diff options
| author | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-03-20 19:16:32 +0100 |
|---|---|---|
| committer | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-03-20 19:16:32 +0100 |
| commit | 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 (patch) | |
| tree | 9221704f413398cfb5d5759083b1e7032566820e /straper/db/public/kernel/sysctl.d | |
| parent | 6b59b75c3a294060dea66bdee16ffaf95ae92889 (diff) | |
| download | bin-39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2.tar.gz bin-39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2.zip | |
feat: first fully successful run e2e on straper
Diffstat (limited to 'straper/db/public/kernel/sysctl.d')
| -rw-r--r-- | straper/db/public/kernel/sysctl.d/99-hardening.conf | 54 | ||||
| -rw-r--r-- | straper/db/public/kernel/sysctl.d/99-wireguard.conf | 7 | ||||
| -rw-r--r-- | straper/db/public/kernel/sysctl.d/README.sysctl | 6 |
3 files changed, 67 insertions, 0 deletions
diff --git a/straper/db/public/kernel/sysctl.d/99-hardening.conf b/straper/db/public/kernel/sysctl.d/99-hardening.conf new file mode 100644 index 0000000..87d036c --- /dev/null +++ b/straper/db/public/kernel/sysctl.d/99-hardening.conf @@ -0,0 +1,54 @@ +# ---------------------------- +# Kernel hardening baseline +# ---------------------------- + +# Kernel pointer & info leaks +kernel.kptr_restrict = 2 +kernel.dmesg_restrict = 1 +kernel.perf_event_paranoid = 3 + +# Protect against memory corruption exploits +kernel.randomize_va_space = 2 +vm.mmap_min_addr = 65536 + +# Disable magic SysRq +kernel.sysrq = 0 + +# Restrict kernel logs +kernel.printk = 3 3 3 3 + +# Protect links & proc +fs.protected_hardlinks = 1 +fs.protected_symlinks = 1 +fs.protected_fifos = 2 +fs.protected_regular = 2 + +# Disable unprivileged user namespaces (major exploit class) +kernel.unprivileged_userns_clone = 0 + +# Block ptrace attacks +kernel.yama.ptrace_scope = 2 + +# Networking hardening +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 +net.ipv4.conf.all.send_redirects = 0 +net.ipv4.conf.default.send_redirects = 0 +net.ipv4.conf.all.accept_source_route = 0 +net.ipv4.conf.default.accept_source_route = 0 +net.ipv4.conf.all.log_martians = 1 +net.ipv4.conf.default.log_martians = 1 +net.ipv4.icmp_ignore_bogus_error_responses = 1 +net.ipv4.tcp_syncookies = 1 + +# NAT compatibility +net.ipv4.conf.all.rp_filter = 0 +net.ipv4.conf.default.rp_filter = 0 +net.ipv4.conf.enx00e04c2e4828.rp_filter = 0 + +# Disable unprivileged BPF +kernel.unprivileged_bpf_disabled = 1 + +# Restrict kernel tracing +kernel.ftrace_enabled = 0 + diff --git a/straper/db/public/kernel/sysctl.d/99-wireguard.conf b/straper/db/public/kernel/sysctl.d/99-wireguard.conf new file mode 100644 index 0000000..c9fa562 --- /dev/null +++ b/straper/db/public/kernel/sysctl.d/99-wireguard.conf @@ -0,0 +1,7 @@ +net.ipv4.ip_forward=1 +net.ipv4.conf.all.rp_filter=0 +net.ipv4.conf.default.rp_filter=0 +net.ipv4.conf.wg0.rp_filter=0 +net.ipv4.conf.enx00e04c2e4828.rp_filter=0 +net.ipv6.conf.wg0.disable_ipv6=1 + diff --git a/straper/db/public/kernel/sysctl.d/README.sysctl b/straper/db/public/kernel/sysctl.d/README.sysctl new file mode 100644 index 0000000..0d3eca6 --- /dev/null +++ b/straper/db/public/kernel/sysctl.d/README.sysctl @@ -0,0 +1,6 @@ +Files located in this directory can set kernel parameters using the +sysctl(8) or systemd-sysctl(8) tool which is typically run with a +unit/init file started during the boot sequence. + +For details regarding the configuration files refer to +sysctl.d(5) or sysctl.conf(5) |