nixos/hardened: harder inet defaults
See e.g., https://github.com/NixOS/nixpkgs/issues/63768 Forwarding remains enabled for now, need to determine its effects on virtualization, if any.
This commit is contained in:
parent
c233e24d54
commit
c3cc7034e2
|
@ -92,4 +92,34 @@ with lib;
|
||||||
|
|
||||||
# Disable ftrace debugging
|
# Disable ftrace debugging
|
||||||
boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
|
boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
|
||||||
|
|
||||||
|
# Enable reverse path filtering (that is, do not attempt to route packets
|
||||||
|
# that "obviously" do not belong to the iface's network; dropped packets are
|
||||||
|
# logged as martians).
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault true;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault true;
|
||||||
|
|
||||||
|
# Ignore broadcast ICMP (mitigate SMURF)
|
||||||
|
boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true;
|
||||||
|
|
||||||
|
# Ignore route information from sender
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.all.accept_source_route" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.default.accept_source_route" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv6.conf.all.accept_source_route" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv6.conf.default.accept_source_route" = mkDefault false;
|
||||||
|
|
||||||
|
# Ignore incoming ICMP redirects (note: default is needed to ensure that the
|
||||||
|
# setting is applied to interfaces added after the sysctls are set)
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false;
|
||||||
|
|
||||||
|
# Ignore outgoing ICMP redirects (this is ipv4 only)
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
|
||||||
|
boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue