94ab6043e7
Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.
53 lines
2.1 KiB
Plaintext
53 lines
2.1 KiB
Plaintext
# Arcline OS — kernel hardening (sysctl)
|
|
# Applies to every edition via the base overlay. Conservative defaults;
|
|
# the workstation edition relaxes a couple of entries (see overlays/workstation).
|
|
|
|
# ── memory ──────────────────────────────────────────────────────────────────
|
|
vm.swappiness=10
|
|
vm.overcommit_memory=2
|
|
vm.dirty_ratio=5
|
|
vm.dirty_background_ratio=2
|
|
|
|
# ── networking ──────────────────────────────────────────────────────────────
|
|
# strict reverse-path filtering
|
|
net.ipv4.conf.all.rp_filter=1
|
|
net.ipv4.conf.default.rp_filter=1
|
|
# no ICMP redirects
|
|
net.ipv4.conf.all.accept_redirects=0
|
|
net.ipv4.conf.default.accept_redirects=0
|
|
net.ipv4.conf.all.secure_redirects=0
|
|
net.ipv4.conf.default.secure_redirects=0
|
|
net.ipv4.conf.all.send_redirects=0
|
|
net.ipv4.conf.default.send_redirects=0
|
|
net.ipv6.conf.all.accept_redirects=0
|
|
net.ipv6.conf.default.accept_redirects=0
|
|
# ICMP hardening
|
|
net.ipv4.icmp_echo_ignore_broadcasts=1
|
|
net.ipv4.icmp_ignore_bogus_error_responses=1
|
|
# TCP hardening
|
|
net.ipv4.tcp_syncookies=1
|
|
net.ipv4.tcp_rfc1337=1
|
|
net.ipv4.tcp_timestamps=0
|
|
net.ipv4.conf.all.log_martians=1
|
|
net.ipv4.conf.default.log_martians=1
|
|
# IPv6: don't auto-accept router advertisements
|
|
net.ipv6.conf.all.accept_ra=0
|
|
net.ipv6.conf.default.accept_ra=0
|
|
|
|
# ── kernel / visibility ─────────────────────────────────────────────────────
|
|
kernel.dmesg_restrict=1
|
|
kernel.kptr_restrict=2
|
|
kernel.perf_event_paranoid=3
|
|
kernel.yama.ptrace_scope=1
|
|
kernel.core_uses_pid=1
|
|
kernel.unprivileged_bpf_disabled=1
|
|
kernel.randomize_va_space=2
|
|
kernel.sysrq=4
|
|
|
|
# ── filesystem hardening ────────────────────────────────────────────────────
|
|
fs.protected_hardlinks=1
|
|
fs.protected_symlinks=1
|
|
fs.protected_fifos=2
|
|
fs.protected_regular=2
|
|
fs.suid_dumpable=0
|