GCE image: Remove some unnecessary lib prefixes.
This commit is contained in:
parent
80202fbd25
commit
cbb14299c9
|
@ -8,7 +8,7 @@ in
|
|||
imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
|
||||
|
||||
# https://cloud.google.com/compute/docs/tutorials/building-images
|
||||
networking.firewall.enable = lib.mkDefault false;
|
||||
networking.firewall.enable = mkDefault false;
|
||||
|
||||
system.build.googleComputeImage =
|
||||
pkgs.vmTools.runInLinuxVM (
|
||||
|
@ -112,7 +112,7 @@ in
|
|||
# at instance creation time.
|
||||
services.openssh.enable = true;
|
||||
services.openssh.permitRootLogin = "without-password";
|
||||
services.openssh.passwordAuthentication = false;
|
||||
services.openssh.passwordAuthentication = mkDefault false;
|
||||
|
||||
# Force getting the hostname from Google Compute.
|
||||
networking.hostName = mkDefault "";
|
||||
|
@ -188,73 +188,73 @@ in
|
|||
# Setings taken from https://cloud.google.com/compute/docs/tutorials/building-images#providedkernel
|
||||
boot.kernel.sysctl = {
|
||||
# enables syn flood protection
|
||||
"net.ipv4.tcp_syncookies" = lib.mkDefault "1";
|
||||
"net.ipv4.tcp_syncookies" = mkDefault "1";
|
||||
|
||||
# ignores source-routed packets
|
||||
"net.ipv4.conf.all.accept_source_route" = lib.mkDefault "0";
|
||||
"net.ipv4.conf.all.accept_source_route" = mkDefault "0";
|
||||
|
||||
# ignores source-routed packets
|
||||
"net.ipv4.conf.default.accept_source_route" = lib.mkDefault "0";
|
||||
"net.ipv4.conf.default.accept_source_route" = mkDefault "0";
|
||||
|
||||
# ignores ICMP redirects
|
||||
"net.ipv4.conf.all.accept_redirects" = lib.mkDefault "0";
|
||||
"net.ipv4.conf.all.accept_redirects" = mkDefault "0";
|
||||
|
||||
# ignores ICMP redirects
|
||||
"net.ipv4.conf.default.accept_redirects" = lib.mkDefault "0";
|
||||
"net.ipv4.conf.default.accept_redirects" = mkDefault "0";
|
||||
|
||||
# ignores ICMP redirects from non-GW hosts
|
||||
"net.ipv4.conf.all.secure_redirects" = lib.mkDefault "1";
|
||||
"net.ipv4.conf.all.secure_redirects" = mkDefault "1";
|
||||
|
||||
# ignores ICMP redirects from non-GW hosts
|
||||
"net.ipv4.conf.default.secure_redirects" = lib.mkDefault "1";
|
||||
"net.ipv4.conf.default.secure_redirects" = mkDefault "1";
|
||||
|
||||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.ip_forward" = lib.mkDefault "0";
|
||||
"net.ipv4.ip_forward" = mkDefault "0";
|
||||
|
||||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.conf.all.send_redirects" = lib.mkDefault "0";
|
||||
"net.ipv4.conf.all.send_redirects" = mkDefault "0";
|
||||
|
||||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.conf.default.send_redirects" = lib.mkDefault "0";
|
||||
"net.ipv4.conf.default.send_redirects" = mkDefault "0";
|
||||
|
||||
# reverse path filtering - IP spoofing protection
|
||||
"net.ipv4.conf.all.rp_filter" = lib.mkDefault "1";
|
||||
"net.ipv4.conf.all.rp_filter" = mkDefault "1";
|
||||
|
||||
# reverse path filtering - IP spoofing protection
|
||||
"net.ipv4.conf.default.rp_filter" = lib.mkDefault "1";
|
||||
"net.ipv4.conf.default.rp_filter" = mkDefault "1";
|
||||
|
||||
# ignores ICMP broadcasts to avoid participating in Smurf attacks
|
||||
"net.ipv4.icmp_echo_ignore_broadcasts" = lib.mkDefault "1";
|
||||
"net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
|
||||
|
||||
# ignores bad ICMP errors
|
||||
"net.ipv4.icmp_ignore_bogus_error_responses" = lib.mkDefault "1";
|
||||
"net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
|
||||
|
||||
# logs spoofed, source-routed, and redirect packets
|
||||
"net.ipv4.conf.all.log_martians" = lib.mkDefault "1";
|
||||
"net.ipv4.conf.all.log_martians" = mkDefault "1";
|
||||
|
||||
# log spoofed, source-routed, and redirect packets
|
||||
"net.ipv4.conf.default.log_martians" = lib.mkDefault "1";
|
||||
"net.ipv4.conf.default.log_martians" = mkDefault "1";
|
||||
|
||||
# implements RFC 1337 fix
|
||||
"net.ipv4.tcp_rfc1337" = lib.mkDefault "1";
|
||||
"net.ipv4.tcp_rfc1337" = mkDefault "1";
|
||||
|
||||
# randomizes addresses of mmap base, heap, stack and VDSO page
|
||||
"kernel.randomize_va_space" = lib.mkDefault "2";
|
||||
"kernel.randomize_va_space" = mkDefault "2";
|
||||
|
||||
# provides protection from ToCToU races
|
||||
"fs.protected_hardlinks" = lib.mkDefault "1";
|
||||
"fs.protected_hardlinks" = mkDefault "1";
|
||||
|
||||
# provides protection from ToCToU races
|
||||
"fs.protected_symlinks" = lib.mkDefault "1";
|
||||
"fs.protected_symlinks" = mkDefault "1";
|
||||
|
||||
# makes locating kernel addresses more difficult
|
||||
"kernel.kptr_restrict" = lib.mkDefault "1";
|
||||
"kernel.kptr_restrict" = mkDefault "1";
|
||||
|
||||
# set ptrace protections
|
||||
"kernel.yama.ptrace_scope" = lib.mkDefault "1";
|
||||
"kernel.yama.ptrace_scope" = mkDefault "1";
|
||||
|
||||
# set perf only available to root
|
||||
"kernel.perf_event_paranoid" = lib.mkDefault "2";
|
||||
"kernel.perf_event_paranoid" = mkDefault "2";
|
||||
|
||||
};
|
||||
|
||||
|
|
Loading…
Reference in a new issue