Harden & optimize networking settings
This commit is contained in:
		
							parent
							
								
									0f0f314643
								
							
						
					
					
						commit
						5c29620dee
					
				
							
								
								
									
										13
									
								
								default.nix
									
									
									
									
									
								
							
							
						
						
									
										13
									
								
								default.nix
									
									
									
									
									
								
							|  | @ -45,12 +45,13 @@ with lib.my; | ||||||
|   fileSystems."/".device = mkDefault "/dev/disk/by-label/nixos"; |   fileSystems."/".device = mkDefault "/dev/disk/by-label/nixos"; | ||||||
| 
 | 
 | ||||||
|   # Use the latest kernel |   # Use the latest kernel | ||||||
|   boot.kernelPackages = mkDefault pkgs.linuxPackages_5_10; |   boot = { | ||||||
| 
 |     kernelPackages = mkDefault pkgs.linuxPackages_5_10; | ||||||
|   boot.loader = { |     loader = { | ||||||
|     efi.canTouchEfiVariables = mkDefault true; |       efi.canTouchEfiVariables = mkDefault true; | ||||||
|     systemd-boot.configurationLimit = 10; |       systemd-boot.configurationLimit = 10; | ||||||
|     systemd-boot.enable = mkDefault true; |       systemd-boot.enable = mkDefault true; | ||||||
|  |     }; | ||||||
|   }; |   }; | ||||||
| 
 | 
 | ||||||
|   # Just the bear necessities... |   # Just the bear necessities... | ||||||
|  |  | ||||||
|  | @ -5,6 +5,7 @@ | ||||||
| with lib.my; | with lib.my; | ||||||
| { | { | ||||||
|   imports = [ |   imports = [ | ||||||
|  |     ../server.nix | ||||||
|     ../personal.nix |     ../personal.nix | ||||||
|     ./hardware-configuration.nix |     ./hardware-configuration.nix | ||||||
| 
 | 
 | ||||||
|  |  | ||||||
|  | @ -53,6 +53,7 @@ with lib; | ||||||
| { | { | ||||||
|   imports = [ |   imports = [ | ||||||
|     "${modulesPath}/profiles/qemu-guest.nix" |     "${modulesPath}/profiles/qemu-guest.nix" | ||||||
|  |     ./server.nix | ||||||
|   ]; |   ]; | ||||||
| 
 | 
 | ||||||
|   environment.systemPackages = |   environment.systemPackages = | ||||||
|  |  | ||||||
|  | @ -26,7 +26,12 @@ with lib; | ||||||
|     longitude = 12.5; |     longitude = 12.5; | ||||||
|   } else {}); |   } else {}); | ||||||
| 
 | 
 | ||||||
|   ## | 
 | ||||||
|  |   # Refuse ICMP echo requests on my desktop/laptop; nobody has any business | ||||||
|  |   # pinging them, unlike my servers. | ||||||
|  |   boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1; | ||||||
|  | 
 | ||||||
|  |   # So thw bitwarden CLI knows where to find my server. | ||||||
|   modules.shell.bitwarden.config.server = "p.v0.io"; |   modules.shell.bitwarden.config.server = "p.v0.io"; | ||||||
| 
 | 
 | ||||||
|   services.syncthing.declarative = { |   services.syncthing.declarative = { | ||||||
|  |  | ||||||
							
								
								
									
										20
									
								
								hosts/server.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										20
									
								
								hosts/server.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,20 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   boot.kernelPackages = pkgs.linuxPackages_latest_hardened; | ||||||
|  | 
 | ||||||
|  |   systemd = { | ||||||
|  |     services.clear-log = { | ||||||
|  |       description = "Clear >1 month-old logs every week"; | ||||||
|  |       serviceConfig = { | ||||||
|  |         Type = "oneshot"; | ||||||
|  |         ExecStart = "${pkgs.systemd}/bin/journalctl --vacuum-time=30d"; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |     timers.clear-log = { | ||||||
|  |       wantedBy = [ "timers.target" ]; | ||||||
|  |       partOf = [ "clear-log.service" ]; | ||||||
|  |       timerConfig.OnCalendar = "weekly UTC"; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
|  | @ -1,7 +1,12 @@ | ||||||
| { lib, config, ... }: | { config, lib, ... }: | ||||||
| 
 | 
 | ||||||
| { | { | ||||||
|   ## System security tweaks |   ## System security tweaks | ||||||
|  |   # sets hidepid=2 on /proc (make process info visible only to owning user) | ||||||
|  |   security.hideProcessInformation = true; | ||||||
|  |   # Prevent replacing the running kernel w/o reboot | ||||||
|  |   security.protectKernelImage = true; | ||||||
|  | 
 | ||||||
|   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy |   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy | ||||||
|   # on ssd systems, and volatile! Because it's wiped on reboot. |   # on ssd systems, and volatile! Because it's wiped on reboot. | ||||||
|   boot.tmpOnTmpfs = lib.mkDefault true; |   boot.tmpOnTmpfs = lib.mkDefault true; | ||||||
|  | @ -9,20 +14,59 @@ | ||||||
|     what = "tmpfs"; |     what = "tmpfs"; | ||||||
|     where = "/tmp"; |     where = "/tmp"; | ||||||
|     type = "tmpfs"; |     type = "tmpfs"; | ||||||
|     # Added noexec (for added security), and reduced size from 50% to 25% |     # Added noexec (for added security) and reduce size from 50% to 25% | ||||||
|     options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; |     options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; | ||||||
|   }]; |   }]; | ||||||
|   # If not using tmpfs, which is naturally purged on reboot, we must clean it |   # If not using tmpfs, which is naturally purged on reboot, we must clean it | ||||||
|   # /tmp ourselves. /tmp should be volatile storage! |   # /tmp ourselves. /tmp should be volatile storage! | ||||||
|   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); |   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); | ||||||
| 
 | 
 | ||||||
|   security.hideProcessInformation = true; |  | ||||||
|   security.protectKernelImage = true; |  | ||||||
| 
 |  | ||||||
|   # Fix a security hole in place for backwards compatibility. See desc in |   # Fix a security hole in place for backwards compatibility. See desc in | ||||||
|   # nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix |   # nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix | ||||||
|   boot.loader.systemd-boot.editor = false; |   boot.loader.systemd-boot.editor = false; | ||||||
| 
 | 
 | ||||||
|  |   boot.kernel.sysctl = { | ||||||
|  |     # The Magic SysRq key is a key combo that allows users connected to the | ||||||
|  |     # system console of a Linux kernel to perform some low-level commands. | ||||||
|  |     # Disable it, since we don't need it, and is a potential security concern. | ||||||
|  |     "kernel.sysrq" = 0; | ||||||
|  | 
 | ||||||
|  |     ## TCP hardening | ||||||
|  |     # Prevent bogus ICMP errors from filling up logs. | ||||||
|  |     "net.ipv4.icmp_ignore_bogus_error_responses" = 1; | ||||||
|  |     # Reverse path filtering causes the kernel to do source validation of | ||||||
|  |     # packets received from all interfaces. This can mitigate IP spoofing. | ||||||
|  |     "net.ipv4.conf.default.rp_filter" = 1; | ||||||
|  |     "net.ipv4.conf.all.rp_filter" = 1; | ||||||
|  |     # Do not accept IP source route packets (we're not a router) | ||||||
|  |     "net.ipv4.conf.all.accept_source_route" = 0; | ||||||
|  |     "net.ipv6.conf.all.accept_source_route" = 0; | ||||||
|  |     # Don't send ICMP redirects (again, we're on a router) | ||||||
|  |     "net.ipv4.conf.all.send_redirects" = 0; | ||||||
|  |     "net.ipv4.conf.default.send_redirects" = 0; | ||||||
|  |     # Refuse ICMP redirects (MITM mitigations) | ||||||
|  |     "net.ipv4.conf.all.accept_redirects" = 0; | ||||||
|  |     "net.ipv4.conf.default.accept_redirects" = 0; | ||||||
|  |     "net.ipv4.conf.all.secure_redirects" = 0; | ||||||
|  |     "net.ipv4.conf.default.secure_redirects" = 0; | ||||||
|  |     "net.ipv6.conf.all.accept_redirects" = 0; | ||||||
|  |     "net.ipv6.conf.default.accept_redirects" = 0; | ||||||
|  |     # Protects against SYN flood attacks | ||||||
|  |     "net.ipv4.tcp_syncookies" = 1; | ||||||
|  |     # Incomplete protection again TIME-WAIT assassination | ||||||
|  |     "net.ipv4.tcp_rfc1337" = 1; | ||||||
|  | 
 | ||||||
|  |     ## TCP optimization | ||||||
|  |     # TCP Fast Open is a TCP extension that reduces network latency by packing | ||||||
|  |     # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for | ||||||
|  |     # both incoming and outgoing connections: | ||||||
|  |     "net.ipv4.tcp_fastopen" = 3; | ||||||
|  |     # Bufferbloat mitigations + slight improvement in throughput & latency | ||||||
|  |     "net.ipv4.tcp_congestion_control" = "bbr"; | ||||||
|  |     "net.core.default_qdisc" = "cake"; | ||||||
|  |   }; | ||||||
|  |   boot.kernelModules = [ "tcp_bbr" ]; | ||||||
|  | 
 | ||||||
|   # Change me later! |   # Change me later! | ||||||
|   user.initialPassword = "nixos"; |   user.initialPassword = "nixos"; | ||||||
|   users.users.root.initialPassword = "nixos"; |   users.users.root.initialPassword = "nixos"; | ||||||
|  |  | ||||||
		Loading…
	
		Reference in a new issue