diff options
Diffstat (limited to 'setup.sh')
| -rwxr-xr-x | setup.sh | 9 |
1 files changed, 9 insertions, 0 deletions
@@ -76,6 +76,9 @@ paru -Qtdq | xargs -r paru -Rns --noconfirm || true # ----------------------------------------------------------------------------- log_info "Step 2: Deploying /etc System Configurations & Security Hardening..." +# Lock root account password (forces sudo-only access) +sudo passwd -l root >/dev/null + # Copy basic configuration files safely sudo cp -v ./etc/keyd/keyd.conf /etc/keyd/ sudo cp -v ./etc/pacman.conf /etc/ @@ -87,6 +90,7 @@ sudo cp -v ./etc/pam.d/greetd /etc/pam.d/ sudo cp -v ./etc/login.defs /etc/ sudo cp -v ./etc/updatedb.conf /etc/ sudo visudo -cf ./etc/sudoers.d/00-hardening && sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/ +sudo chmod 0440 /etc/sudoers.d/00-hardening sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/ sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/ sudo cp -v ./etc/cups/cupsd.conf /etc/cups/ @@ -141,6 +145,11 @@ log_info "Step 3: Reloading System Configuration & Enabling Services..." sudo sysctl --system sudo mkinitcpio -P + +if command -v sbctl >/dev/null 2>&1; then + sudo sbctl sign-all -s 2>/dev/null || true +fi + sudo systemctl daemon-reload # Enable User-Level Socket/Service Units |