 asepharyana
|
e6033c8b12
|
feat(infra): hardening firewall + sysctl + ssh
- deny-by-default iptables/ip6tables: public cuma 22/80/443/4013,
sisanya localhost + tailscale CGNAT; log FW-DROP rate-limited
- persist via netfilter-persistent (rules.v4/v6) + /usr/local/bin/firewall.sh
- sysctl hardening: syncookies, rp_filter, redirect off, kptr/dmesg
restrict, protected links, somaxconn, tcp retries tuner
- sshd: PasswordAuthentication no (fix 50-cloud-init.conf override),
PermitRootLogin prohibit-password, MaxAuthTries 4, LoginGraceTime 30,
X11Forwarding no
|
2026-08-02 20:22:49 +07:00 |
|