forked from KptltD00M/nixy
KptltD00M
5082521524
- Introduced `default-creds` module for managing default credentials with Umami integration. - Added `fail2ban` module for brute-force attack protection with configurable ban times. - Created `firewall` module to enable and configure basic firewall settings. - Implemented `gitea` module for self-hosted Git service with PostgreSQL backend. - Developed `glance` module for a customizable dashboard with various widgets and themes. - Added `iknowyou` module for a self-hosted password manager with production and demo environments. - Introduced `kernel-hardening` module for enhancing kernel security settings. - Created `mazanoke` module for a simple web application with Nginx integration. - Added `mealie` module for a self-hosted meal planning application. - Implemented `stirling-pdf` module for PDF generation service. - Developed `umami` module for self-hosted analytics with secret management. - Added `ssh` module for secure SSH configuration with user restrictions. - Introduced `nixy` theme for a customized aesthetic experience across services.
36 lines
1002 B
Nix
36 lines
1002 B
Nix
# Kernel hardening for the server
|
|
{
|
|
boot.kernel.sysctl = {
|
|
# Restrict access to kernel logs and pointers
|
|
"kernel.dmesg_restrict" = 1;
|
|
"kernel.kptr_restrict" = 2;
|
|
|
|
# BPF hardening
|
|
"net.core.bpf_jit_harden" = 2;
|
|
"kernel.unprivileged_bpf_disabled" = 1;
|
|
|
|
# Reverse path filtering (anti-spoofing)
|
|
"net.ipv4.conf.all.rp_filter" = 1;
|
|
"net.ipv4.conf.default.rp_filter" = 1;
|
|
|
|
# SYN flood protection
|
|
"net.ipv4.tcp_syncookies" = 1;
|
|
|
|
# Disable IP source routing
|
|
"net.ipv4.conf.all.accept_source_route" = 0;
|
|
"net.ipv4.conf.default.accept_source_route" = 0;
|
|
|
|
# Ignore ICMP redirects (prevent MITM)
|
|
"net.ipv4.conf.all.accept_redirects" = 0;
|
|
"net.ipv4.conf.default.accept_redirects" = 0;
|
|
"net.ipv4.conf.all.secure_redirects" = 0;
|
|
"net.ipv6.conf.all.accept_redirects" = 0;
|
|
|
|
# Don't send ICMP redirects
|
|
"net.ipv4.conf.all.send_redirects" = 0;
|
|
|
|
# Restrict ptrace to parent processes only
|
|
"kernel.yama.ptrace_scope" = 1;
|
|
};
|
|
}
|