mirror of
https://github.com/tommytran732/Linux-Setup-Scripts
synced 2024-11-09 03:31:33 -05:00
Compare commits
No commits in common. "5c7a2850e63ea77214c8457bd98cb1b26fb2268d" and "e258f693dc5507d7fc38c7feab6c707b8cc56022" have entirely different histories.
5c7a2850e6
...
e258f693dc
@ -158,7 +158,7 @@ fi
|
||||
|
||||
# Setup real-ucode
|
||||
MACHINE_TYPE=$(uname -m)
|
||||
if [ "$virtualization" = 'none' ] && [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||
if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||
sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
|
||||
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
||||
|
@ -239,7 +239,7 @@ else
|
||||
fi
|
||||
|
||||
# Setup real-ucode
|
||||
if [ "$virtualization" = 'none' ] && [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||
if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||
sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
|
||||
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
||||
|
18
RHEL-9.sh
18
RHEL-9.sh
@ -39,7 +39,6 @@ sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
|
||||
sudo chmod 700 /home/*
|
||||
|
||||
# Setup NTS
|
||||
sudo dnf install -y chrony
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
|
||||
sudo chmod 644 /etc/chrony.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
|
||||
@ -89,6 +88,12 @@ sudo systemctl enable --now dnf-automatic.timer
|
||||
# Remove unnecessary packages
|
||||
sudo dnf remove -y cockpit*
|
||||
|
||||
# Install hardened_malloc
|
||||
sudo dnf copr enable secureblue/hardened_malloc -y
|
||||
sudo dnf install -y hardened_malloc
|
||||
echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
|
||||
sudo chmod 644 /etc/ld.so.preload
|
||||
|
||||
# Install appropriate virtualization drivers
|
||||
if [ "$virtualization" = 'kvm' ]; then
|
||||
sudo dnf install -y qemu-guest-agent
|
||||
@ -102,7 +107,6 @@ echo 'server:
|
||||
auto-trust-anchor-file: "/var/lib/unbound/root.key"
|
||||
trust-anchor-signaling: yes
|
||||
root-key-sentinel: yes
|
||||
tls-cert-bundle: "/etc/ssl/cert.pem"
|
||||
tls-ciphers: "PROFILE=SYSTEM"
|
||||
hide-http-user-agent: yes
|
||||
hide-identity: yes
|
||||
@ -131,7 +135,7 @@ forward-zone:
|
||||
|
||||
sudo chmod 644 /etc/unbound/unbound.conf
|
||||
|
||||
sudo mkdir -p /etc/systemd/system/unbound.service.d
|
||||
mkdir -p /etc/systemd/system/unbound.service.d
|
||||
echo $'[Service]
|
||||
MemoryDenyWriteExecute=true
|
||||
PrivateDevices=true
|
||||
@ -156,9 +160,9 @@ sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
|
||||
sudo systemctl enable --now unbound
|
||||
|
||||
# Setup yara
|
||||
#sudo dnf install -y yara
|
||||
#sudo insights-client --collector malware-detection
|
||||
#sudo sed -i 's/test_scan: true/test_scan: false/' /etc/insights-client/malware-detection-config.yml
|
||||
sudo dnf install -y yara
|
||||
sudo insights-client --collector malware-detection
|
||||
sudo sed -i 's/test_scan: true/test_scan: false/' /etc/insights-client/malware-detection-config.yml
|
||||
|
||||
# Setup fwupd
|
||||
if [ "$virtualization" = 'none' ]; then
|
||||
@ -189,7 +193,7 @@ fi
|
||||
|
||||
# Setup real-ucode
|
||||
MACHINE_TYPE=$(uname -m)
|
||||
if [ "$virtualization" = 'none' ] && [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||
if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||
sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
|
||||
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
||||
|
Loading…
Reference in New Issue
Block a user