add hardening profile
This commit is contained in:
ChaotiCryptidz
parent
2600a9e55d
commit
48ebc0bcab
|
|
@ -5,6 +5,7 @@
|
||||||
users.root
|
users.root
|
||||||
users.chaoticryptidz
|
users.chaoticryptidz
|
||||||
|
|
||||||
|
profiles.hardening
|
||||||
profiles.tailscale
|
profiles.tailscale
|
||||||
profiles.gui
|
profiles.gui
|
||||||
profiles.laptop
|
profiles.laptop
|
||||||
|
|
@ -20,8 +21,6 @@
|
||||||
profiles.sshd
|
profiles.sshd
|
||||||
];
|
];
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
|
||||||
|
|
||||||
home-manager.users.root = { imports = with tree; [ home.base ]; };
|
home-manager.users.root = { imports = with tree; [ home.base ]; };
|
||||||
home-manager.users.chaoticryptidz = {
|
home-manager.users.chaoticryptidz = {
|
||||||
imports = with tree; [
|
imports = with tree; [
|
||||||
|
|
@ -42,6 +41,10 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
networking.firewall.enable = true;
|
||||||
|
# let vscode, vivaldi, etc work.
|
||||||
|
security.unprivilegedUsernsClone = true;
|
||||||
|
|
||||||
networking.hostName = "lappy";
|
networking.hostName = "lappy";
|
||||||
time.timeZone = "Europe/London";
|
time.timeZone = "Europe/London";
|
||||||
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
|
||||||
|
|
|
||||||
|
|
@ -3,6 +3,5 @@
|
||||||
hardware.enableAllFirmware = true;
|
hardware.enableAllFirmware = true;
|
||||||
hardware.cpu.intel.updateMicrocode = true;
|
hardware.cpu.intel.updateMicrocode = true;
|
||||||
hardware.cpu.amd.updateMicrocode = true;
|
hardware.cpu.amd.updateMicrocode = true;
|
||||||
hardware.ksm.enable = true;
|
|
||||||
hardware.wirelessRegulatoryDatabase = true;
|
hardware.wirelessRegulatoryDatabase = true;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
100
profiles/hardening/hardening.nix
Normal file
100
profiles/hardening/hardening.nix
Normal file
|
|
@ -0,0 +1,100 @@
|
||||||
|
{ config, pkgs, lib, ... }: {
|
||||||
|
# modified from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
|
||||||
|
# but with some stuff not turned on
|
||||||
|
|
||||||
|
boot.kernelPackages = pkgs.linuxPackages_hardened;
|
||||||
|
|
||||||
|
environment.memoryAllocator.provider = "scudo";
|
||||||
|
environment.variables.SCUDO_OPTIONS = "ZeroContents=1";
|
||||||
|
|
||||||
|
# TODO: this breaks NetworkManager
|
||||||
|
# security.lockKernelModules = true;
|
||||||
|
|
||||||
|
security.protectKernelImage = true;
|
||||||
|
|
||||||
|
security.forcePageTableIsolation = true;
|
||||||
|
|
||||||
|
# This is required by podman to run containers in rootless mode.
|
||||||
|
security.unprivilegedUsernsClone = lib.mkDefault config.virtualisation.containers.enable;
|
||||||
|
|
||||||
|
security.virtualisation.flushL1DataCache = "always";
|
||||||
|
|
||||||
|
boot.kernelParams = [
|
||||||
|
# Slab/slub sanity checks, redzoning, and poisoning
|
||||||
|
"slub_debug=FZP"
|
||||||
|
|
||||||
|
# Overwrite free'd memory
|
||||||
|
"page_poison=1"
|
||||||
|
|
||||||
|
# Enable page allocator randomization
|
||||||
|
"page_alloc.shuffle=1"
|
||||||
|
|
||||||
|
# Disable slab merging
|
||||||
|
"slab_nomerge"
|
||||||
|
|
||||||
|
# Zero memory on alloc and init
|
||||||
|
# Scudo should do this but make kernel do it as well
|
||||||
|
"init_on_alloc=1"
|
||||||
|
"init_on_free=1"
|
||||||
|
|
||||||
|
# Make page allocations less predictable
|
||||||
|
"page_alloc.shuffle=1"
|
||||||
|
|
||||||
|
# Turn on page table isolation
|
||||||
|
"pti=on"
|
||||||
|
|
||||||
|
# Disable vsyscalls
|
||||||
|
"vsyscall=none"
|
||||||
|
|
||||||
|
# Disable debugfs
|
||||||
|
"debugfs=off"
|
||||||
|
];
|
||||||
|
|
||||||
|
boot.kernel.sysctl = {
|
||||||
|
# Restrict ptrace() usage to processes with a pre-defined relationship
|
||||||
|
# (e.g., parent/child)
|
||||||
|
"kernel.yama.ptrace_scope" = 1;
|
||||||
|
|
||||||
|
# Hide kptrs even for processes with CAP_SYSLOG
|
||||||
|
"kernel.kptr_restrict" = 2;
|
||||||
|
|
||||||
|
# Disable bpf() JIT (to eliminate spray attacks)
|
||||||
|
"net.core.bpf_jit_enable" = false;
|
||||||
|
|
||||||
|
# Disable unprivileged bpf
|
||||||
|
"kernel.unprivileged_bpf_disabled" = 1;
|
||||||
|
|
||||||
|
# Disable ftrace debugging
|
||||||
|
"kernel.ftrace_enabled" = false;
|
||||||
|
|
||||||
|
# Disable kexec
|
||||||
|
"kernel.kexec_load_disabled" = 1;
|
||||||
|
|
||||||
|
# Disable sysrq
|
||||||
|
"kernel.sysrq" = 0;
|
||||||
|
|
||||||
|
# Enable strict reverse path filtering (that is, do not attempt to route
|
||||||
|
# packets that "obviously" do not belong to the iface's network; dropped
|
||||||
|
# packets are logged as martians).
|
||||||
|
"net.ipv4.conf.all.log_martians" = true;
|
||||||
|
"net.ipv4.conf.all.rp_filter" = "1";
|
||||||
|
"net.ipv4.conf.default.log_martians" = true;
|
||||||
|
"net.ipv4.conf.default.rp_filter" = "1";
|
||||||
|
|
||||||
|
# Ignore broadcast ICMP (mitigate SMURF)
|
||||||
|
"net.ipv4.icmp_echo_ignore_broadcasts" = true;
|
||||||
|
|
||||||
|
# Ignore incoming ICMP redirects (note: default is needed to ensure that the
|
||||||
|
# setting is applied to interfaces added after the sysctls are set)
|
||||||
|
"net.ipv4.conf.all.accept_redirects" = false;
|
||||||
|
"net.ipv4.conf.all.secure_redirects" = false;
|
||||||
|
"net.ipv4.conf.default.accept_redirects" = false;
|
||||||
|
"net.ipv4.conf.default.secure_redirects" = false;
|
||||||
|
"net.ipv6.conf.all.accept_redirects" = false;
|
||||||
|
"net.ipv6.conf.default.accept_redirects" = false;
|
||||||
|
|
||||||
|
# Ignore outgoing ICMP redirects (this is ipv4 only)
|
||||||
|
"net.ipv4.conf.all.send_redirects" = false;
|
||||||
|
"net.ipv4.conf.default.send_redirects" = false;
|
||||||
|
};
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue