4 boot.kernelPackages = mkDefault pkgs.linuxPackages;
5 #boot.kernelPackages = pkgs.linuxPackages_latest;
6 #boot.kernelPackages = pkgs.linuxPackages_hardened;
7 #boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
8 #environment.memoryAllocator.provider = "libc";
9 nix.settings.allowed-users = [ "@users" ];
10 networking.firewall.pingLimit = "--limit 60/minute --limit-burst 5";
11 security.allowSimultaneousMultithreading = false;
12 security.apparmor.enable = mkDefault true;
13 security.forcePageTableIsolation = true;
14 security.lockKernelModules = mkDefault true;
15 security.protectKernelImage = true;
16 security.virtualisation.flushL1DataCache = "always";
17 # Only allow members of the wheel group to execute sudo by setting
18 # the executable’s permissions accordingly.
19 # This prevents users that are not members of wheel
20 # from exploiting vulnerabilities in sudo such as CVE-2021-3156.
21 security.sudo.execWheelOnly = true;
22 boot.blacklistedKernelModules = [
23 # Obscure network protocols
28 # Old or rare or insufficiently audited filesystems
51 boot.kernel.sysctl = {
52 # Mitigate kernel pointer leaks
53 "kernel.kptr_restrict" = 2;
54 # Restricts the kernel log to the CAP_SYSLOG capability
55 "kernel.dmesg_restrict" = 1;
56 # Prevent information leaks
57 #kernel.printk = "3 3 3 3";
58 # Restrict eBPF to the CAP_BPF capability
59 # and enable JIT hardening techniques
60 # such as constant blinding.
61 "kernel.unprivileged_bpf_disabled" = 1;
62 "net.core.bpf_jit_harden" = 2;
63 # Restricts loading TTY line disciplines
64 # to the CAP_SYS_MODULE capability to prevent
65 # unprivileged attackers from loading vulnerable
66 # line disciplines with the TIOCSETD ioctl
67 "dev.tty.ldisc_autoload" = 0;
68 # The userfaultfd() syscall is often abused to exploit
69 # use-after-free flaws.
70 # Due to this, this sysctl is used to restrict
71 # this syscall to the CAP_SYS_PTRACE capability.
72 "vm.unprivileged_userfaultfd" = 0;
73 # kexec is a system call that is used
74 # to boot another kernel during runtime.
75 "kernel.kexec_load_disabled" = 1;
76 # User namespaces are a feature in the kernel which aim to
77 # improve sandboxing and make it easily accessible for
78 # unprivileged users however, this feature exposes
79 # significant kernel attack surface for privilege
80 # escalation so this sysctl restricts the usage of user
81 # namespaces to the CAP_SYS_ADMIN capability.
82 "kernel.unprivileged_userns_clone" = 0;
83 # Restricts all usage of performance events to the
84 # CAP_PERFMON capability
85 "kernel.perf_event_paranoid" = 3;
86 # Helps protect against SYN flood attacks
87 "net.ipv4.tcp_syncookies" = 1;
88 # Protects against time-wait assassination
89 # by dropping RST packets for sockets
90 # in the time-wait state.
91 "net.ipv4.tcp_rfc1337" = 1;
92 # Disable ICMP redirect acceptance and sending to prevent
93 # man-in-the-middle attacks and minimize information disclosure.
94 "net.ipv4.conf.all.accept_redirects" = 0;
95 "net.ipv4.conf.default.accept_redirects" = 0;
96 "net.ipv4.conf.all.secure_redirects" = 0;
97 "net.ipv4.conf.default.secure_redirects" = 0;
98 "net.ipv6.conf.all.accept_redirects" = 0;
99 "net.ipv6.conf.default.accept_redirects" = 0;
100 "net.ipv4.conf.all.send_redirects" = 0;
101 "net.ipv4.conf.default.send_redirects" = 0;
102 # Disable source routing, a mechanism
103 # that allows users to redirect network traffic.
104 "net.ipv4.conf.all.accept_source_route" = 0;
105 "net.ipv4.conf.default.accept_source_route" = 0;
106 "net.ipv6.conf.all.accept_source_route" = 0;
107 "net.ipv6.conf.default.accept_source_route" = 0;
109 # Disable TCP SACK, which is commonly exploited
110 # and unnecessary for many circumstances.
111 # https://serverfault.com/questions/10955/when-to-turn-tcp-sack-off
112 "net.ipv4.tcp_sack" = 0;
113 "net.ipv4.tcp_dsack" = 0;
114 "net.ipv4.tcp_fack" = 0;
116 # Generate a random IPv6 address
117 "net.ipv6.conf.all.use_tempaddr" = mkForce 2;
118 "net.ipv6.conf.default.use_tempaddr" = mkForce 2;
119 # Restricts usage of ptrace to only processes
120 # with the CAP_SYS_PTRACE capability
121 "kernel.yama.ptrace_scope" = 2;
122 # Do source validation by confirming reverse path
123 "net.ipv4.conf.all.rp_filter" = 1;
124 "net.ipv4.conf.default.rp_filter" = 1;
126 boot.kernelParams = [
131 "page_alloc.shuffle=1"
136 # Disabled because zfs and wireguard modules are not signed
137 "module.sig_enforce=0"
138 "lockdown=confidentiality"
143 services.journald.extraConfig = ''
145 MaxRetentionSec=1month
150 enable = mkDefault false;
158 # Avoid TOFU MITM by providing well known public keys here.
160 "git.sr.ht".hostNames = [ "git.sr.ht" ];
161 "git.sr.ht".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
163 "github.com".hostNames = [ "github.com" ];
164 "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
166 "gitlab.com".hostNames = [ "gitlab.com" ];
167 "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
169 openFirewall = mkDefault false;
171 KbdInteractiveAuthentication = mkDefault false;
172 # Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
175 "curve25519-sha256@libssh.org"
176 "diffie-hellman-group16-sha512"
177 "diffie-hellman-group18-sha512"
178 "sntrup761x25519-sha512@openssh.com"
180 PasswordAuthentication = false;
181 # Remove any remote gpg-agent's socket.
182 StreamLocalBindUnlink = true;
183 UseDns = mkDefault false;
184 X11Forwarding = mkDefault false;