
# Enforce strict ASLR, prevent kernel pointer leakage via /proc/kallsyms,
# restrict dmesg to CAP_SYSLOG, disable magic SysRq, and restrict perf/kexec.
kernel.randomize_va_space = 2
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.sysrq = 0
kernel.perf_event_paranoid = 3
kernel.kexec_load_disabled = 1

# --- B. Process Trace & Execution Restrictions (Yama / BPF) ---
# Lock ptrace entirely against all callers, enforce BPF JIT blinding,
# lock BPF syscall from unprivileged users, and prevent TTY hijacking via TIOCSTI.
kernel.yama.ptrace_scope = 3
kernel.unprivileged_bpf_disabled = 1
net.core.bpf_jit_harden = 2
dev.tty.legacy_tiocsti = 0

# --- C. Namespace & Container Boundary Hardening ---
# Completely disable unprivileged user namespaces to block local privilege escalations.
kernel.unprivileged_userns_clone = 0
user.max_user_namespaces = 0

# --- D. Filesystem & Memory Dump Restrictions ---
# Block symlink/hardlink race conditions, prevent malicious writes into FIFO/regular
# files in world-writable stickied dirs, and completely suppress suid core dumps.
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2
fs.suid_dumpable = 0

# --- E. Memory Management Tuning ---
# Strict overcommit control to avoid memory exhaustion attacks and expand VMA mapping.
vm.overcommit_memory = 2
vm.overcommit_ratio = 50
vm.max_map_count = 262144

# --- F. IPv4 Network Hardening (Strict Source Routing & Anti-Spoofing) ---
# Enforce strict reverse path filtering, drop/log martians, disable ICMP redirects,
# and drop source routing.
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.all.bootp_relay = 0

# --- G. IPv4 DoS & Flood Mitigation ---
# Enforce SYN cookies, drop ICMP echo/broadcast requests, and ignore bogus errors.
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.icmp_echo_ignore_all = 1
net.core.somaxconn = 4096
net.core.netdev_max_backlog = 5000

# --- H. IPv6 Protocol Hardening & Neutralization ---
# If IPv6 is unused, fully disable stack across all interfaces to eliminate attack surface.
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

0 2 * * * /usr/bin/freshclam --quiet
5 2 * * * /usr/bin/flock -n /tmp/clamscan.lock /usr/bin/nice -n 19 /usr/bin/ionice -c 3 /usr/bin/clamdscan --multiscan --fdpass --quiet / >> /var/log/clamav-scan-$(date +\%Y\%m\%d).log
10 2 * * * /usr/sbin/chkrootkit >> /var/log/chkrootkit-scan-$(date +\%Y\%m\%d).log
15 2 * * * /usr/bin/aide --check
0 3 1 * * /usr/bin/logger "REMINDER: Run 'aide --update' after a system upgrade to maintain database integrity."
20 2 * * * /usr/sbin/unhide proc tcp udp sys >> /var/log/unhide-scan-$(date +\%Y\%m\%d).log 2>&1
40 2 * * * /usr/bin/lynis --cronjob --quiet >> /var/log/lynis-report-$(date +\%Y\%m\%d).log
50 2 * * * /usr/bin/rkhunter --cronjob --rwo >> /var/log/rkhunter-scan-$(date +\%Y\%m\%d).log
0 4 * * * /usr/local/bin/daily_nmap_scan.sh >/dev/null 2>&1

#!/bin/bash

# Define variables
TIMESTAMP=$(date +"%Y-%m-%d")
SCAN_DIR="/var/log/nmap_scans"
TARGET_SPEC="192.168.1.0/24"

# Create the log directory if it doesn't exist
mkdir -p $SCAN_DIR

# Run the Nmap scan
/usr/bin/nmap -A -T4 $TARGET_SPEC -oN $SCAN_DIR/nmap_scan_$TIMESTAMP.txt

Name		Name	Last commit message	Last commit date
.gitignore		.gitignore
CNAME		CNAME
LICENSE		LICENSE
README.md		README.md
index.html		index.html

Navigation Menu

Uh oh!

Repository files navigation

Security Policy

Supported Versions

Reporting a Vulnerability

Developer Security Standards (Mandatory for Organization Members and Recommended for Contributors)

I. Authorized Operating Environment

II. Mandatory Security Suite

III. Identity & Access Management

Appendix

About

Releases

Packages

Used by

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Security Policy

Supported Versions

Reporting a Vulnerability

Developer Security Standards (Mandatory for Organization Members and Recommended for Contributors)

I. Authorized Operating Environment

II. Mandatory Security Suite

III. Identity & Access Management

Appendix

About

Resources

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages