AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

hardening config

Browse Source
This commit is contained in:
Dmitriy Kholkin 2023-01-26 00:38:41 +03:00
parent e7bd3f7307
commit a4f8f9a1eb
2 changed files with 30 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
machines/Home-Hypervisor/boot.nix
View File

@ -77,20 +77,6 @@ in {
"rd.systemd.show_status=auto"
"rd.udev.log_priority=3"
];
kernel.sysctl = {
"kernel.sysrq" = false;
"net.core.default_qdisc" = "sch_fq_codel";
"net.ipv4.conf.all.accept_source_route" = false;
"net.ipv4.icmp_ignore_bogus_error_responses" = true;
"net.ipv4.tcp_congestion_control" = "bbr";
"net.ipv4.tcp_fastopen" = 3;
"net.ipv4.tcp_rfc1337" = true;
"net.ipv4.tcp_syncookies" = true;
"net.ipv6.conf.all.accept_source_route" = false;
# disable ipv6
"net.ipv6.conf.all.disable_ipv6" = true;
"net.ipv6.conf.default.disable_ipv6" = true;
};
kernel.sysctl = {
"vm.swappiness" = if config.deviceSpecific.isSSD then 1 else 10;
};

30
machines/Home-Hypervisor/hardening.nix Normal file
View File

@ -0,0 +1,30 @@
{ modulesPath, config, pkgs, lib, ... }: {
imports = [
"${toString modulesPath}/profiles/hardened.nix"
];
boot.kernel.sysctl = {
"kernel.sysrq" = false;
"net.core.default_qdisc" = "sch_fq_codel";
"net.ipv4.conf.all.accept_source_route" = false;
"net.ipv4.icmp_ignore_bogus_error_responses" = true;
"net.ipv4.tcp_congestion_control" = "bbr";
"net.ipv4.tcp_fastopen" = 3;
"net.ipv4.tcp_rfc1337" = true;
"net.ipv4.tcp_syncookies" = true;
"net.ipv6.conf.all.accept_source_route" = false;
# disable ipv6
"net.ipv6.conf.all.disable_ipv6" = true;
"net.ipv6.conf.default.disable_ipv6" = true;
};
security.lockKernelModules = false;
security.allowSimultaneousMultithreading = true;
security.virtualisation.flushL1DataCache = "cond";
# security.forcePageTableIsolation = false;
# boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = false;
# boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = "0";
# boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = false;
# boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = "0";
}