hiro/phoebe
1
0
Fork 0
mirror of https://github.com/vale981/phoebe synced 2025-03-04 17:31:41 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: Some settings should always be enabled

Browse source 
Even if Phoebe security is off, force some settings to be on.  These
are settings that are appropriate even for developer testing VMs.
This commit is contained in:
Peter Jones 2018-12-20 16:54:36 -07:00
parent 9745341307
commit b9061e43a4
No known key found for this signature in database
GPG key ID: 9DAFAA8D01941E49
1 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
modules/security/default.nix
View file

@ -23,11 +23,28 @@ in
#### Implementation
config = mkMerge [
############################################################################
# Things to disable when not using security settings:
(mkIf (!cfg.enable) {
# Only really useful for development VMs:
networking.firewall.enable = false;
})
############################################################################
# Settings that are always enabled:
{
# Users must be created in Nix:
users.mutableUsers = false;
# Don't require or use any passwords:
security.pam.enableSSHAgentAuth = true;
services.openssh.passwordAuthentication = false;
services.openssh.permitRootLogin = "without-password";
}
############################################################################
# Settings to enable when security is enabled:
(mkIf cfg.enable {
# Firewall:
networking.firewall = {
@ -36,6 +53,14 @@ in
pingLimit = "--limit 1/minute --limit-burst 5";
allowedTCPPorts = config.services.openssh.ports;
};
# SSH and authentication:
services.openssh.forwardX11 = false;
services.openssh.openFirewall = false; # Done above.
# Run-time kernel modifications:
# FIXME: enable after some testing.
# security.lockKernelModules = true;
})
];
}