nixos/upterm: additional hardening
Before:
$ ps aux | grep upterm
root 2575046 0.0 0.0 1085080
6968 ? Ssl 07:03 0:00 /nix/store/ci97r1lqx4128w75k7dcsw82j5bl0n3g-upterm-0.8.2/bin/uptermd --ssh-addr [::]:2323 --private-key ssh_host_ed25519_key
After
$ ps aux | grep upterm
uptermd 2832993 0.4 0.0 1158812 6856 ? Ssl 07:08 0:00 /nix/store/ci97r1lqx4128w75k7dcsw82j5bl0n3g-upterm-0.8.2/bin/uptermd --ssh-addr [::]:2323 --private-key ssh_host_ed25519_key
This commit is contained in:
parent
b419e38ea8
commit
eefafb54ef
@ -85,6 +85,7 @@ in
|
|||||||
AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
||||||
CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
|
||||||
PrivateUsers = cfg.port >= 1024;
|
PrivateUsers = cfg.port >= 1024;
|
||||||
|
DynamicUser = true;
|
||||||
LockPersonality = true;
|
LockPersonality = true;
|
||||||
MemoryDenyWriteExecute = true;
|
MemoryDenyWriteExecute = true;
|
||||||
PrivateDevices = true;
|
PrivateDevices = true;
|
||||||
@ -95,7 +96,9 @@ in
|
|||||||
ProtectKernelLogs = true;
|
ProtectKernelLogs = true;
|
||||||
ProtectKernelModules = true;
|
ProtectKernelModules = true;
|
||||||
ProtectKernelTunables = true;
|
ProtectKernelTunables = true;
|
||||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
ProtectProc = "invisible";
|
||||||
|
# AF_UNIX is for ssh-keygen, which relies on nscd to resolve the uid to a user
|
||||||
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||||
RestrictNamespaces = true;
|
RestrictNamespaces = true;
|
||||||
RestrictRealtime = true;
|
RestrictRealtime = true;
|
||||||
SystemCallArchitectures = "native";
|
SystemCallArchitectures = "native";
|
||||||
|
Loading…
Reference in New Issue
Block a user