forked from TommyTran732/Fedora-CoreOS-Ignition
-
Notifications
You must be signed in to change notification settings - Fork 0
/
UTM-Chrony.yml
220 lines (215 loc) · 10.2 KB
/
UTM-Chrony.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
# Copyright (C) 2021-2024 Thien Tran
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License. You may obtain a copy of
# the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations under
# the License.
variant: fcos
version: 1.5.0
passwd:
users:
- name: tomster
ssh_authorized_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINkTKkJS7Id1WCyA5Klu/moLG9mP5hTC+v2qYqypMF1u [email protected]
groups:
- wheel
- sudo
systemd:
units:
- name: postinst.service
enabled: true
contents: |
[Unit]
Description=Initial System Setup
# We run after `systemd-machine-id-commit.service` to ensure that
# `ConditionFirstBoot=true` services won't rerun on the next boot.
After=systemd-machine-id-commit.service
After=network-online.target
# We run before `zincati.service` to avoid conflicting rpm-ostree
# transactions.
Before=zincati.service
ConditionPathExists=!/var/lib/%N.stamp
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/restorecon -R /var
ExecStart=/usr/sbin/setsebool -P container_use_cephfs off
ExecStart=/usr/sbin/setsebool -P virt_use_nfs off
ExecStart=/usr/sbin/setsebool -P virt_use_samba off
ExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound
ExecStart=/usr/bin/rpm-ostree override bind-license bind-utils bind-libs brcmfmac-firmware intel-gpu-firmware mt7xxx-firmware atheros-firmware amd-ucode-firmware linux-firmware amd-gpu-firmware realtek-firmware btrfs-progs cifs-utils clevis clevis-dracut clevis-luks clevis-pin-tpm2 clevis-systemd containerd containers-common-extra crun crun-wasm cryptsetup dnsmasq e2fsprogs-libs e2fsprogs flatpak-session-helper fuse-overlayfs fuse-sshfs fuse3 fwupd google-compute-engine-guest-configs-udev iptables-legacy iptables-legacy-libs kexec-tools libnvme lvm2 lvm2-libs mdadm moby-engine nvme-cli podman rsync runc samba-client-libs samba-common libwbclient libsmbclient samba-common-libs socat sssd-client sssd-ldap sssd-common sssd-krb5-common sssd-nfs-idmap sssd-ad sssd-krb5 sssd-ipa sssd-common-pac systemd-resolved toolbox tpm2-tools tpm2-tss-fapi vim-data vim-minimal wireguard-tools
ExecStart=/usr/bin/sed -i 's/\s+nullok//g' /etc/pam.d/system-auth
ExecStart=/usr/bin/sed -i '$ a\allow 10.0.2.2/32' /etc/chrony.conf
ExecStart=/usr/bin/sed -i 's/#install msr/install msr/g' /etc/modprobe.d/30_security-misc.conf
ExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf
ExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf
ExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/990-security-misc.conf
ExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf
ExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf
ExecStart=/usr/bin/echo 'EDITOR=nano' >> /etc/bashrc
ExecStart=/usr/bin/echo 'VISUAL=nano' >> /etc/bashrc
ExecStart=/usr/bin/systemctl disable systemd-resolved
ExecStart=/usr/bin/touch /var/lib/%N.stamp
ExecStart=/usr/bin/systemctl --no-block reboot
[Install]
WantedBy=multi-user.target
- name: postinst2.service
enabled: true
contents: |
[Unit]
Description=Initial System Setup Part 3
# We run this after the packages have been overlayed
After=firewalld.service
ConditionPathExists=!/var/lib/%N.stamp
ConditionPathExists=/var/lib/postinst.stamp
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/systemctl enable --now firewalld
ExecStart=/usr/bin/firewall-cmd --lockdown-on
ExecStart=/usr/bin/firewall-cmd --permanent --add-service=ntp
ExecStart=/usr/bin/firewall-cmd --reload
[Install]
WantedBy=multi-user.target
- name: docker.service
enabled: false
- name: fstrim.timer
enabled: true
- name: systemd-oomd.service
enabled: true
- name: rpm-ostree-countme.timer
enabled: false
mask: true
- name: sshd.service
enabled: false
- name: sshd.socket
enabled: true
- name: kdump.service
enabled: false
mask: true
- name: debug-shell.service
enabled: false
mask: true
- name: coreos-cni-networking-check.service
enabled: false
mask: true
storage:
files:
- path: /etc/zincati/config.d/51-rollout-wariness.toml
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/zincati/config.d/51-rollout-wariness.toml
- path: /etc/zincati/config.d/55-updates-strategy.toml
contents:
inline: |
[updates]
strategy = "immediate"
- path: /etc/yum.repos.d/_copr:copr.fedorainfracloud.org:secureblue:hardened_malloc.repo
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/yum.repos.d/_copr:copr.fedorainfracloud.org:secureblue:hardened_malloc.repo
- path: /etc/chrony.conf
contents:
source: https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf
overwrite: true
- path: /etc/modprobe.d/30_security-misc.conf
contents:
source: https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf
- path: /etc/sysctl.d/990-security-misc.conf
contents:
source: https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf
- path: /etc/sysctl.d/30_silent-kernel-printk.conf
contents:
source: https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf
- path: /etc/sysctl.d/30_security-misc_kexec-disable.conf
contents:
source: https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf
- path: /etc/systemd/system/NetworkManager.service.d/99-brace.conf
contents:
source: https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf
- path: /etc/systemd/system/irqbalance.service.d/99-brace.conf
contents:
source: https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf
- path: /etc/ssh/sshd_config.d/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config.d/10-custom.conf
- path: /etc/ssh/ssh_config.d/10-custom.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/ssh_config.d/10-custom.conf
- path: /etc/systemd/system/sshd.service.d/local.conf
contents:
source: https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf
- path: /etc/tuned/active_profile
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/active_profile
- path: /etc/tuned/profile_mode
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/tuned/profile_mode
- path: /etc/systemd/zram-generator.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf
- path: /etc/security/limits.d/30-disable-coredump.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf
- path: /etc/sysconfig/chronyd
overwrite: true
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd
- path: /etc/unbound/unbound.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf
- path: /etc/systemd/system/unbound.service.d/override.conf
contents:
source: https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf
- path: /etc/issue
overwrite: true
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue
- path: /etc/issue.net
overwrite: true
contents:
source: https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/issue
links:
- path: /etc/localtime
target: ../usr/share/zoneinfo/America/Phoenix
- path: /etc/systemd/system/multi-user.target.wants/unbound.service
target: /usr/lib/systemd/system/unbound.service
- path: /etc/systemd/system/multi-user.target.wants/tuned.service
target: /usr/lib/systemd/system/tuned.service
kernel_arguments:
should_exist:
- mitigations=auto,nosmt
- spectre_v2=on
- spectre_bhi=on
- spec_store_bypass_disable=on
- tsx=off
- kvm.nx_huge_pages=force
- nosmt=force
- l1d_flush=on
- spec_rstack_overflow=safe-ret
- gather_data_sampling=force
- reg_file_data_sampling=on
- random.trust_bootloader=off
- random.trust_cpu=off
- intel_iommu=on
- amd_iommu=force_isolation
- efi=disable_early_pci_dma
- iommu=force
- iommu.passthrough=0
- iommu.strict=1
- slab_nomerge
- init_on_alloc=1
- init_on_free=1
- pti=on
- vsyscall=none
- ia32_emulation=0
- page_alloc.shuffle=1
- randomize_kstack_offset=on
- debugfs=off
- lockdown=confidentiality
- module.sig_enforce=1