google-compute-config.nix: use sysctl snippets from gce
We make them available at ${gce}/sysctl.d and add them to environments.etc, like we do with the systemd ones.
This commit is contained in:
parent
d658dd4ce0
commit
e95d4c734a
|
@ -144,81 +144,5 @@ in
|
|||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
|
||||
# Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
|
||||
boot.kernel.sysctl = {
|
||||
# Turn on SYN-flood protections. Starting with 2.6.26, there is no loss
|
||||
# of TCP functionality/features under normal conditions. When flood
|
||||
# protections kick in under high unanswered-SYN load, the system
|
||||
# should remain more stable, with a trade off of some loss of TCP
|
||||
# functionality/features (e.g. TCP Window scaling).
|
||||
"net.ipv4.tcp_syncookies" = mkDefault "1";
|
||||
|
||||
# ignores ICMP redirects
|
||||
"net.ipv4.conf.all.accept_redirects" = mkDefault "0";
|
||||
|
||||
# ignores ICMP redirects
|
||||
"net.ipv4.conf.default.accept_redirects" = mkDefault "0";
|
||||
|
||||
# ignores ICMP redirects from non-GW hosts
|
||||
"net.ipv4.conf.all.secure_redirects" = mkDefault "1";
|
||||
|
||||
# ignores ICMP redirects from non-GW hosts
|
||||
"net.ipv4.conf.default.secure_redirects" = mkDefault "1";
|
||||
|
||||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.ip_forward" = mkDefault "0";
|
||||
|
||||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.conf.all.send_redirects" = mkDefault "0";
|
||||
|
||||
# don't allow traffic between networks or act as a router
|
||||
"net.ipv4.conf.default.send_redirects" = mkDefault "0";
|
||||
|
||||
# strict reverse path filtering - IP spoofing protection
|
||||
"net.ipv4.conf.all.rp_filter" = mkDefault "1";
|
||||
|
||||
# strict path filtering - IP spoofing protection
|
||||
"net.ipv4.conf.default.rp_filter" = mkDefault "1";
|
||||
|
||||
# ignores ICMP broadcasts to avoid participating in Smurf attacks
|
||||
"net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
|
||||
|
||||
# ignores bad ICMP errors
|
||||
"net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
|
||||
|
||||
# logs spoofed, source-routed, and redirect packets
|
||||
"net.ipv4.conf.all.log_martians" = mkDefault "1";
|
||||
|
||||
# log spoofed, source-routed, and redirect packets
|
||||
"net.ipv4.conf.default.log_martians" = mkDefault "1";
|
||||
|
||||
# implements RFC 1337 fix
|
||||
"net.ipv4.tcp_rfc1337" = mkDefault "1";
|
||||
|
||||
# randomizes addresses of mmap base, heap, stack and VDSO page
|
||||
"kernel.randomize_va_space" = mkDefault "2";
|
||||
|
||||
# Reboot the machine soon after a kernel panic.
|
||||
"kernel.panic" = mkDefault "10";
|
||||
|
||||
## Not part of the original config
|
||||
|
||||
# provides protection from ToCToU races
|
||||
"fs.protected_hardlinks" = mkDefault "1";
|
||||
|
||||
# provides protection from ToCToU races
|
||||
"fs.protected_symlinks" = mkDefault "1";
|
||||
|
||||
# makes locating kernel addresses more difficult
|
||||
"kernel.kptr_restrict" = mkDefault "1";
|
||||
|
||||
# set ptrace protections
|
||||
"kernel.yama.ptrace_scope" = mkOverride 500 "1";
|
||||
|
||||
# set perf only available to root
|
||||
"kernel.perf_event_paranoid" = mkDefault "2";
|
||||
|
||||
};
|
||||
|
||||
environment.etc."sysctl.d/11-gce-network-security.conf".source = "${gce}/sysctl.d/11-gce-network-security.conf";
|
||||
}
|
||||
|
|
|
@ -46,6 +46,10 @@ buildPythonApplication rec {
|
|||
mkdir -p $out/lib/udev/rules.d
|
||||
cp -r google_config/udev/*.rules $out/lib/udev/rules.d
|
||||
|
||||
# sysctl snippets will be used by google-compute-config.nix
|
||||
mkdir -p $out/sysctl.d
|
||||
cp google_config/sysctl/*.conf $out/sysctl.d
|
||||
|
||||
patchShebangs $out/bin/*
|
||||
'';
|
||||
|
||||
|
|
Loading…
Reference in a new issue