RHEL needs tls cert bundle config

Signed-off-by: Tommy <contact@tommytran.io>

Fedora-Server-40.sh

@@ -158,7 +158,7 @@ fi
 
 # Setup real-ucode
 MACHINE_TYPE=$(uname -m)
-if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
+if [ "$virtualization" = 'none' ] && [ "${MACHINE_TYPE}" == 'x86_64' ]; then
     sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
     sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
     sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware

Fedora-Workstation-40.sh

@@ -239,7 +239,7 @@ else
 fi
 
 # Setup real-ucode
-if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
+if [ "$virtualization" = 'none' ] && [ "${MACHINE_TYPE}" == 'x86_64' ]; then
     sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
     sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
     sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware

RHEL-9.sh

@@ -39,6 +39,7 @@ sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
 sudo chmod 700 /home/*
 
 # Setup NTS
+sudo dnf install -y chrony
 unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony.conf
 sudo chmod 644 /etc/chrony.conf
 unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/sysconfig/chronyd | sudo tee /etc/sysconfig/chronyd
@@ -88,12 +89,6 @@ sudo systemctl enable --now dnf-automatic.timer
 # Remove unnecessary packages
 sudo dnf remove -y cockpit*
 
-# Install hardened_malloc
-sudo dnf copr enable secureblue/hardened_malloc -y
-sudo dnf install -y hardened_malloc
-echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
-sudo chmod 644 /etc/ld.so.preload
-
 # Install appropriate virtualization drivers
 if [ "$virtualization" = 'kvm' ]; then
     sudo dnf install -y qemu-guest-agent
@@ -107,6 +102,7 @@ echo 'server:
   auto-trust-anchor-file: "/var/lib/unbound/root.key"
   trust-anchor-signaling: yes
   root-key-sentinel: yes
+  tls-cert-bundle: "/etc/ssl/cert.pem"
   tls-ciphers: "PROFILE=SYSTEM"
   hide-http-user-agent: yes
   hide-identity: yes
@@ -135,7 +131,7 @@ forward-zone:
 
 sudo chmod 644 /etc/unbound/unbound.conf
 
-mkdir -p /etc/systemd/system/unbound.service.d
+sudo mkdir -p /etc/systemd/system/unbound.service.d
 echo $'[Service]
 MemoryDenyWriteExecute=true
 PrivateDevices=true
@@ -160,9 +156,9 @@ sudo chmod 644 /etc/systemd/system/unbound.service.d/override.conf
 sudo systemctl enable --now unbound
 
 # Setup yara
-sudo dnf install -y yara
+#sudo dnf install -y yara
-sudo insights-client --collector malware-detection
+#sudo insights-client --collector malware-detection
-sudo sed -i 's/test_scan: true/test_scan: false/' /etc/insights-client/malware-detection-config.yml
+#sudo sed -i 's/test_scan: true/test_scan: false/' /etc/insights-client/malware-detection-config.yml
 
 # Setup fwupd
 if [ "$virtualization" = 'none' ]; then
@@ -193,7 +189,7 @@ fi
 
 # Setup real-ucode
 MACHINE_TYPE=$(uname -m)
-if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
+if [ "$virtualization" = 'none' ] && [ "${MACHINE_TYPE}" == 'x86_64' ]; then
     sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
     sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
     sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware