nixos/profiles/security.nix

   1 { pkgs, lib, ... }:
   2 with lib;
   3 {
   4   boot.kernelPackages = mkDefault pkgs.linuxPackages;
   5   #boot.kernelPackages = pkgs.linuxPackages_latest;
   6   #boot.kernelPackages = pkgs.linuxPackages_hardened;
   7   #boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
   8   #environment.memoryAllocator.provider = "libc";
   9   nix.settings.allowed-users = [ "@users" ];
  10   networking.firewall.pingLimit = "--limit 60/minute --limit-burst 5";
  11   security.allowSimultaneousMultithreading = false;
  12   security.apparmor.enable = lib.mkDefault true;
  13   security.forcePageTableIsolation = true;
  14   security.lockKernelModules = lib.mkDefault true;
  15   security.protectKernelImage = true;
  16   security.virtualisation.flushL1DataCache = "always";
  17   # Only allow members of the wheel group to execute sudo by setting
  18   # the executable’s permissions accordingly.
  19   # This prevents users that are not members of wheel
  20   # from exploiting vulnerabilities in sudo such as CVE-2021-3156.
  21   security.sudo.execWheelOnly = true;
  22   boot.blacklistedKernelModules = [
  23     # Obscure network protocols
  24     "ax25"
  25     "netrom"
  26     "rose"
  27
  28     # Old or rare or insufficiently audited filesystems
  29     "adfs"
  30     "affs"
  31     "bfs"
  32     "befs"
  33     "cramfs"
  34     "efs"
  35     "erofs"
  36     "exofs"
  37     "freevxfs"
  38     "f2fs"
  39     "hfs"
  40     "hpfs"
  41     "jfs"
  42     "minix"
  43     "nilfs2"
  44     "ntfs"
  45     "omfs"
  46     "qnx4"
  47     "qnx6"
  48     "sysv"
  49     "ufs"
  50   ];
  51   boot.kernel.sysctl = {
  52     # Mitigate kernel pointer leaks
  53     "kernel.kptr_restrict" = 2;
  54     # Restricts the kernel log to the CAP_SYSLOG capability
  55     "kernel.dmesg_restrict" = 1;
  56     # Prevent information leaks
  57     #kernel.printk = "3 3 3 3";
  58     # Restrict eBPF to the CAP_BPF capability
  59     # and enable JIT hardening techniques
  60     # such as constant blinding.
  61     "kernel.unprivileged_bpf_disabled" = 1;
  62     "net.core.bpf_jit_harden" = 2;
  63     # Restricts loading TTY line disciplines
  64     # to the CAP_SYS_MODULE capability to prevent
  65     # unprivileged attackers from loading vulnerable
  66     # line disciplines with the TIOCSETD ioctl
  67     "dev.tty.ldisc_autoload" = 0;
  68     # The userfaultfd() syscall is often abused to exploit
  69     # use-after-free flaws.
  70     # Due to this, this sysctl is used to restrict
  71     # this syscall to the CAP_SYS_PTRACE capability.
  72     "vm.unprivileged_userfaultfd" = 0;
  73     # kexec is a system call that is used
  74     # to boot another kernel during runtime.
  75     "kernel.kexec_load_disabled" = 1;
  76     # User namespaces are a feature in the kernel which aim to
  77     # improve sandboxing and make it easily accessible for
  78     # unprivileged users however, this feature exposes
  79     # significant kernel attack surface for privilege
  80     # escalation so this sysctl restricts the usage of user
  81     # namespaces to the CAP_SYS_ADMIN capability.
  82     "kernel.unprivileged_userns_clone" = 0;
  83     # Restricts all usage of performance events to the
  84     # CAP_PERFMON capability
  85     "kernel.perf_event_paranoid" = 3;
  86     # Helps protect against SYN flood attacks
  87     "net.ipv4.tcp_syncookies" = 1;
  88     # Protects against time-wait assassination
  89     # by dropping RST packets for sockets
  90     # in the time-wait state.
  91     "net.ipv4.tcp_rfc1337" = 1;
  92     # Disable ICMP redirect acceptance and sending to prevent
  93     # man-in-the-middle attacks and minimize information disclosure.
  94     "net.ipv4.conf.all.accept_redirects" = 0;
  95     "net.ipv4.conf.default.accept_redirects" = 0;
  96     "net.ipv4.conf.all.secure_redirects" = 0;
  97     "net.ipv4.conf.default.secure_redirects" = 0;
  98     "net.ipv6.conf.all.accept_redirects" = 0;
  99     "net.ipv6.conf.default.accept_redirects" = 0;
 100     "net.ipv4.conf.all.send_redirects" = 0;
 101     "net.ipv4.conf.default.send_redirects" = 0;
 102     # Disable source routing, a mechanism
 103     # that allows users to redirect network traffic.
 104     "net.ipv4.conf.all.accept_source_route" = 0;
 105     "net.ipv4.conf.default.accept_source_route" = 0;
 106     "net.ipv6.conf.all.accept_source_route" = 0;
 107     "net.ipv6.conf.default.accept_source_route" = 0;
 108     /*
 109       # Disable TCP SACK, which is commonly exploited
 110       # and unnecessary for many circumstances.
 111       # https://serverfault.com/questions/10955/when-to-turn-tcp-sack-off
 112       "net.ipv4.tcp_sack" = 0;
 113       "net.ipv4.tcp_dsack" = 0;
 114       "net.ipv4.tcp_fack" = 0;
 115     */
 116     # Generate a random IPv6 address
 117     "net.ipv6.conf.all.use_tempaddr" = lib.mkForce 2;
 118     "net.ipv6.conf.default.use_tempaddr" = lib.mkForce 2;
 119     # Restricts usage of ptrace to only processes
 120     # with the CAP_SYS_PTRACE capability
 121     "kernel.yama.ptrace_scope" = 2;
 122     # Do source validation by confirming reverse path
 123     "net.ipv4.conf.all.rp_filter" = 1;
 124     "net.ipv4.conf.default.rp_filter" = 1;
 125   };
 126   boot.kernelParams = [
 127     "slab_nomerge"
 128     "slub_debug=FZ"
 129     #"init_on_alloc=1"
 130     #"init_on_free=1"
 131     "page_alloc.shuffle=1"
 132     "pti=on"
 133     "vsyscall=none"
 134     "debugfs=off"
 135     "oops=panic"
 136     # Disabled because zfs and wireguard modules are not signed
 137     "module.sig_enforce=0"
 138     "lockdown=confidentiality"
 139     "mce=0"
 140     #"quiet"
 141     #"loglevel=0"
 142   ];
 143   services.journald.extraConfig = ''
 144     Compress=true
 145     MaxRetentionSec=1month
 146     Storage=persistent
 147     SystemMaxUse=100M
 148   '';
 149   systemd.coredump = {
 150     enable = lib.mkDefault false;
 151     extraConfig = ''
 152       Compress=true
 153       MaxUse=1024M
 154       Storage=external
 155     '';
 156   };
 157   services.openssh = {
 158     openFirewall = lib.mkDefault false;
 159     settings = {
 160       PasswordAuthentication = false;
 161     };
 162   };
 163 }