Harden & optimize networking settings
This commit is contained in:
		
							parent
							
								
									0f0f314643
								
							
						
					
					
						commit
						5c29620dee
					
				
							
								
								
									
										13
									
								
								default.nix
									
									
									
									
									
								
							
							
						
						
									
										13
									
								
								default.nix
									
									
									
									
									
								
							|  | @ -45,12 +45,13 @@ with lib.my; | |||
|   fileSystems."/".device = mkDefault "/dev/disk/by-label/nixos"; | ||||
| 
 | ||||
|   # Use the latest kernel | ||||
|   boot.kernelPackages = mkDefault pkgs.linuxPackages_5_10; | ||||
| 
 | ||||
|   boot.loader = { | ||||
|     efi.canTouchEfiVariables = mkDefault true; | ||||
|     systemd-boot.configurationLimit = 10; | ||||
|     systemd-boot.enable = mkDefault true; | ||||
|   boot = { | ||||
|     kernelPackages = mkDefault pkgs.linuxPackages_5_10; | ||||
|     loader = { | ||||
|       efi.canTouchEfiVariables = mkDefault true; | ||||
|       systemd-boot.configurationLimit = 10; | ||||
|       systemd-boot.enable = mkDefault true; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   # Just the bear necessities... | ||||
|  |  | |||
|  | @ -5,6 +5,7 @@ | |||
| with lib.my; | ||||
| { | ||||
|   imports = [ | ||||
|     ../server.nix | ||||
|     ../personal.nix | ||||
|     ./hardware-configuration.nix | ||||
| 
 | ||||
|  |  | |||
|  | @ -53,6 +53,7 @@ with lib; | |||
| { | ||||
|   imports = [ | ||||
|     "${modulesPath}/profiles/qemu-guest.nix" | ||||
|     ./server.nix | ||||
|   ]; | ||||
| 
 | ||||
|   environment.systemPackages = | ||||
|  |  | |||
|  | @ -26,7 +26,12 @@ with lib; | |||
|     longitude = 12.5; | ||||
|   } else {}); | ||||
| 
 | ||||
|   ## | ||||
| 
 | ||||
|   # Refuse ICMP echo requests on my desktop/laptop; nobody has any business | ||||
|   # pinging them, unlike my servers. | ||||
|   boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1; | ||||
| 
 | ||||
|   # So thw bitwarden CLI knows where to find my server. | ||||
|   modules.shell.bitwarden.config.server = "p.v0.io"; | ||||
| 
 | ||||
|   services.syncthing.declarative = { | ||||
|  |  | |||
							
								
								
									
										20
									
								
								hosts/server.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										20
									
								
								hosts/server.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,20 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
|   boot.kernelPackages = pkgs.linuxPackages_latest_hardened; | ||||
| 
 | ||||
|   systemd = { | ||||
|     services.clear-log = { | ||||
|       description = "Clear >1 month-old logs every week"; | ||||
|       serviceConfig = { | ||||
|         Type = "oneshot"; | ||||
|         ExecStart = "${pkgs.systemd}/bin/journalctl --vacuum-time=30d"; | ||||
|       }; | ||||
|     }; | ||||
|     timers.clear-log = { | ||||
|       wantedBy = [ "timers.target" ]; | ||||
|       partOf = [ "clear-log.service" ]; | ||||
|       timerConfig.OnCalendar = "weekly UTC"; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
|  | @ -1,7 +1,12 @@ | |||
| { lib, config, ... }: | ||||
| { config, lib, ... }: | ||||
| 
 | ||||
| { | ||||
|   ## System security tweaks | ||||
|   # sets hidepid=2 on /proc (make process info visible only to owning user) | ||||
|   security.hideProcessInformation = true; | ||||
|   # Prevent replacing the running kernel w/o reboot | ||||
|   security.protectKernelImage = true; | ||||
| 
 | ||||
|   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy | ||||
|   # on ssd systems, and volatile! Because it's wiped on reboot. | ||||
|   boot.tmpOnTmpfs = lib.mkDefault true; | ||||
|  | @ -9,20 +14,59 @@ | |||
|     what = "tmpfs"; | ||||
|     where = "/tmp"; | ||||
|     type = "tmpfs"; | ||||
|     # Added noexec (for added security), and reduced size from 50% to 25% | ||||
|     # Added noexec (for added security) and reduce size from 50% to 25% | ||||
|     options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; | ||||
|   }]; | ||||
|   # If not using tmpfs, which is naturally purged on reboot, we must clean it | ||||
|   # /tmp ourselves. /tmp should be volatile storage! | ||||
|   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); | ||||
| 
 | ||||
|   security.hideProcessInformation = true; | ||||
|   security.protectKernelImage = true; | ||||
| 
 | ||||
|   # Fix a security hole in place for backwards compatibility. See desc in | ||||
|   # nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix | ||||
|   boot.loader.systemd-boot.editor = false; | ||||
| 
 | ||||
|   boot.kernel.sysctl = { | ||||
|     # The Magic SysRq key is a key combo that allows users connected to the | ||||
|     # system console of a Linux kernel to perform some low-level commands. | ||||
|     # Disable it, since we don't need it, and is a potential security concern. | ||||
|     "kernel.sysrq" = 0; | ||||
| 
 | ||||
|     ## TCP hardening | ||||
|     # Prevent bogus ICMP errors from filling up logs. | ||||
|     "net.ipv4.icmp_ignore_bogus_error_responses" = 1; | ||||
|     # Reverse path filtering causes the kernel to do source validation of | ||||
|     # packets received from all interfaces. This can mitigate IP spoofing. | ||||
|     "net.ipv4.conf.default.rp_filter" = 1; | ||||
|     "net.ipv4.conf.all.rp_filter" = 1; | ||||
|     # Do not accept IP source route packets (we're not a router) | ||||
|     "net.ipv4.conf.all.accept_source_route" = 0; | ||||
|     "net.ipv6.conf.all.accept_source_route" = 0; | ||||
|     # Don't send ICMP redirects (again, we're on a router) | ||||
|     "net.ipv4.conf.all.send_redirects" = 0; | ||||
|     "net.ipv4.conf.default.send_redirects" = 0; | ||||
|     # Refuse ICMP redirects (MITM mitigations) | ||||
|     "net.ipv4.conf.all.accept_redirects" = 0; | ||||
|     "net.ipv4.conf.default.accept_redirects" = 0; | ||||
|     "net.ipv4.conf.all.secure_redirects" = 0; | ||||
|     "net.ipv4.conf.default.secure_redirects" = 0; | ||||
|     "net.ipv6.conf.all.accept_redirects" = 0; | ||||
|     "net.ipv6.conf.default.accept_redirects" = 0; | ||||
|     # Protects against SYN flood attacks | ||||
|     "net.ipv4.tcp_syncookies" = 1; | ||||
|     # Incomplete protection again TIME-WAIT assassination | ||||
|     "net.ipv4.tcp_rfc1337" = 1; | ||||
| 
 | ||||
|     ## TCP optimization | ||||
|     # TCP Fast Open is a TCP extension that reduces network latency by packing | ||||
|     # data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for | ||||
|     # both incoming and outgoing connections: | ||||
|     "net.ipv4.tcp_fastopen" = 3; | ||||
|     # Bufferbloat mitigations + slight improvement in throughput & latency | ||||
|     "net.ipv4.tcp_congestion_control" = "bbr"; | ||||
|     "net.core.default_qdisc" = "cake"; | ||||
|   }; | ||||
|   boot.kernelModules = [ "tcp_bbr" ]; | ||||
| 
 | ||||
|   # Change me later! | ||||
|   user.initialPassword = "nixos"; | ||||
|   users.users.root.initialPassword = "nixos"; | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue