From 7f3c409d56f296628e91fde9386f5ce1d2c03dd6 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 12 Apr 2021 13:38:56 -0700 Subject: [PATCH 1/5] Force hosts to contain proper localhost --- config/profile-config/common.nix | 2 +- lib/fudo/hosts.nix | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/config/profile-config/common.nix b/config/profile-config/common.nix index f27b7c4..e95e398 100644 --- a/config/profile-config/common.nix +++ b/config/profile-config/common.nix @@ -31,7 +31,7 @@ in { }; libdefaults = { - allow_weak_crypto = false; + allow_weak_crypto = true; dns_lookup_kdc = true; dns_lookup_realm = true; forwardable = true; diff --git a/lib/fudo/hosts.nix b/lib/fudo/hosts.nix index b0993c8..6c12067 100644 --- a/lib/fudo/hosts.nix +++ b/lib/fudo/hosts.nix @@ -143,7 +143,22 @@ in { # Necessary to ensure that Kerberos and Avahi both work. Kerberos needs # the fqdn of the host, whereas Avahi wants just the simple hostname.` - hosts = { "127.0.0.1" = [ "${hostname}.${domain-name}" "${hostname}" ]; }; + hosts = { + "127.0.0.2" = [ "${hostname}.${domain-name}" "${hostname}" ]; + "127.0.0.1" = [ "${hostname}.${domain-name}" "${hostname}" ]; + "::1" = [ "${hostname}.${domain-name}" "${hostname}" ]; + }; + }; + + environment.etc.hosts = mkForce { + text = '' + 127.0.0.1 ${hostname}.${domain-name} ${hostname} localhost + 127.0.0.2 ${hostname} localhost + ::1 ${hostname}.${domain-name} ${hostname} localhost + ''; + user = "root"; + group = "root"; + mode = "0444"; }; nix = mkIf From 6ee8509d990bd0672ec06074d6ccfbfacb2897f3 Mon Sep 17 00:00:00 2001 From: Root Date: Mon, 12 Apr 2021 13:41:00 -0700 Subject: [PATCH 2/5] Don't use tmpfs for small-mem hosts --- config/hosts/limina.nix | 1 + config/hosts/plato.nix | 1 + config/profile-config/server.nix | 12 ++---------- lib/fudo/hosts.nix | 9 +++++++++ 4 files changed, 13 insertions(+), 10 deletions(-) diff --git a/config/hosts/limina.nix b/config/hosts/limina.nix index 04fb8f6..a85eb41 100644 --- a/config/hosts/limina.nix +++ b/config/hosts/limina.nix @@ -13,4 +13,5 @@ profile = "server"; ssh-pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMqymGZ5dI6ChI1Qx1QfjBo/h0+xFwpRx/wQSDxWQprI"; + tmp-on-tmpfs = false; } diff --git a/config/hosts/plato.nix b/config/hosts/plato.nix index 8fa9a6c..16187c2 100644 --- a/config/hosts/plato.nix +++ b/config/hosts/plato.nix @@ -16,4 +16,5 @@ build-pubkeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMPjwpcktL0Rhjc/D3ZmzwkSRqSJX5TGjMXVstpg8nNqQQrj9DxPq7gV4a+1LxMtQGPUv4gYx7De1a5LMVk8u6qJJnaLlt3TB1e1SUCBxxeh5sWIY5BMx8Q0/aRTkyTchyczX6FX0LXM7FP6yvxZVZSn2WHRp7REr8G1PUAwuIGy2a4bKOUSh5Uj4riXFXnROW2mp1vUfe5oH4X5HP3ACCXWRVUFdqDt1ldcrqqi+7/8x2G1eOHJcQ7B5FdL3uuq0nBrUzFQTt6KCHy0C2Jc3DFwOS1+ZdGKZpao+/arh/fH+LQfMUePx/AQOkYrJwvuRwbxg8XmlZ89u2gyDuqapzjBmsu+wyd5pF2QglyTRZW9Ijy1NTuzduPm6wgqN0Q09evFJvM9ZjShcIY3xTcCGDxpwTeYgMVXMF79sV9u+JwCSBpaIyteIJ7M/J/NWmaKoUF6Ia9mNts889Ba9TKzQFek19KYetOB2hfXV+7bvXrH+OBppzpdrztJFavBceQTs=" ]; + tmp-on-tmpfs = false; } diff --git a/config/profile-config/server.nix b/config/profile-config/server.nix index 1b0b130..9cc8bf0 100644 --- a/config/profile-config/server.nix +++ b/config/profile-config/server.nix @@ -2,11 +2,7 @@ with lib; let - serverPackages = with pkgs; [ - emacs-nox - reboot-if-necessary - test-config - ]; + serverPackages = with pkgs; [ emacs-nox reboot-if-necessary test-config ]; reboot-if-necessary = pkgs.writeShellScriptBin "reboot-if-necessary" '' if [ $# -ne 1 ]; then @@ -50,9 +46,7 @@ in { imports = [ ./common.nix ]; config = { - environment = { - systemPackages = serverPackages; - }; + environment = { systemPackages = serverPackages; }; system.autoUpgrade.enable = false; @@ -60,8 +54,6 @@ in { networking.networkmanager.enable = mkForce false; - boot.tmpOnTmpfs = true; - services = { xserver.enable = false; diff --git a/lib/fudo/hosts.nix b/lib/fudo/hosts.nix index b0993c8..b772b68 100644 --- a/lib/fudo/hosts.nix +++ b/lib/fudo/hosts.nix @@ -89,6 +89,13 @@ let default = null; }; + tmp-on-tmpfs = mkOption { + type = bool; + description = + "Use tmpfs for /tmp. Great if you've got enough (>16G) RAM."; + default = true; + }; + enable-gui = mkEnableOption "Install desktop GUI software."; docker-server = mkEnableOption "Enable Docker on the current host."; @@ -172,6 +179,8 @@ in { autoPrune.enable = true; }; + boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs; + programs.ssh.knownHosts = let keyed-hosts = filterAttrs (host: opts: opts.ssh-pubkey != null) config.fudo.hosts; From 6f070a9963b4494bd0e71c3f8f28c840c867893a Mon Sep 17 00:00:00 2001 From: root Date: Mon, 12 Apr 2021 14:41:08 -0700 Subject: [PATCH 3/5] Set the host domain name --- lib/fudo/hosts.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/fudo/hosts.nix b/lib/fudo/hosts.nix index 6c12067..9592bc9 100644 --- a/lib/fudo/hosts.nix +++ b/lib/fudo/hosts.nix @@ -136,6 +136,7 @@ in { in { networking = { hostName = config.instance.hostname; + domain = domain-name; nameservers = site.nameservers; # This will cause a loop on the gateway itself #defaultGateway = site.gateway-v4; From 4a7c4a9469bc0a1428dbe1cd1f3de099645921e9 Mon Sep 17 00:00:00 2001 From: Root Date: Mon, 12 Apr 2021 14:53:55 -0700 Subject: [PATCH 4/5] Only enable the firewall if there's an external interface specified --- lib/fudo/hosts.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/fudo/hosts.nix b/lib/fudo/hosts.nix index 10acca6..cbaf9a0 100644 --- a/lib/fudo/hosts.nix +++ b/lib/fudo/hosts.nix @@ -119,6 +119,12 @@ let description = "SSH public keys used to access the build server."; default = [ ]; }; + + external-interfaces = mkOption { + type = listOf str; + description = "A list of interfaces on which to enable the firewall."; + default = [ ]; + }; }; }; @@ -155,6 +161,11 @@ in { "127.0.0.1" = [ "${hostname}.${domain-name}" "${hostname}" ]; "::1" = [ "${hostname}.${domain-name}" "${hostname}" ]; }; + + firewall = { + enable = (length host-cfg.external-interfaces) > 0; + allowedTCPPorts = [ 22 ]; + }; }; environment.etc.hosts = mkForce { From 71d7fcd7a49af7f7fd96de7677e023bad18ecfd2 Mon Sep 17 00:00:00 2001 From: Root Date: Mon, 12 Apr 2021 15:30:11 -0700 Subject: [PATCH 5/5] Fuck...didn't I push this? --- config/host-config/clunk.nix | 12 +++--------- config/host-config/limina.nix | 8 ++------ 2 files changed, 5 insertions(+), 15 deletions(-) diff --git a/config/host-config/clunk.nix b/config/host-config/clunk.nix index 5cd326f..386622a 100644 --- a/config/host-config/clunk.nix +++ b/config/host-config/clunk.nix @@ -6,9 +6,7 @@ let dns-proxy-port = 5335; - host-packages = with pkgs; [ - nixops - ]; + host-packages = with pkgs; [ nixops ]; site-name = config.fudo.hosts.${config.instance.hostname}.site; site = config.fudo.site.${site-name}; @@ -53,13 +51,9 @@ in { network-definition = config.fudo.networks."rus.selby.ca"; }; - networking = { - firewall = { - enable = true; - trustedInterfaces = [ "intif0" "docker0" ]; - allowedTCPPorts = [ 22 ]; - }; + fudo.hosts.clunk.external-interfaces = [ "enp1s0" ]; + networking = { interfaces = { enp1s0.useDHCP = true; diff --git a/config/host-config/limina.nix b/config/host-config/limina.nix index 9c12b98..3c9eb6e 100644 --- a/config/host-config/limina.nix +++ b/config/host-config/limina.nix @@ -20,13 +20,9 @@ in { "openssh-with-gssapi-8.4p1" # CVE-2021-28041 ]; - networking = { - firewall = { - enable = true; - trustedInterfaces = [ "intif0" "intif1" "intif2" "lo" ]; - allowedTCPPorts = [ 22 ]; - }; + fudo.hosts.limina.external-interfaces = [ "enp1s0" ]; + networking = { interfaces = { enp1s0 = { useDHCP = true; };