diff --git a/Fedora-Workstation-38.sh b/Fedora-Workstation-38.sh index 8ef40b3..6a2cd23 100644 --- a/Fedora-Workstation-38.sh +++ b/Fedora-Workstation-38.sh @@ -55,6 +55,8 @@ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_silent-kernel-printk.conf -o /etc/sysctl.d/30_silent-kernel-printk.conf sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_security-misc_kexec-disable.conf -o /etc/sysctl.d/30_security-misc_kexec-disable.conf sudo sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/30_security-misc.conf +sudo dracut -f +sudo sysctl -p # Systemd Hardening sudo mkdir -p /etc/systemd/system/NetworkManager.service.d diff --git a/GCP-Debian-11.sh b/GCP-Debian-11.sh index 157c76a..9bc89ff 100644 --- a/GCP-Debian-11.sh +++ b/GCP-Debian-11.sh @@ -41,7 +41,12 @@ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_security-misc_kexec-disable.conf -o /etc/sysctl.d/30_security-misc_kexec-disable.conf sudo mkdir -p /etc/systemd/system/NetworkManager.service.d sudo curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf -o /etc/systemd/system/NetworkManager.service.d/99-brace.conf +sudo sysctl -p +# Rebuild initramfs +sudo update-initramfs -u + +# Security limit echo "* hard core 0" | tee -a /etc/security/limits.conf # Setup unbound diff --git a/RHEL-Server-9.sh b/RHEL-Server-9.sh index a3b2946..d992319 100644 --- a/RHEL-Server-9.sh +++ b/RHEL-Server-9.sh @@ -43,6 +43,7 @@ sudo sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g sudo sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/30_security-misc.conf sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_silent-kernel-printk.conf -o /etc/sysctl.d/30_silent-kernel-printk.conf sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_security-misc_kexec-disable.conf -o /etc/sysctl.d/30_security-misc_kexec-disable.conf +sudo dracut -f sudo sysctl -p # Systemd hardening diff --git a/Ubuntu-22.04-Desktop.sh b/Ubuntu-22.04-Desktop.sh index 2bddd1c..5f4640b 100644 --- a/Ubuntu-22.04-Desktop.sh +++ b/Ubuntu-22.04-Desktop.sh @@ -47,6 +47,18 @@ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_silent-kernel-printk.conf -o /etc/sysctl.d/30_silent-kernel-printk.conf sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/sysctl.d/30_security-misc_kexec-disable.conf -o /etc/sysctl.d/30_security-misc_kexec-disable.conf sudo sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/30_security-misc.conf +sudo sysctl -p + +# Rebuild initramfs +sudo update-initramfs -u + +# Disable telemetry +sudo systemctl stop apport.service +sudo systemctl disable apport.service +sudo systemctl mask apport.service +sudo systemctl stop whoopsie.service +sudo systemctl disable whoopsie.service +sudo systemctl mask whoopsie.service # Systemd Hardening sudo mkdir -p /etc/systemd/system/NetworkManager.service.d diff --git a/Ubuntu-22.04-Server.sh b/Ubuntu-22.04-Server.sh index a2fc3e1..58d4e23 100644 --- a/Ubuntu-22.04-Server.sh +++ b/Ubuntu-22.04-Server.sh @@ -128,7 +128,12 @@ sudo curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/ sudo sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=3/g' /etc/sysctl.d/30_security-misc.conf sudo sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/30_security-misc.conf sudo sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/30_security-misc.conf +sudo sysctl -p +# Rebuild initramfs +sudo update-initramfs -u + +# Disable telemetry sudo systemctl stop apport.service sudo systemctl disable apport.service sudo systemctl mask apport.service