From 2474523199cde6d1ad8ef6ca085bd690bc5d619a Mon Sep 17 00:00:00 2001 From: Denis Chevalier Date: Thu, 6 Aug 2026 12:45:32 +0200 Subject: harden sudo --- etc.bash | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) (limited to 'etc.bash') diff --git a/etc.bash b/etc.bash index 77fb690..87b67b8 100755 --- a/etc.bash +++ b/etc.bash @@ -1,18 +1,19 @@ #!/bin/bash -sudo cp -rv etc/keyd/* /etc/keyd/ -sudo cp -v etc/pacman.conf /etc/ -sudo cp -v etc/kernel/cmdline /etc/kernel/ -sudo cp -v etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/ -sudo cp -v etc/pam.d/system-local-login /etc/pam.d/ -sudo cp -v etc/pam.d/system-login /etc/pam.d/ -sudo cp -v etc/login.defs /etc/ -sudo cp -v etc/updatedb.conf /etc/ -sudo cp -v etc/systemd/coredump.conf /etc/systemd/ -sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d/ +sudo cp -rv ./etc/keyd/* /etc/keyd/ +sudo cp -v ./etc/pacman.conf /etc/ +sudo cp -v ./etc/kernel/cmdline /etc/kernel/ +sudo cp -v ./etc/modprobe.d/blacklist-security.conf /etc/modprobe.d/ +sudo cp -v ./etc/pam.d/system-local-login /etc/pam.d/ +sudo cp -v ./etc/pam.d/system-login /etc/pam.d/ +sudo cp -v ./etc/login.defs /etc/ +sudo cp -v ./etc/updatedb.conf /etc/ +sudo cp -v ./etc/sudoers.d/00-hardening /etc/sudoers.d/ +sudo cp -v ./etc/systemd/coredump.conf /etc/systemd/ +sudo cp -v ./etc/sysctl.d/99-security.conf /etc/sysctl.d/ sudo sysctl --system -grep tmpfs /etc/fstab || sudo cat etc/fstab >> /etc/fstab +grep tmpfs /etc/fstab || sudo cat ./etc/fstab >> /etc/fstab # firewall sudo ufw default deny incoming @@ -25,5 +26,5 @@ sudo systemctl enable --now ufw sudo systemctl enable --now fstrim.timer # linux-hardened -sudo cp -v etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d -sudo mkinitcpio -p linux-hardened +sudo cp -v ./etc/mkinitcpio.d/linux-hardened.preset /etc/mkinitcpio.d +sudo mkinitcpio -P -- cgit