Sebastian Gumprich
2ba40b0891
* fix ansible-lint issue https://github.com/ansible-community/ansible-lint/issues/1795 Signed-off-by: rndmh3ro <[email protected]> * move 2 sysctls to debian specific Signed-off-by: rndmh3ro <[email protected]> * fix ansible-lint issue https://github.com/ansible-community/ansible-lint/issues/1795 Signed-off-by: rndmh3ro <[email protected]> * add arch linux sysctls * simplify sysctl settings Signed-off-by: rndmh3ro <[email protected]> * ove overwrite to the bottom to let it acutally overwrite something Signed-off-by: rndmh3ro <[email protected]> * fix typo Signed-off-by: rndmh3ro <[email protected]>
42 lines
845 B
YAML
42 lines
845 B
YAML
---
|
|
|
|
os_nologin_shell_path: '/sbin/nologin'
|
|
|
|
os_shadow_perms:
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
|
|
os_passwd_perms:
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
os_env_umask: '027'
|
|
|
|
os_auth_uid_min: 1000
|
|
os_auth_uid_max: 60000
|
|
os_auth_gid_min: 1000
|
|
os_auth_gid_max: 60000
|
|
os_auth_sys_uid_min: 500
|
|
os_auth_sys_uid_max: 999
|
|
os_auth_sys_gid_min: 500
|
|
os_auth_sys_gid_max: 999
|
|
os_auth_sub_uid_min: 100000
|
|
os_auth_sub_uid_max: 600100000
|
|
os_auth_sub_uid_count: 65536
|
|
os_auth_sub_gid_min: 100000
|
|
os_auth_sub_gid_max: 600100000
|
|
os_auth_sub_gid_count: 65536
|
|
|
|
modprobe_package: 'kmod'
|
|
auditd_package: 'audit'
|
|
|
|
hidepid_option: '2' # allowed values: 0, 1, 2
|
|
|
|
sysctl_custom_config:
|
|
# Mitigation of vulnerability CVE-2021-33909
|
|
kernel.unprivileged_userns_clone: 0
|
|
# Mitigation of vulnerability CVE-2021-33910
|
|
kernel.unprivileged_bpf_disabled: 1
|