102 lines
2.7 KiB
Nix
102 lines
2.7 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
security.sudo = {
|
|
execWheelOnly = true;
|
|
extraConfig = ''
|
|
# Reduce sudo timeout to 5 minutes
|
|
Defaults timestamp_timeout=5
|
|
# Require password for sudo even in same terminal session after timeout
|
|
Defaults timestamp_type=global
|
|
# Show asterisks when typing password
|
|
Defaults pwfeedback
|
|
'';
|
|
};
|
|
|
|
nix.settings.allowed-users = [ "@wheel" ];
|
|
|
|
security.apparmor = {
|
|
enable = true;
|
|
killUnconfinedConfinables = true;
|
|
};
|
|
|
|
services.fail2ban = {
|
|
enable = true;
|
|
maxretry = 5;
|
|
bantime = "1h";
|
|
bantime-increment = {
|
|
enable = true;
|
|
maxtime = "168h"; # 1 week max ban
|
|
factor = "4";
|
|
};
|
|
};
|
|
|
|
security.pam.loginLimits = [
|
|
{ domain = "*"; type = "hard"; item = "core"; value = "0"; }
|
|
];
|
|
|
|
boot.kernel.sysctl = {
|
|
"kernel.dmesg_restrict" = 1;
|
|
"kernel.kptr_restrict" = 2;
|
|
"kernel.perf_event_paranoid" = 3;
|
|
"kernel.yama.ptrace_scope" = 1;
|
|
"kernel.unprivileged_bpf_disabled" = 1;
|
|
"kernel.sysrq" = 0;
|
|
"kernel.randomize_va_space" = 2;
|
|
"kernel.kexec_load_disabled" = 1;
|
|
|
|
"net.ipv4.conf.all.log_martians" = 1;
|
|
"net.ipv4.conf.default.log_martians" = 1;
|
|
"net.ipv4.icmp_echo_ignore_broadcasts" = 1;
|
|
"net.ipv4.conf.all.accept_redirects" = 0;
|
|
"net.ipv4.conf.default.accept_redirects" = 0;
|
|
"net.ipv4.conf.all.send_redirects" = 0;
|
|
"net.ipv4.conf.default.send_redirects" = 0;
|
|
"net.ipv4.conf.all.accept_source_route" = 0;
|
|
"net.ipv4.conf.default.accept_source_route" = 0;
|
|
"net.ipv4.conf.all.rp_filter" = 1;
|
|
"net.ipv4.conf.default.rp_filter" = 1;
|
|
"net.ipv4.tcp_syncookies" = 1;
|
|
"net.ipv4.tcp_rfc1337" = 1;
|
|
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
|
|
|
|
"net.ipv6.conf.all.accept_redirects" = 0;
|
|
"net.ipv6.conf.default.accept_redirects" = 0;
|
|
"net.ipv6.conf.all.accept_source_route" = 0;
|
|
"net.ipv6.conf.default.accept_source_route" = 0;
|
|
"net.ipv6.conf.all.accept_ra" = 0;
|
|
"net.ipv6.conf.default.accept_ra" = 0;
|
|
|
|
"net.core.rmem_max" = 16777216;
|
|
"net.core.wmem_max" = 16777216;
|
|
"net.ipv4.tcp_fastopen" = 3;
|
|
"net.ipv4.tcp_congestion_control" = "bbr";
|
|
"net.core.default_qdisc" = "fq";
|
|
|
|
"vm.swappiness" = 10;
|
|
"vm.vfs_cache_pressure" = 50;
|
|
"vm.dirty_ratio" = 10;
|
|
"vm.dirty_background_ratio" = 5;
|
|
|
|
"fs.protected_hardlinks" = 1;
|
|
"fs.protected_symlinks" = 1;
|
|
"fs.protected_fifos" = 2;
|
|
"fs.protected_regular" = 2;
|
|
"fs.suid_dumpable" = 0;
|
|
};
|
|
|
|
system.autoUpgrade = {
|
|
enable = true;
|
|
allowReboot = false;
|
|
dates = "04:00";
|
|
};
|
|
|
|
security.auditd.enable = true;
|
|
security.audit = {
|
|
enable = true;
|
|
rules = [
|
|
"-a exit,always -F arch=b64 -S execve"
|
|
];
|
|
};
|
|
}
|