94ab6043e7
Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.
25 lines
630 B
Plaintext
25 lines
630 B
Plaintext
# Arcline OS — ssh hardening
|
|
# Secure by default: key-based auth only, root login via key only.
|
|
# To allow password auth, comment the PasswordAuthentication line — you opt
|
|
# in to exposure, never out.
|
|
#
|
|
# Matches Debian's drop-in semantics (Read drop-ins from sshd_config.d).
|
|
|
|
# authentication
|
|
PermitRootLogin prohibit-password
|
|
PubkeyAuthentication yes
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
PermitEmptyPasswords no
|
|
MaxAuthTries 3
|
|
LoginGraceTime 30
|
|
|
|
# session hardening
|
|
X11Forwarding no
|
|
AllowTcpForwarding yes
|
|
AllowAgentForwarding yes
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
TCPKeepAlive no
|
|
UseDNS no
|