b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

GCE image: Add some recommended sysctl settings. Disable OS level firewall by default for GCE images (GCE provides external firewall). Disable passwordAuthentication. Related to issue #6991.

Browse source
This commit is contained in:
Rob Vermaas 2015-03-26 09:09:18 +00:00
parent 8feda47bee
commit 80202fbd25
1 changed files with 80 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

81
nixos/modules/virtualisation/google-compute-image.nix
View file

@ -7,6 +7,9 @@ in
{
imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
# https://cloud.google.com/compute/docs/tutorials/building-images
networking.firewall.enable = lib.mkDefault false;
system.build.googleComputeImage =
pkgs.vmTools.runInLinuxVM (
pkgs.runCommand "google-compute-image"
@ -95,6 +98,7 @@ in
boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
boot.initrd.kernelModules = [ "virtio_scsi" ];
boot.kernelModules = [ "virtio_pci" "virtio_net" ];
# Generate a GRUB menu. Amazon's pv-grub uses this to boot our kernel/initrd.
boot.loader.grub.device = "/dev/sda";
@ -108,6 +112,7 @@ in
# at instance creation time.
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.passwordAuthentication = false;
# Force getting the hostname from Google Compute.
networking.hostName = mkDefault "";
@ -178,5 +183,79 @@ in
serviceConfig.RemainAfterExit = true;
serviceConfig.StandardError = "journal+console";
serviceConfig.StandardOutput = "journal+console";
};
};
# Setings taken from https://cloud.google.com/compute/docs/tutorials/building-images#providedkernel
boot.kernel.sysctl = {
# enables syn flood protection
"net.ipv4.tcp_syncookies" = lib.mkDefault "1";
# ignores source-routed packets
"net.ipv4.conf.all.accept_source_route" = lib.mkDefault "0";
# ignores source-routed packets
"net.ipv4.conf.default.accept_source_route" = lib.mkDefault "0";
# ignores ICMP redirects
"net.ipv4.conf.all.accept_redirects" = lib.mkDefault "0";
# ignores ICMP redirects
"net.ipv4.conf.default.accept_redirects" = lib.mkDefault "0";
# ignores ICMP redirects from non-GW hosts
"net.ipv4.conf.all.secure_redirects" = lib.mkDefault "1";
# ignores ICMP redirects from non-GW hosts
"net.ipv4.conf.default.secure_redirects" = lib.mkDefault "1";
# don't allow traffic between networks or act as a router
"net.ipv4.ip_forward" = lib.mkDefault "0";
# don't allow traffic between networks or act as a router
"net.ipv4.conf.all.send_redirects" = lib.mkDefault "0";
# don't allow traffic between networks or act as a router
"net.ipv4.conf.default.send_redirects" = lib.mkDefault "0";
# reverse path filtering - IP spoofing protection
"net.ipv4.conf.all.rp_filter" = lib.mkDefault "1";
# reverse path filtering - IP spoofing protection
"net.ipv4.conf.default.rp_filter" = lib.mkDefault "1";
# ignores ICMP broadcasts to avoid participating in Smurf attacks
"net.ipv4.icmp_echo_ignore_broadcasts" = lib.mkDefault "1";
# ignores bad ICMP errors
"net.ipv4.icmp_ignore_bogus_error_responses" = lib.mkDefault "1";
# logs spoofed, source-routed, and redirect packets
"net.ipv4.conf.all.log_martians" = lib.mkDefault "1";
# log spoofed, source-routed, and redirect packets
"net.ipv4.conf.default.log_martians" = lib.mkDefault "1";
# implements RFC 1337 fix
"net.ipv4.tcp_rfc1337" = lib.mkDefault "1";
# randomizes addresses of mmap base, heap, stack and VDSO page
"kernel.randomize_va_space" = lib.mkDefault "2";
# provides protection from ToCToU races
"fs.protected_hardlinks" = lib.mkDefault "1";
# provides protection from ToCToU races
"fs.protected_symlinks" = lib.mkDefault "1";
# makes locating kernel addresses more difficult
"kernel.kptr_restrict" = lib.mkDefault "1";
# set ptrace protections
"kernel.yama.ptrace_scope" = lib.mkDefault "1";
# set perf only available to root
"kernel.perf_event_paranoid" = lib.mkDefault "2";
};
}