V8.00.000.2025.06.17
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -87,8 +87,8 @@ exit:
|
||||
firmware:
|
||||
install: true # If non-free firmware is needed for the network or other hardware, autoinstall it.
|
||||
lookup: "missing" # - "never" Completely disables the firmware search.
|
||||
# - "missing" Searches only when the firmware is needed. (default)
|
||||
# - "always" Always searches and asks for any firmware that could be useful for the hardware.
|
||||
# - "missing" Searches only when the firmware is needed. (default)
|
||||
# - "always" Always searches and asks for any firmware that could be useful for the hardware.
|
||||
image: "linux-image-amd64" # Could be a meta-package or a specific image like:
|
||||
# "linux-image-amd64" || "linux-image-arm64"
|
||||
# "linux-image-cloud-amd64" || "linux-image-cloud-arm64"
|
||||
@@ -96,7 +96,303 @@ image: "linux-image-amd64" # Could be a meta-package or a specific image lik
|
||||
# "linux-image-6.12.30+bpo-amd64"
|
||||
|
||||
################################################################################################################################
|
||||
# GRUB2 settings
|
||||
# Dropbear settings
|
||||
################################################################################################################################
|
||||
dropbear:
|
||||
boot: true # Dropbear initramfs integration.
|
||||
dhcp: true # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
|
||||
firewall: false # Yet not implemented. MUST be "false".
|
||||
# Additional ultra hardening of the dropbear initramfs environment via firewall.
|
||||
# The "bastion_ipv4" MUST be provided.
|
||||
port: 42137 # SSH Port dropbear initramfs should listen.
|
||||
|
||||
################################################################################################################################
|
||||
# Grub Bootparameter
|
||||
################################################################################################################################
|
||||
grub_parameter:
|
||||
##############################################################################################################################
|
||||
# Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go
|
||||
# undetected. During boot if audit=1, then the backlog will hold 64 records. If more than 64 records are created during boot,
|
||||
# auditd records will be lost, and potential malicious activity could go undetected.
|
||||
##############################################################################################################################
|
||||
- "audit=1"
|
||||
- "audit_backlog_limit=8192"
|
||||
|
||||
##############################################################################################################################
|
||||
# Distrusts CPU bootloader for initial entropy at boot. Distrusts the CPU for initial entropy at boot, as it is not possible
|
||||
# to audit, may contain weaknesses or a backdoor.
|
||||
# https://en.wikipedia.org/wiki/RDRAND#Reception
|
||||
# https://twitter.com/pid_eins/status/1149649806056280069
|
||||
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||||
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
##############################################################################################################################
|
||||
- "random.trust_cpu=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# Distrusts the bootloader for initial entropy at boot.
|
||||
# https://lkml.org/lkml/2022/6/5/271
|
||||
##############################################################################################################################
|
||||
- "random.trust_bootloader=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# ASLR (Address Space Layout Randomization) causes central areas of memory to be assigned random addresses each time a program
|
||||
# is started. These include: Stack, Heap, Shared libraries (e.g., libc), mmap regions, VDSO/VSyscall. The executable itself
|
||||
# (only with PIE binaries). The aim is to make it more difficult for attackers to predict memory addresses, thereby preventing
|
||||
# classic exploits that rely on known addresses from succeeding.
|
||||
# 0: disabled Fixed memory addresses – insecure, testable.
|
||||
# 1: Partial ASLR Heap, mmap are randomized, stack only partially randomized.
|
||||
# 2: Full ASLR (default) Stack, mmap, heap, VDSO, shared libraries all randomized.
|
||||
##############################################################################################################################
|
||||
- "randomize_va_space=2"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables IOMMU to prevent DMA attacks. intel_iommu=on amd_iommu=force_isolation iommu=force
|
||||
# Multiple IOMMU switches are redundant; iommu=force is usually sufficient. Forces an IOMMU to be initialized and used
|
||||
# completely, even if the BIOS or ACPI wanted to disable it. It activates the basic DMA remapping function. However, it does
|
||||
# not say anything about how restrictive the mapping strategy is, 'passthrough', 'strict', see below.
|
||||
##############################################################################################################################
|
||||
- "iommu=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables strict enforcement of IOMMU TLB invalidation, so devices will never be able to access stale data contents. #
|
||||
# iommu.passthrough=0
|
||||
# Prevents devices from operating in identity-mapped passthrough mode. Without this parameter (or with =1), devices could be
|
||||
# passed through without being monitored by the IOMMU in a truly restrictive manner. From a security standpoint,
|
||||
# iommu.passthrough=0 is an important step toward DMA isolation for all devices, especially for untrusted PCI(e) devices. #
|
||||
# iommu.strict=1
|
||||
# Enables Strict Mode for dma-iommu.c (i.e., all DMA transactions are validated synchronously). Without this parameter, the
|
||||
# kernel often runs in lazy mode, where mapping caches are used.
|
||||
# Performance vs. security: strict=1= more secure, but potentially slower, especially with many small DMA transfers. #
|
||||
# https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97
|
||||
# Page 11 of https://lenovopress.lenovo.com/lp1467.pdf
|
||||
##############################################################################################################################
|
||||
- "iommu.passthrough=0"
|
||||
- "iommu.strict=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Disable the busmaster bit on all PCI bridges during very early boot to avoid holes in IOMMU. #
|
||||
# https://mjg59.dreamwidth.org/54433.html
|
||||
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||||
##############################################################################################################################
|
||||
- "efi=disable_early_pci_dma"
|
||||
|
||||
##############################################################################################################################
|
||||
# Disables the merging of slabs of similar sizes. Sometimes a slab can be used vulnerably, which an attacker can exploit.
|
||||
##############################################################################################################################
|
||||
- "slab_nomerge"
|
||||
|
||||
##############################################################################################################################
|
||||
# Zero memory at allocation and free time.
|
||||
##############################################################################################################################
|
||||
- "init_on_alloc=1"
|
||||
- "init_on_free=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# This option randomizes page allocator freelists, improving security by making page allocations less predictable. This also
|
||||
# improves performance.
|
||||
##############################################################################################################################
|
||||
- "page_alloc.shuffle=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# When releasing (i.e., free_pages()), all bytes with a marker value (e.g., 0xAA) are overwritten. If later code
|
||||
# (accidentally or maliciously) accesses this page, it will most likely crash or produce recognizable artifacts. Only
|
||||
# supported if the kernel was built with CONFIG_PAGE_POISONING=y (default on Debian: enabled since Bookworm).
|
||||
##############################################################################################################################
|
||||
- "page_poison=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR.
|
||||
##############################################################################################################################
|
||||
- "pti=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# The setting 'vsyscall' is obsolete, are at fixed addresses and are a target for ROP.
|
||||
##############################################################################################################################
|
||||
- "vsyscall=none"
|
||||
|
||||
##############################################################################################################################
|
||||
# The kernel adds a small random padding offset to the stack pointer with every system call or kernel entry. The starting
|
||||
# point for local variables is at a different position within the stack with every call. This makes ROP chains
|
||||
# (return-oriented programming) or stack pivoting attacks significantly more difficult.
|
||||
##############################################################################################################################
|
||||
- "randomize_kstack_offset=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Prevents the debugfsfile system from being made available at boot time. This is a useful hardening measure because debugfs
|
||||
# reveals a lot of potentially security-relevant kernel information by default, which can be misused by normal users and by
|
||||
# exploits.
|
||||
##############################################################################################################################
|
||||
- "debugfs=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# Force the kernel to panic on "oopses" (which may be due to false positives).
|
||||
# - 'panic=N' (e.g., 'panic=60'): Wait N seconds and then reboot.
|
||||
# - 'panic=0' No automatic action (System remains stuck in panic state).
|
||||
# - 'panic=-1' Also explicitly prevents any automatic reboot.
|
||||
##############################################################################################################################
|
||||
- "oops=panic"
|
||||
- "panic=-1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enable a subset of known mitigations for CPU vulnerabilities and disable SMT.
|
||||
# - 'mitigations=auto' Enables all available CPU-specific security measures based on the detected CPU, microcode version, and
|
||||
# kernel build configuration, if applicable.
|
||||
# - 'nosmt' Disables Simultaneous Multithreading (SMT) (e.g., Hyper-Threading on Intel) system-wide to prevent shared cache
|
||||
# attacks (SMoTHER, MDS, L1TF, TAA, Snoop-assisted).
|
||||
# Why is 'mitigations=auto,nosmt' better than setting everything manually?
|
||||
# Automatically adjusted: Depending on CPU family, stepping, microcode.
|
||||
# Consistency guaranteed: No contradictions between flags possible
|
||||
# (e.g., spec_store_bypass_disable=on vs. nospec_store_bypass_disable=off).
|
||||
# Future-proof: Even new features (e.g., bhi=flush or srbds) are automatically activated without having to know about them. #
|
||||
##############################################################################################################################
|
||||
- "mitigations=auto,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for both 'Spectre Variant 2' (indirect branch speculation) and Intel branch history injection (BHI)
|
||||
# vulnerabilities.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
||||
##############################################################################################################################
|
||||
#- "spectre_v2=on"
|
||||
#- "spectre_v2_user=on"
|
||||
#- "spectre_bhi=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Disable Speculative Store Bypass (Spectre Variant 4).
|
||||
# https://www.suse.com/support/kb/doc/?id=000019189
|
||||
##############################################################################################################################
|
||||
#- "spec_store_bypass_disable=on"
|
||||
#- "nospec_store_bypass_disable=off"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for the L1TF vulnerability through disabling SMT and L1D flush runtime control. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
||||
##############################################################################################################################
|
||||
#- "l1tf=full,force"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Enable mitigations for the MDS vulnerability through clearing buffer cache and disabling SMT. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
||||
##############################################################################################################################
|
||||
#- "mds=full,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||||
# Patches the TAA vulnerability by disabling TSX and enables mitigations using TSX Async Abort along with disabling SMT. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
||||
##############################################################################################################################
|
||||
#- "tsx=off"
|
||||
#- "tsx_async_abort=full,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html
|
||||
##############################################################################################################################
|
||||
- "kvm.nx_huge_pages=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Force disable SMT as it has caused numerous CPU vulnerabilities. The only full mitigation of cross-HT attacks is disabling. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||||
##############################################################################################################################
|
||||
- "nosmt=force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables the prctl interface to prevent leaks from L1D on context switches.
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
|
||||
##############################################################################################################################
|
||||
- "l1d_flush=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
|
||||
# mmio_stale_data=off No mitigation (unsafe)
|
||||
# mmio_stale_data=full All known measures active
|
||||
# mmio_stale_data=full,nosmt Full mitigation + SMT disabling
|
||||
# mmio_stale_data=auto Activated depending on CPU/microcode
|
||||
# mmio_stale_data=full,force Forces mitigation even on CPUs that are supposedly not affected. #
|
||||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||||
##############################################################################################################################
|
||||
- "mmio_stale_data=full,force"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with Return Instructions) vulnerability and disable
|
||||
# SMT. If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant mitigations, provided the CPU
|
||||
# is affected; 'retbleed=auto,nosmt' explicitly overrides the internal assessment and forces full protection. If maximum
|
||||
# hardening is required, and one does not want to rely on "auto-detection" then it is recommended to additionally set
|
||||
# 'retbleed=auto,nosmt' otherwise, 'mitigations=auto,nosmt' is sufficient.
|
||||
# https://www.suse.com/support/kb/doc/?id=000020693
|
||||
##############################################################################################################################
|
||||
- "retbleed=auto,nosmt"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables kernel lockdown mode with a focus on confidentiality. The kernel is configured in such a way that even privileged
|
||||
# users (such as root) have limited access to kernel data and debug mechanisms.
|
||||
# 'confidentiality': Maximum restriction to ensure the security and integrity of the system. This prevents direct access to
|
||||
# hardware and debug interfaces, for example. Useful for highly secure environments as it reduces the attack surface to kernel
|
||||
# data. However, some applications that require debugging or hardware access may have problems. #
|
||||
# https://blog.cloudflare.com/de-de/linux-kernel-hardening/
|
||||
# https://www.linux-magazine.com/Issues/2020/239/Lockdown-Mode
|
||||
##############################################################################################################################
|
||||
- "lockdown=confidentiality"
|
||||
|
||||
##############################################################################################################################
|
||||
# Enables 'Read-Only Data Protection', which implements read-only memory areas for kernel data structures. This protects the
|
||||
# kernel from certain types of exploit (e.g., buffer overflows). 'on': Forces the corresponding areas to remain read-only.
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html #
|
||||
##############################################################################################################################
|
||||
- "rodata=on"
|
||||
|
||||
##############################################################################################################################
|
||||
# Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety error detector. KFENCE detects heap
|
||||
# out-of-bounds access, use-after-free, and invalid-free errors. KFENCE is designed to be enabled in production kernels, and
|
||||
# has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind
|
||||
# KFENCE design is that with enough total uptime, KFENCE will detect bugs in code paths not typically exercised by
|
||||
# non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a
|
||||
# large fleet of machines.
|
||||
# https://docs.kernel.org/dev-tools/kfence.html
|
||||
##############################################################################################################################
|
||||
- "kfence.sample_interval=100"
|
||||
|
||||
##############################################################################################################################
|
||||
# CFI Ensures that only controlled, predefined transitions are possible in the programs' control flow.
|
||||
# kcfi (Kernel Control Flow Integrity): Specific implementation of CFI for the Linux kernel that is particularly robust and
|
||||
# provides accurate control flow validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special
|
||||
# checks and instrumentation into the kernel code.
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
##############################################################################################################################
|
||||
- "cfi=kcfi"
|
||||
|
||||
##############################################################################################################################
|
||||
# Remove additional (32-bit) attack surface, unless you really need them.
|
||||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html
|
||||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||||
##############################################################################################################################
|
||||
- "ia32_emulation=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# Removes mapping for 32-bit VDSO (for ia32binaries). On 32-bit processes that rely on VDSO, this causes a fallback to classic
|
||||
# syscalls (slower) or errors. On a system without CONFIG_IA32_EMULATION or with ia32_emulation=0, vdso32=0 is effective but
|
||||
# redundant.
|
||||
##############################################################################################################################
|
||||
- "vdso32=0"
|
||||
|
||||
##############################################################################################################################
|
||||
# Checks every copy_to_user() / copy_from_user()operation. Prevents kernels from accidentally copying unallocated memory to
|
||||
# userspace. Stop exploits that trigger buffer overflows or use-after-free via copy_*_user(), for example. Effect: Detects
|
||||
# heap/SLOB abuse, overwrites. Leads to BUG() & stack trace if suspicious access is detected. #
|
||||
##############################################################################################################################
|
||||
- "hardened_usercopy=1"
|
||||
|
||||
##############################################################################################################################
|
||||
# Sets the minimum log output of the kernel at boot time to level 0 (= KERN_EMERG).
|
||||
##############################################################################################################################
|
||||
- "loglevel=0"
|
||||
|
||||
################################################################################################################################
|
||||
# Grub settings
|
||||
################################################################################################################################
|
||||
grub:
|
||||
background: # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
|
||||
@@ -367,63 +663,23 @@ ntp:
|
||||
timezone: "Europe/Lisbon" # Any valid setting for $TZ; see the contents of '/usr/share/zoneinfo' for valid values.
|
||||
utc: true # Controls whether the hardware clock is set to UTC.
|
||||
|
||||
|
||||
################################################################################################################################
|
||||
# Dropbear settings
|
||||
################################################################################################################################
|
||||
dropbear:
|
||||
boot: true # Dropbear initramfs integration.
|
||||
dhcp: true # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
|
||||
firewall: false # Yet not implemented. MUST be "false".
|
||||
# Additional ultra hardening of the dropbear initramfs environment via firewall.
|
||||
# The "bastion_ipv4" MUST be provided.
|
||||
port: 42137 # SSH Port dropbear initramfs should listen.
|
||||
|
||||
################################################################################################################################
|
||||
# SSH settings
|
||||
################################################################################################################################
|
||||
ssh:
|
||||
allow_hardening: true # For additional hardening of SSH connections via TCP wrapper: '/etc/hosts.allow'.
|
||||
# If "allow_policies" = "true", at least one 'bastion_ipv4' MUST be provided.
|
||||
# One or multiple Domains could be provided as well via 'allow_domain'.
|
||||
|
||||
allow_domain:
|
||||
- vpn00.x448.eu
|
||||
allow_ipv4:
|
||||
# If "allow_hardening" = "true", at least one 'allow_ipv4' MUST be provided.
|
||||
allow_ipv4: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv4.
|
||||
- 202.61.246.50
|
||||
allow_ipv6:
|
||||
allow_ipv6: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv6.
|
||||
- 2a03:4000:53:f:abcd:9494:0:2
|
||||
port: 42137
|
||||
port: 42137 # SSH Port.
|
||||
root_ca: "/.preseed/ssh_root_ca.pub"
|
||||
|
||||
################################################################################################################################
|
||||
# Grub Bootparameter
|
||||
################################################################################################################################
|
||||
grub_parameter:
|
||||
- "audit=1 audit_backlog_limit=8192"
|
||||
- "random.trust_cpu=off"
|
||||
|
||||
################################################################################################################################
|
||||
# User settings
|
||||
################################################################################################################################
|
||||
user:
|
||||
allow_policies: true # For additional hardening of SSH connections '/etc/hosts.allow'.
|
||||
# If "allow_policies" = "true", at least one 'bastion_ipv4' MUST be provided.
|
||||
# One or multiple Domains could be provided as well 'allow_domain'.
|
||||
bastion_enable: false # In case 'bastion_ipv4' and 'bastion_ipv6' are SSH Bastion IPs set this to "true".
|
||||
# If these are Jump Server and / or static VPN-Exit-Nodes, set this to "false".
|
||||
bastion_ipv4: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv4.
|
||||
- 202.61.246.50
|
||||
bastion_ipv6: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv6.
|
||||
- 2a03:4000:53:f:abcd:9494:0:2
|
||||
allow_domain: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes Domains.
|
||||
- vpn00.x448.eu
|
||||
|
||||
|
||||
|
||||
ssh_port: 42137 # SSH Port. In case "dropbear_boot" = "true" the same SSH Port will be used.
|
||||
ssh_rootca: "/.preseed/ssh_root_ca.pub"
|
||||
|
||||
##############################################################################################################################
|
||||
# root – Superuser account (normally disabled for direct login)
|
||||
##############################################################################################################################
|
||||
@@ -482,9 +738,9 @@ user:
|
||||
restricted: false # If true, user is limited in scope (e.g., no login, no file access).
|
||||
shell_access: true # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.
|
||||
|
||||
################################################################################
|
||||
##############################################################################################################################
|
||||
# ansible – System user for automation, no interactive shell
|
||||
################################################################################
|
||||
##############################################################################################################################
|
||||
user1:
|
||||
ensure: present # "present" = create user; "absent" = remove user
|
||||
protected: true # Prevent unintentional edits or deletions.
|
||||
|
||||
Reference in New Issue
Block a user