43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
# §37.3 — Kernel sysctl hardening.
|
|
---
|
|
- name: Deploy sysctl hardening drop-in
|
|
ansible.builtin.copy:
|
|
dest: /etc/sysctl.d/99-morphit-hardening.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
# Managed by Ansible — see OPERATIONS.md §37.3 for rationale.
|
|
# Network
|
|
net.ipv4.ip_forward = 0
|
|
net.ipv4.conf.all.send_redirects = 0
|
|
net.ipv4.conf.default.send_redirects = 0
|
|
net.ipv4.conf.all.accept_redirects = 0
|
|
net.ipv4.conf.default.accept_redirects = 0
|
|
net.ipv6.conf.all.accept_redirects = 0
|
|
net.ipv6.conf.default.accept_redirects = 0
|
|
net.ipv4.conf.all.secure_redirects = 0
|
|
net.ipv4.conf.default.secure_redirects = 0
|
|
net.ipv4.conf.all.accept_source_route = 0
|
|
net.ipv4.conf.default.accept_source_route = 0
|
|
net.ipv6.conf.all.accept_source_route = 0
|
|
net.ipv6.conf.default.accept_source_route = 0
|
|
net.ipv4.conf.all.log_martians = 1
|
|
net.ipv4.conf.default.log_martians = 1
|
|
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
|
net.ipv4.icmp_ignore_bogus_error_responses = 1
|
|
net.ipv4.tcp_syncookies = 1
|
|
net.ipv4.conf.all.rp_filter = 1
|
|
net.ipv4.conf.default.rp_filter = 1
|
|
# Kernel
|
|
kernel.kptr_restrict = 2
|
|
kernel.dmesg_restrict = 1
|
|
kernel.unprivileged_bpf_disabled = 1
|
|
kernel.yama.ptrace_scope = 1
|
|
kernel.randomize_va_space = 2
|
|
fs.protected_hardlinks = 1
|
|
fs.protected_symlinks = 1
|
|
fs.protected_fifos = 2
|
|
fs.protected_regular = 2
|
|
fs.suid_dumpable = 0
|
|
notify: Apply sysctl
|