asepharyana
e6033c8b12
- deny-by-default iptables/ip6tables: public cuma 22/80/443/4013, sisanya localhost + tailscale CGNAT; log FW-DROP rate-limited - persist via netfilter-persistent (rules.v4/v6) + /usr/local/bin/firewall.sh - sysctl hardening: syncookies, rp_filter, redirect off, kptr/dmesg restrict, protected links, somaxconn, tcp retries tuner - sshd: PasswordAuthentication no (fix 50-cloud-init.conf override), PermitRootLogin prohibit-password, MaxAuthTries 4, LoginGraceTime 30, X11Forwarding no
13 lines
232 B
Plaintext
13 lines
232 B
Plaintext
ClientAliveInterval 60
|
|
ClientAliveCountMax 3
|
|
MaxStartups 100:30:200
|
|
MaxSessions 100
|
|
TCPKeepAlive yes
|
|
|
|
# Hardening 2026-08-02
|
|
MaxAuthTries 4
|
|
LoginGraceTime 30
|
|
PermitRootLogin prohibit-password
|
|
X11Forwarding no
|
|
AllowTcpForwarding yes
|