Skip to content
This repository was archived by the owner on Sep 14, 2025. It is now read-only.

Commit 501b3d0

Browse files
felbingerfelbinger
committed
hardening: restructure
1 parent efefdd5 commit 501b3d0

File tree

11 files changed

+342
-166
lines changed

11 files changed

+342
-166
lines changed

‎flake.nix‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
./modules/containers.nix
3131
./modules/filebeat.nix
3232
./modules/firewall.nix
33-
./modules/hardening.nix
33+
./modules/hardening
3434
./modules/nginx.nix
3535
./modules/acme.nix
3636
./modules/postgres.nix

‎modules/hardening.nix‎

Lines changed: 0 additions & 165 deletions
This file was deleted.

‎modules/hardening/default.nix‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
lib,
3+
config,
4+
...
5+
}:
6+
let
7+
mkDisableOption =
8+
name:
9+
lib.mkEnableOption name
10+
// {
11+
default = true;
12+
example = false;
13+
};
14+
in
15+
{
16+
options.secshell.hardening = mkDisableOption "hardening";
17+
18+
imports = [
19+
./kernel.nix
20+
./kernel-modules.nix
21+
./kernel-sysctl.nix
22+
./memory.nix
23+
./nix.nix
24+
./ssh.nix
25+
./proc.nix
26+
./pwquality.nix
27+
];
28+
29+
config = lib.mkIf config.secshell.hardening {
30+
security = {
31+
sudo = {
32+
execWheelOnly = true;
33+
extraConfig = ''
34+
Defaults logfile="/var/log/sudo.log"
35+
'';
36+
};
37+
apparmor = {
38+
enable = lib.mkDefault true;
39+
killUnconfinedConfinables = lib.mkDefault true;
40+
};
41+
};
42+
43+
# weird logrotate issue during config check
44+
# cannot find name for group ID 30000
45+
# https://discourse.nixos.org/t/logrotate-config-fails-due-to-missing-group-30000/28501
46+
services.logrotate.checkConfig = false;
47+
};
48+
}

‎modules/hardening/kernel-modules.nix‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
lib,
3+
pkgs,
4+
config,
5+
...
6+
}:
7+
{
8+
config = lib.mkIf config.secshell.hardening {
9+
boot.extraModprobeConfig =
10+
let
11+
cmd = "${pkgs.coreutils}/bin/true";
12+
modules = [
13+
# Obscure network protocols
14+
"ax25"
15+
"netrom"
16+
"rose"
17+
18+
# Old or rare or insufficiently audited filesystems
19+
"adfs"
20+
"affs"
21+
"bfs"
22+
"befs"
23+
"cramfs"
24+
"efs"
25+
"erofs"
26+
"exofs"
27+
"freevxfs"
28+
"f2fs"
29+
"hfs"
30+
"hpfs"
31+
"jfs"
32+
"minix"
33+
"nilfs2"
34+
"ntfs"
35+
"omfs"
36+
"qnx4"
37+
"qnx6"
38+
"sysv"
39+
"ufs"
40+
41+
# Unused network protocols
42+
"sctp"
43+
"dccp"
44+
"rds"
45+
"tipc"
46+
"n-hdlc"
47+
"x25"
48+
"appletalk"
49+
"can"
50+
"atm"
51+
"psnap"
52+
"p8022"
53+
54+
# Unused file systems
55+
"jffs2"
56+
"hfsplus"
57+
"udf"
58+
59+
# Unused interfaces
60+
"thunderbolt"
61+
"firewire-core"
62+
63+
# Firewire
64+
"sbp2"
65+
"ohci1394"
66+
"firewire-ohci"
67+
68+
# Wifi
69+
"ath"
70+
"iwlegacy"
71+
"iwlwifi"
72+
"mwifiex"
73+
"rtlwifi"
74+
];
75+
in
76+
lib.concatStringsSep "\n" (map (kmod: "install ${kmod} ${cmd}") modules);
77+
};
78+
}

‎modules/hardening/kernel-sysctl.nix‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
lib,
3+
config,
4+
...
5+
}:
6+
{
7+
config = lib.mkIf config.secshell.hardening {
8+
boot.kernel.sysctl = {
9+
"dev.tty.ldisc_autoload" = lib.mkDefault 0;
10+
"fs.protected_fifos" = lib.mkDefault 2;
11+
"fs.protected_regular" = lib.mkDefault 2;
12+
"fs.protected_hardlinks" = lib.mkDefault 1;
13+
"fs.protected_symlinks" = lib.mkDefault 1;
14+
"fs.suid_dumpable" = lib.mkDefault 0;
15+
"kernel.yama.ptrace_scope" = lib.mkDefault 3;
16+
"kernel.randomize_va_space" = lib.mkDefault 2;
17+
"kernel.dmesg_restrict" = lib.mkDefault 1;
18+
"kernel.perf_event_paranoid" = lib.mkDefault 3;
19+
"kernel.sysrq" = lib.mkDefault 0;
20+
"kernel.unprivileged_bpf_disabled" = lib.mkDefault 1;
21+
"kernel.io_uring_disabled" = lib.mkDefault 2;
22+
"net.core.bpf_jit_harden" = lib.mkDefault 2;
23+
"net.ipv4.ip_forward" = lib.mkDefault 0;
24+
"net.ipv6.conf.all.forwarding" = lib.mkDefault 0;
25+
"net.ipv6.conf.all.accept_ra" = lib.mkDefault 0;
26+
"net.ipv6.conf.default.accept_ra" = lib.mkDefault 0;
27+
28+
# Hide kptrs even for processes with CAP_SYSLOG
29+
"kernel.kptr_restrict" = lib.mkOverride 500 2;
30+
31+
# Disable bpf() JIT (to eliminate spray attacks)
32+
"net.core.bpf_jit_enable" = lib.mkDefault false;
33+
34+
# Disable ftrace debugging
35+
"kernel.ftrace_enabled" = lib.mkDefault false;
36+
37+
# Enable strict reverse path filtering (that is, do not attempt to route
38+
# packets that "obviously" do not belong to the iface's network; dropped
39+
# packets are logged as martians).
40+
"net.ipv4.conf.all.log_martians" = lib.mkDefault true;
41+
"net.ipv4.conf.all.rp_filter" = lib.mkDefault "1";
42+
"net.ipv4.conf.default.log_martians" = lib.mkDefault true;
43+
"net.ipv4.conf.default.rp_filter" = lib.mkDefault "1";
44+
45+
# Ignore broadcast ICMP (mitigate SMURF)
46+
"net.ipv4.icmp_echo_ignore_broadcasts" = lib.mkDefault true;
47+
48+
# Ignore incoming ICMP redirects (note: default is needed to ensure that the
49+
# setting is applied to interfaces added after the sysctls are set)
50+
"net.ipv4.conf.all.accept_redirects" = lib.mkDefault false;
51+
"net.ipv4.conf.all.secure_redirects" = lib.mkDefault false;
52+
"net.ipv4.conf.default.accept_redirects" = lib.mkDefault false;
53+
"net.ipv4.conf.default.secure_redirects" = lib.mkDefault false;
54+
"net.ipv6.conf.all.accept_redirects" = lib.mkDefault false;
55+
"net.ipv6.conf.default.accept_redirects" = lib.mkDefault false;
56+
57+
# Ignore outgoing ICMP redirects (this is ipv4 only)
58+
"net.ipv4.conf.all.send_redirects" = lib.mkDefault false;
59+
"net.ipv4.conf.default.send_redirects" = lib.mkDefault false;
60+
};
61+
};
62+
}

‎modules/hardening/kernel.nix‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
lib,
3+
config,
4+
pkgs,
5+
...
6+
}:
7+
{
8+
config = lib.mkIf config.secshell.hardening {
9+
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_hardened;
10+
security = {
11+
lockKernelModules = lib.mkDefault true;
12+
protectKernelImage = lib.mkDefault true;
13+
};
14+
};
15+
}

0 commit comments

Comments
 (0)