From 5c29620deea7d0af7623a9c32b0655550716334d Mon Sep 17 00:00:00 2001 From: Henrik Lissner Date: Sat, 20 Feb 2021 22:50:43 -0500 Subject: [PATCH] Harden & optimize networking settings --- default.nix | 13 ++++++----- hosts/ao/default.nix | 1 + hosts/linode.nix | 1 + hosts/personal.nix | 7 +++++- hosts/server.nix | 20 ++++++++++++++++ modules/security.nix | 54 ++++++++++++++++++++++++++++++++++++++++---- 6 files changed, 84 insertions(+), 12 deletions(-) create mode 100644 hosts/server.nix diff --git a/default.nix b/default.nix index 6f08c096..3569eff2 100644 --- a/default.nix +++ b/default.nix @@ -45,12 +45,13 @@ with lib.my; fileSystems."/".device = mkDefault "/dev/disk/by-label/nixos"; # Use the latest kernel - boot.kernelPackages = mkDefault pkgs.linuxPackages_5_10; - - boot.loader = { - efi.canTouchEfiVariables = mkDefault true; - systemd-boot.configurationLimit = 10; - systemd-boot.enable = mkDefault true; + boot = { + kernelPackages = mkDefault pkgs.linuxPackages_5_10; + loader = { + efi.canTouchEfiVariables = mkDefault true; + systemd-boot.configurationLimit = 10; + systemd-boot.enable = mkDefault true; + }; }; # Just the bear necessities... diff --git a/hosts/ao/default.nix b/hosts/ao/default.nix index b26f13ad..54ee1759 100644 --- a/hosts/ao/default.nix +++ b/hosts/ao/default.nix @@ -5,6 +5,7 @@ with lib.my; { imports = [ + ../server.nix ../personal.nix ./hardware-configuration.nix diff --git a/hosts/linode.nix b/hosts/linode.nix index 93c6d0dc..6f517dc6 100644 --- a/hosts/linode.nix +++ b/hosts/linode.nix @@ -53,6 +53,7 @@ with lib; { imports = [ "${modulesPath}/profiles/qemu-guest.nix" + ./server.nix ]; environment.systemPackages = diff --git a/hosts/personal.nix b/hosts/personal.nix index 75fda916..cb959bfe 100644 --- a/hosts/personal.nix +++ b/hosts/personal.nix @@ -26,7 +26,12 @@ with lib; longitude = 12.5; } else {}); - ## + + # Refuse ICMP echo requests on my desktop/laptop; nobody has any business + # pinging them, unlike my servers. + boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1; + + # So thw bitwarden CLI knows where to find my server. modules.shell.bitwarden.config.server = "p.v0.io"; services.syncthing.declarative = { diff --git a/hosts/server.nix b/hosts/server.nix new file mode 100644 index 00000000..fcdd0dba --- /dev/null +++ b/hosts/server.nix @@ -0,0 +1,20 @@ +{ config, lib, pkgs, ... }: + +{ + boot.kernelPackages = pkgs.linuxPackages_latest_hardened; + + systemd = { + services.clear-log = { + description = "Clear >1 month-old logs every week"; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.systemd}/bin/journalctl --vacuum-time=30d"; + }; + }; + timers.clear-log = { + wantedBy = [ "timers.target" ]; + partOf = [ "clear-log.service" ]; + timerConfig.OnCalendar = "weekly UTC"; + }; + }; +} diff --git a/modules/security.nix b/modules/security.nix index 90384df1..07e95d1e 100644 --- a/modules/security.nix +++ b/modules/security.nix @@ -1,7 +1,12 @@ -{ lib, config, ... }: +{ config, lib, ... }: { ## System security tweaks + # sets hidepid=2 on /proc (make process info visible only to owning user) + security.hideProcessInformation = true; + # Prevent replacing the running kernel w/o reboot + security.protectKernelImage = true; + # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy # on ssd systems, and volatile! Because it's wiped on reboot. boot.tmpOnTmpfs = lib.mkDefault true; @@ -9,20 +14,59 @@ what = "tmpfs"; where = "/tmp"; type = "tmpfs"; - # Added noexec (for added security), and reduced size from 50% to 25% + # Added noexec (for added security) and reduce size from 50% to 25% options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; }]; # If not using tmpfs, which is naturally purged on reboot, we must clean it # /tmp ourselves. /tmp should be volatile storage! boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); - security.hideProcessInformation = true; - security.protectKernelImage = true; - # Fix a security hole in place for backwards compatibility. See desc in # nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix boot.loader.systemd-boot.editor = false; + boot.kernel.sysctl = { + # The Magic SysRq key is a key combo that allows users connected to the + # system console of a Linux kernel to perform some low-level commands. + # Disable it, since we don't need it, and is a potential security concern. + "kernel.sysrq" = 0; + + ## TCP hardening + # Prevent bogus ICMP errors from filling up logs. + "net.ipv4.icmp_ignore_bogus_error_responses" = 1; + # Reverse path filtering causes the kernel to do source validation of + # packets received from all interfaces. This can mitigate IP spoofing. + "net.ipv4.conf.default.rp_filter" = 1; + "net.ipv4.conf.all.rp_filter" = 1; + # Do not accept IP source route packets (we're not a router) + "net.ipv4.conf.all.accept_source_route" = 0; + "net.ipv6.conf.all.accept_source_route" = 0; + # Don't send ICMP redirects (again, we're on a router) + "net.ipv4.conf.all.send_redirects" = 0; + "net.ipv4.conf.default.send_redirects" = 0; + # Refuse ICMP redirects (MITM mitigations) + "net.ipv4.conf.all.accept_redirects" = 0; + "net.ipv4.conf.default.accept_redirects" = 0; + "net.ipv4.conf.all.secure_redirects" = 0; + "net.ipv4.conf.default.secure_redirects" = 0; + "net.ipv6.conf.all.accept_redirects" = 0; + "net.ipv6.conf.default.accept_redirects" = 0; + # Protects against SYN flood attacks + "net.ipv4.tcp_syncookies" = 1; + # Incomplete protection again TIME-WAIT assassination + "net.ipv4.tcp_rfc1337" = 1; + + ## TCP optimization + # TCP Fast Open is a TCP extension that reduces network latency by packing + # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for + # both incoming and outgoing connections: + "net.ipv4.tcp_fastopen" = 3; + # Bufferbloat mitigations + slight improvement in throughput & latency + "net.ipv4.tcp_congestion_control" = "bbr"; + "net.core.default_qdisc" = "cake"; + }; + boot.kernelModules = [ "tcp_bbr" ]; + # Change me later! user.initialPassword = "nixos"; users.users.root.initialPassword = "nixos";