63 lines
1.3 KiB
Nix
63 lines
1.3 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
serverRoles = [
|
|
"server"
|
|
"embedded"
|
|
];
|
|
server = lib.elem config.host.role serverRoles;
|
|
role = if server then "server" else "personal";
|
|
forwarding = lib.elem (config.boot.kernel.sysctl."net.ipv4.conf.all.forwarding" or false) [
|
|
true
|
|
1
|
|
"1"
|
|
];
|
|
in
|
|
{
|
|
options.lynis = {
|
|
enable = lib.mkOption {
|
|
default = false;
|
|
type = lib.types.bool;
|
|
};
|
|
skipTests = lib.mkOption {
|
|
default = [
|
|
"AUTH-9230"
|
|
"AUTH-9262"
|
|
"AUTH-9284"
|
|
"AUTH-9286"
|
|
"FILE-6310"
|
|
"FILE-6410"
|
|
"FINT-4350"
|
|
"KRNL-5830"
|
|
"NAME-4028"
|
|
"PKGS-7398"
|
|
"SSH-7408"
|
|
"TOOL-5002"
|
|
]
|
|
++ lib.optionals (!server) [
|
|
"ACCT-9622"
|
|
"ACCT-9626"
|
|
"ACCT-9628"
|
|
"HRDN-7222"
|
|
"HRDN-7230"
|
|
"LOGG-2154"
|
|
"USB-1000"
|
|
]
|
|
++ lib.optional forwarding "KRNL-6000:net.ipv4.conf.all.forwarding";
|
|
type = lib.types.listOf lib.types.str;
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf config.lynis.enable {
|
|
environment.systemPackages = [ pkgs.lynis ];
|
|
environment.etc."lynis/custom.prf".text = lib.concatLines (
|
|
[ "machine-role=${role}" ] ++ map (t: "skip-test=${t}") config.lynis.skipTests
|
|
);
|
|
};
|
|
}
|