asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

hardening

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 07:07:17 +02:00
commit 5cbce68d88
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
3 changed files with 41 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

33
modules/security.nix Normal file
View file

@ -0,0 +1,33 @@
{ config, pkgs, ... }:
{
# Only allow members of the wheel group to execute sudo
security.sudo.execWheelOnly = true;
# Linux Audit Framework (suggested by Lynis)
security.auditd.enable = true;
security.audit.enable = true;
# Kernel Hardening
security.protectKernelImage = true;
# Sysctl hardening
boot.kernel.sysctl = {
# Hide kernel pointers from unprivileged users
"kernel.kptr_restrict" = 1;
# Restrict ptrace to only child processes
"kernel.yama.ptrace_scope" = 1;
# Disable BPF JIT for unprivileged users
"kernel.unprivileged_bpf_disabled" = 1;
# Networking hardening
"net.ipv4.conf.all.log_martians" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.default.log_martians" = 1;
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
};
}