diff options
| author | Joachim Fasting <joachifm@fastmail.fm> | 2019-07-04 18:51:06 +0200 |
|---|---|---|
| committer | Joachim Fasting <joachifm@fastmail.fm> | 2019-07-04 19:24:44 +0200 |
| commit | c3cc7034e2562b110cd12192e0f390ad25cb5dbe (patch) | |
| tree | f4057a257af1d3964c40fb2fad6aac3aedefae24 /nixos/modules/profiles | |
| parent | c233e24d54bc1681f9001fcdf7adc0c91aea5609 (diff) | |
| download | nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.tar nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.tar.gz nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.tar.bz2 nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.tar.lz nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.tar.xz nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.tar.zst nixlib-c3cc7034e2562b110cd12192e0f390ad25cb5dbe.zip | |
nixos/hardened: harder inet defaults
See e.g., https://github.com/NixOS/nixpkgs/issues/63768 Forwarding remains enabled for now, need to determine its effects on virtualization, if any.
Diffstat (limited to 'nixos/modules/profiles')
| -rw-r--r-- | nixos/modules/profiles/hardened.nix | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index af0dd8471c72..97279a78a57b 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -92,4 +92,34 @@ with lib; # Disable ftrace debugging boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false; + + # Enable reverse path filtering (that is, do not attempt to route packets + # that "obviously" do not belong to the iface's network; dropped packets are + # logged as martians). + boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true; + boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault true; + boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true; + boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault true; + + # Ignore broadcast ICMP (mitigate SMURF) + boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true; + + # Ignore route information from sender + boot.kernel.sysctl."net.ipv4.conf.all.accept_source_route" = mkDefault false; + boot.kernel.sysctl."net.ipv4.conf.default.accept_source_route" = mkDefault false; + boot.kernel.sysctl."net.ipv6.conf.all.accept_source_route" = mkDefault false; + boot.kernel.sysctl."net.ipv6.conf.default.accept_source_route" = mkDefault false; + + # Ignore incoming ICMP redirects (note: default is needed to ensure that the + # setting is applied to interfaces added after the sysctls are set) + boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false; + boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false; + boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false; + boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false; + boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false; + boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false; + + # Ignore outgoing ICMP redirects (this is ipv4 only) + boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false; + boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false; } |