Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1084522" data-attributes="member: 96560">Made some changes to have a partially secure configuration. You need to do a 2 stage installation process.First you change Gnome Settings &gt; Networking &gt; and set the network Ethernet and WiFi to manual and to use a static ip, and also you turn off Automatic DNS and give it your favourite DNS severs, like &#039;9.9.9.9,149.112.112.112&#039; which specifies Quad9. The use of a manual ip will get rid of the bootp protocol, which can be a attack vector.Then you add these lines to the default &#039;/etc/nixos/confguration.nix&#039; . These lines give you a set of modified firewall rules. You don&#039;t need to be on-line, the change do not need fetching online things.[ICODE]services.printing.enable = false;&nbsp;&nbsp; # networking.enableIPv6 = false;&nbsp;&nbsp; services.avahi.enable = false;&nbsp;&nbsp; # services.ipp-usb.enable = false;&nbsp;&nbsp; networking.firewall.enable = true;&nbsp;&nbsp; networking.useDHCP = false;&nbsp;&nbsp; networking.firewall.extraCommands = &quot;iptables -I INPUT 1 -f -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; iptables -I INPUT 2 -m state --state NEW -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 3 -p tcp --tcp-flags ALL ALL -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 4 -p tcp --tcp-flags ALL NONE -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 5 -p tcp&nbsp; --dport 6000:6007 -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 6 -p udp&nbsp; --sport 68 -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 7 -p tcp&nbsp; --sport 68 -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 8 -m state --state RELATED -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 9 -p tcp&nbsp; --dport 5353 -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I INPUT 10 -p udp&nbsp; --dport 5353 -j DROP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &quot;;[/ICODE]Now do a &#039;sudo nixos-rebuild switch&#039; . This puts the firewall rules into effect.Then issue this command: &#039;sudo nix-channel --add channels.nixos.org/nixos-unstable nixos&#039;If the command doesn&#039;t work, add &#039;https://&#039; in front of that channel, MT changed it to something else when I had the https:// in front.This sets the update channel to unstable, which gives you the most recent packages.Additionally, some of the options below depends on the unstable channel.Then you use the following &#039;configuration.nix&#039;:[ICODE]# Edit this configuration file to define what should be installed on# your system. Help is available in the configuration.nix(5) man page# and in the NixOS manual (accessible by running ‘nixos-help’).{ config, pkgs, ... }:{imports =[ ./restrict-nix-env.nix # Path to your module file# Include the results of the hardware scan../hardware-configuration.nix];# imports = [# ./restrict-nix-env.nix # Path to your module file# ];# lib.mkForce = &quot;/etc/nixos/configuration.nix&quot;;# Bootloader.boot.loader.systemd-boot.enable = true;boot.loader.efi.canTouchEfiVariables = true;networking.hostName = &quot;nixos&quot;; # Define your hostname.# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.#####MY CHANGESnetworking.enableIPv6 = false;# networking.tcpcrypt.enable = true ;# Configure network proxy if necessary# networking.proxy.default = &quot;http://user:password@proxy:port/&quot;;# networking.proxy.noProxy = &quot;127.0.0.1,localhost,internal.domain&quot;;# Enable networkingnetworking.networkmanager.enable = true;# Set your time zone.# Select internationalisation properties.i18n.defaultLocale = &quot;en_US.UTF-8&quot;;# Enable the X11 windowing system.services.xserver.enable = true;# Enable GNOME Desktop Environment.services.xserver.displayManager.gdm.enable = true;services.xserver.desktopManager.gnome.enable = true;# Configure keymap in X11services.xserver = {layout = &quot;us&quot;;xkbVariant = &quot;&quot;;};# Enable CUPS to print documents.# services.printing.enable = true;###MY CHANGEservices.ipp-usb.enable = false;services.printing.enable = false;services.avahi.enable = false;networking.firewall.package = pkgs.iptables;networking.firewall.enable = true;networking.firewall.extraCommands = &quot;iptables -I INPUT 1 -f -j DROPiptables -I INPUT 2 -m state --state NEW,RELATED -j DROPiptables -I INPUT 3 -p tcp --tcp-flags ALL ALL -j DROPiptables -I INPUT 4 -p tcp --tcp-flags ALL NONE -j DROPiptables -I INPUT 5 -p tcp --dport 6000:6007 -j DROPiptables -I INPUT 6 -p udp --sport 68 -j DROPiptables -I INPUT 7 -p tcp --sport 68 -j DROPiptables -I INPUT 7 -p tcp --dPort 22:23 -j DROPiptables -I INPUT 9 -p tcp --dport 5353 -j DROP;iptables -I INPUT 10 -p udp --dport 5353 -j DROP;&quot;;networking.firewall.allowedTCPPorts = [ 443 ];###MY CONFIG SECURITYsecurity.apparmor.enable = true;nix.settings.sandbox = true;# Enable sound with pipewire.sound.enable = true;hardware.pulseaudio.enable = false;###MY CHANGEShardware.pulseaudio.support32Bit = true;# hardware.pulseaudio.extraConfig = &quot;load-module module-combine-sink&quot;;security.rtkit.enable = true;services.pipewire = {enable = true;alsa.enable = false;alsa.support32Bit = true;pulse.enable = true;# If you want to use JACK applications, uncomment this#jack.enable = true;# use the example session manager (no others are packaged yet so this is enabled by default,# no need to redefine it in your config for now)#media-session.enable = true;};# Enable touchpad support (enabled default in most desktopManager).# services.xserver.libinput.enable = true;# Define a user account. Don&#039;t forget to set a password with ‘passwd’.users.users.victor = {isNormalUser = true;description = &quot;Victor&quot;;extraGroups = [ &quot;networkmanager&quot; &quot;wheel&quot; ];packages = with pkgs; [# thunderbird];};services.pcscd.enable = true;security.pam.yubico = {enable = true;# debug = true;control = &quot;required&quot; ;mode = &quot;challenge-response&quot;;### challenge response need to write configuration to yubikey with yubikey personalization tool, installed below### then a &quot;challenge* file is written to ~/.yubico with the command &quot;ykpamcfg -2 -v&quot;### id generated by : nix-shell --command &#039;ykinfo -s&#039; -p yubikey-personalizationid = [ &quot;11084705&quot; ];};users.users.user2 = {isNormalUser = true;description = &quot;User2&quot;;packages = with pkgs; [# thunderbird];};# Allow unfree packagesnixpkgs.config.allowUnfree = true ;###MY PACKAGESenvironment.systemPackages = with pkgs; [# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.# wgetlibreofficegeditiftopdeja-dupnmap# operayubioath-flutteryubikey-manager-qtyubikey-touch-detectoryubikey-personalization-guiyubikey-managerpam_u2fyubikey-personalizationlibu2f-hostyubico-pamchromiumapparmor-pamapparmor-utilsapparmor-parserapparmor-profilesapparmor-bin-utilsapparmor-kernel-patcheslibapparmorstrace];nixpkgs.config = {# allowUnfree = true; # Important: Set to true firstallowUnfreePredicate = pkg: builtins.elem pkg.name [ &quot;opera&quot; ];};environment.defaultPackages = [] ;###MY CONFIG# Disable Deprecated media serverservices.dleyna-server.enable = false;###MY CONFIG# HARDENIHNGservices.gnome.rygel.enable = false;services.gnome.gnome-remote-desktop.enable = false;lib.mkForce = &quot;services.gnome.evolution-data-server.enable = false;nix.settings.allowed-users = [ zzz ] ;systemd.services.nscd.serviceConfig = { ProtectHome=true;ProtectControlGroups = true;ProtectKernelModules = true;ProtectKernelTunables = true;# RestrictSUIDSGID = true;MemoryDenyWriteExecute = true;LockPersonality = true;IPAddressDeny = any;NoNewPrivileges = true;};&quot;;services.gnome.gnome-user-share.enable = false;### The following disables ModemManager, by defining a pre-requisite of avahi.service; which depends on its enabled = false.systemd.services.&quot;reload-systemd-vconsole-setup&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;reload-systemd-vconsole-setup&quot;.requisite = [ &quot;avahi.service&quot; ];systemd.services.&quot;getty@&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;getty@&quot;.requisite = [ &quot;avahi.service&quot; ];systemd.services.&quot;colord&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;colord&quot;.requisite = [ &quot;avahi.service&quot; ];systemd.services.&quot;network-local-commands&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;network-local-commands&quot;.requisite = [ &quot;avahi.service&quot; ];systemd.services.&quot;bolt&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;bolt&quot;.requisite = [ &quot;avahi.service&quot; ];systemd.services.&quot;ModemManager&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;ModemManager&quot;.requisite = [ &quot;avahi.service&quot; ];systemd.services.&quot;wpa_supplicant&quot;.after = [ &quot;avahi.service&quot; ];systemd.services.&quot;wpa_supplicant&quot;.requisite = [ &quot;avahi.service&quot; ];services.geoclue2.enable = false ;nixpkgs.config.packageOverrides = pkgs: {# blacklistedPackage1 = null;# anotherBadPackage = null;sshd = null;};networking.useDHCP = false;services.dbus.implementation = &quot;broker&quot;;boot.initrd.systemd.dbus.enable = false;services.xserver.updateDbusEnvironment = false;systemd.services.dbus-broker.serviceConfig = { ProtectHome=true;ProtectControlGroups = true;ProtectKernelModules = true;ProtectKernelTunables = true;RestrictSUIDSGID = true;MemoryDenyWriteExecute = true;LockPersonality = true;IPAddressDeny = &quot;any&quot;;NoNewPrivileges = true;};systemd.services.accounts-daemon.serviceConfig = { ProtectHome=true;ProtectControlGroups = true;ProtectKernelModules = true;ProtectKernelTunables = true;# RestrictSUIDSGID = true;MemoryDenyWriteExecute = true;LockPersonality = true;IPAddressDeny = &quot;any&quot;;NoNewPrivileges = true;};]# disable all music things since I cant find the name of the &#039;music&#039; appservices.polaris.enable = false ;services.navidrome.enable = false ;services.gonic.enable = false ;services.mpd.enable = false ;services.mopidy.enable = false ;services.jmusicbot.enable = false ;programs.geary.enable = false;environment.gnome.excludePackages = with pkgs; [# pkgs.gnome-music.orggnome.gnome-musicgnome.totem];networking.extraHosts = &quot;0.0.0.0 multicast0.0.0.0 bootpc&quot; ;services.prometheus.exporters.modemmanager.enable = false ;# List services that you want to enable:# This value determines the NixOS release from which the default# settings for stateful data, like file locations and database versions# on your system were taken. It‘s perfectly fine and recommended to leave# this value at the release version of the first install of this system.# Before changing this value read the documentation for this option# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).system.stateVersion = &quot;23.11&quot;; # Did you read the comment?}[/ICODE]Remember to reboot.Today 2024-04-24, the package deja-dup did not install as requested in the &#039;configuration.nix&#039;. Maybe it is due to using the unstable channel.So I have to do &#039;nix-env -i deja-dup&#039; .This installs the Gnome Backup program, without which you cannot restore from backup.Now do this to mount /nix/store as writable:&nbsp; &#039;sudo /run/wrappers/bin/mount&nbsp; -o remount,rw /nix/store&#039;Next, do a &#039;whereis nix&#039;. This gives you the base location of the &#039;nix-env&#039; command and &#039;nixos-rebuild&#039; command.Use &#039;ls -la&#039; to follow the path revealed.Copy the found path, and do a &#039;ls -la&#039; with that path.Repeat until you find the true location, not just a link, where it will show you the file permssions, which includes o+x.Then do &#039;sudo chmod o-x&#039; with the correct path which is not a link.Repeat the steps above changing the permissions of curl.Now reboot.&nbsp; This will re-mount /nix/store to be read-only again as intended by the distro.Remember you have to repeat these 2 things: changing file permissions of nix and curl whenever you rebuild. Or anybody who gains access to your account will be able to install anything they wish.</blockquote>

[QUOTE="Victor M, post: 1084522, member: 96560"] Made some changes to have a partially secure configuration. You need to do a 2 stage installation process. First you change Gnome Settings > Networking > and set the network Ethernet and WiFi to manual and to use a static ip, and also you turn off Automatic DNS and give it your favourite DNS severs, like '9.9.9.9,149.112.112.112' which specifies Quad9. The use of a manual ip will get rid of the bootp protocol, which can be a attack vector. Then you add these lines to the default '/etc/nixos/confguration.nix' . These lines give you a set of modified firewall rules. You don't need to be on-line, the change do not need fetching online things. [ICODE] services.printing.enable = false; # networking.enableIPv6 = false; services.avahi.enable = false; # services.ipp-usb.enable = false; networking.firewall.enable = true; networking.useDHCP = false; networking.firewall.extraCommands = "iptables -I INPUT 1 -f -j DROP iptables -I INPUT 2 -m state --state NEW -j DROP iptables -I INPUT 3 -p tcp --tcp-flags ALL ALL -j DROP iptables -I INPUT 4 -p tcp --tcp-flags ALL NONE -j DROP iptables -I INPUT 5 -p tcp --dport 6000:6007 -j DROP iptables -I INPUT 6 -p udp --sport 68 -j DROP iptables -I INPUT 7 -p tcp --sport 68 -j DROP iptables -I INPUT 8 -m state --state RELATED -j DROP iptables -I INPUT 9 -p tcp --dport 5353 -j DROP iptables -I INPUT 10 -p udp --dport 5353 -j DROP "; [/ICODE] Now do a 'sudo nixos-rebuild switch' . This puts the firewall rules into effect. Then issue this command: 'sudo nix-channel --add channels.nixos.org/nixos-unstable nixos' If the command doesn't work, add 'https://' in front of that channel, MT changed it to something else when I had the https:// in front. This sets the update channel to unstable, which gives you the most recent packages. Additionally, some of the options below depends on the unstable channel. Then you use the following 'configuration.nix': [ICODE] # Edit this configuration file to define what should be installed on # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). { config, pkgs, ... }: { imports = [ ./restrict-nix-env.nix # Path to your module file # Include the results of the hardware scan. ./hardware-configuration.nix ]; # imports = [ # ./restrict-nix-env.nix # Path to your module file # ]; # lib.mkForce = "/etc/nixos/configuration.nix"; # Bootloader. boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; networking.hostName = "nixos"; # Define your hostname. # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. #####MY CHANGES networking.enableIPv6 = false; # networking.tcpcrypt.enable = true ; # Configure network proxy if necessary # networking.proxy.default = "http://user:password@proxy:port/"; # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; # Enable networking networking.networkmanager.enable = true; # Set your time zone. # Select internationalisation properties. i18n.defaultLocale = "en_US.UTF-8"; # Enable the X11 windowing system. services.xserver.enable = true; # Enable GNOME Desktop Environment. services.xserver.displayManager.gdm.enable = true; services.xserver.desktopManager.gnome.enable = true; # Configure keymap in X11 services.xserver = { layout = "us"; xkbVariant = ""; }; # Enable CUPS to print documents. # services.printing.enable = true; ###MY CHANGE services.ipp-usb.enable = false; services.printing.enable = false; services.avahi.enable = false; networking.firewall.package = pkgs.iptables; networking.firewall.enable = true; networking.firewall.extraCommands = "iptables -I INPUT 1 -f -j DROP iptables -I INPUT 2 -m state --state NEW,RELATED -j DROP iptables -I INPUT 3 -p tcp --tcp-flags ALL ALL -j DROP iptables -I INPUT 4 -p tcp --tcp-flags ALL NONE -j DROP iptables -I INPUT 5 -p tcp --dport 6000:6007 -j DROP iptables -I INPUT 6 -p udp --sport 68 -j DROP iptables -I INPUT 7 -p tcp --sport 68 -j DROP iptables -I INPUT 7 -p tcp --dPort 22:23 -j DROP iptables -I INPUT 9 -p tcp --dport 5353 -j DROP; iptables -I INPUT 10 -p udp --dport 5353 -j DROP; "; networking.firewall.allowedTCPPorts = [ 443 ]; ###MY CONFIG SECURITY security.apparmor.enable = true; nix.settings.sandbox = true; # Enable sound with pipewire. sound.enable = true; hardware.pulseaudio.enable = false; ###MY CHANGES hardware.pulseaudio.support32Bit = true; # hardware.pulseaudio.extraConfig = "load-module module-combine-sink"; security.rtkit.enable = true; services.pipewire = { enable = true; alsa.enable = false; alsa.support32Bit = true; pulse.enable = true; # If you want to use JACK applications, uncomment this #jack.enable = true; # use the example session manager (no others are packaged yet so this is enabled by default, # no need to redefine it in your config for now) #media-session.enable = true; }; # Enable touchpad support (enabled default in most desktopManager). # services.xserver.libinput.enable = true; # Define a user account. Don't forget to set a password with ‘passwd’. users.users.victor = { isNormalUser = true; description = "Victor"; extraGroups = [ "networkmanager" "wheel" ]; packages = with pkgs; [ # thunderbird ]; }; services.pcscd.enable = true; security.pam.yubico = { enable = true; # debug = true; control = "required" ; mode = "challenge-response"; ### challenge response need to write configuration to yubikey with yubikey personalization tool, installed below ### then a "challenge* file is written to ~/.yubico with the command "ykpamcfg -2 -v" ### id generated by : nix-shell --command 'ykinfo -s' -p yubikey-personalization id = [ "11084705" ]; }; users.users.user2 = { isNormalUser = true; description = "User2"; packages = with pkgs; [ # thunderbird ]; }; # Allow unfree packages nixpkgs.config.allowUnfree = true ; ###MY PACKAGES environment.systemPackages = with pkgs; [ # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. # wget libreoffice gedit iftop deja-dup nmap # opera yubioath-flutter yubikey-manager-qt yubikey-touch-detector yubikey-personalization-gui yubikey-manager pam_u2f yubikey-personalization libu2f-host yubico-pam chromium apparmor-pam apparmor-utils apparmor-parser apparmor-profiles apparmor-bin-utils apparmor-kernel-patches libapparmor strace ]; nixpkgs.config = { # allowUnfree = true; # Important: Set to true first allowUnfreePredicate = pkg: builtins.elem pkg.name [ "opera" ]; }; environment.defaultPackages = [] ; ###MY CONFIG # Disable Deprecated media server services.dleyna-server.enable = false; ###MY CONFIG # HARDENIHNG services.gnome.rygel.enable = false; services.gnome.gnome-remote-desktop.enable = false; lib.mkForce = "services.gnome.evolution-data-server.enable = false; nix.settings.allowed-users = [ zzz ] ; systemd.services.nscd.serviceConfig = { ProtectHome=true; ProtectControlGroups = true; ProtectKernelModules = true; ProtectKernelTunables = true; # RestrictSUIDSGID = true; MemoryDenyWriteExecute = true; LockPersonality = true; IPAddressDeny = any; NoNewPrivileges = true; }; "; services.gnome.gnome-user-share.enable = false; ### The following disables ModemManager, by defining a pre-requisite of avahi.service; which depends on its enabled = false. systemd.services."reload-systemd-vconsole-setup".after = [ "avahi.service" ]; systemd.services."reload-systemd-vconsole-setup".requisite = [ "avahi.service" ]; systemd.services."getty@".after = [ "avahi.service" ]; systemd.services."getty@".requisite = [ "avahi.service" ]; systemd.services."colord".after = [ "avahi.service" ]; systemd.services."colord".requisite = [ "avahi.service" ]; systemd.services."network-local-commands".after = [ "avahi.service" ]; systemd.services."network-local-commands".requisite = [ "avahi.service" ]; systemd.services."bolt".after = [ "avahi.service" ]; systemd.services."bolt".requisite = [ "avahi.service" ]; systemd.services."ModemManager".after = [ "avahi.service" ]; systemd.services."ModemManager".requisite = [ "avahi.service" ]; systemd.services."wpa_supplicant".after = [ "avahi.service" ]; systemd.services."wpa_supplicant".requisite = [ "avahi.service" ]; services.geoclue2.enable = false ; nixpkgs.config.packageOverrides = pkgs: { # blacklistedPackage1 = null; # anotherBadPackage = null; sshd = null; }; networking.useDHCP = false; services.dbus.implementation = "broker"; boot.initrd.systemd.dbus.enable = false; services.xserver.updateDbusEnvironment = false; systemd.services.dbus-broker.serviceConfig = { ProtectHome=true; ProtectControlGroups = true; ProtectKernelModules = true; ProtectKernelTunables = true; RestrictSUIDSGID = true; MemoryDenyWriteExecute = true; LockPersonality = true; IPAddressDeny = "any"; NoNewPrivileges = true; }; systemd.services.accounts-daemon.serviceConfig = { ProtectHome=true; ProtectControlGroups = true; ProtectKernelModules = true; ProtectKernelTunables = true; # RestrictSUIDSGID = true; MemoryDenyWriteExecute = true; LockPersonality = true; IPAddressDeny = "any"; NoNewPrivileges = true; }; ] # disable all music things since I cant find the name of the 'music' app services.polaris.enable = false ; services.navidrome.enable = false ; services.gonic.enable = false ; services.mpd.enable = false ; services.mopidy.enable = false ; services.jmusicbot.enable = false ; programs.geary.enable = false; environment.gnome.excludePackages = with pkgs; [ # pkgs.gnome-music.org gnome.gnome-music gnome.totem ]; networking.extraHosts = "0.0.0.0 multicast 0.0.0.0 bootpc" ; services.prometheus.exporters.modemmanager.enable = false ; # List services that you want to enable: # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). system.stateVersion = "23.11"; # Did you read the comment? } [/ICODE] Remember to reboot. Today 2024-04-24, the package deja-dup did not install as requested in the 'configuration.nix'. Maybe it is due to using the unstable channel. So I have to do 'nix-env -i deja-dup' . This installs the Gnome Backup program, without which you cannot restore from backup. Now do this to mount /nix/store as writable: 'sudo /run/wrappers/bin/mount -o remount,rw /nix/store' Next, do a 'whereis nix'. This gives you the base location of the 'nix-env' command and 'nixos-rebuild' command. Use 'ls -la' to follow the path revealed. Copy the found path, and do a 'ls -la' with that path. Repeat until you find the true location, not just a link, where it will show you the file permssions, which includes o+x. Then do 'sudo chmod o-x' with the correct path which is not a link. Repeat the steps above changing the permissions of curl. Now reboot. This will re-mount /nix/store to be read-only again as intended by the distro. Remember you have to repeat these 2 things: changing file permissions of nix and curl whenever you rebuild. Or anybody who gains access to your account will be able to install anything they wish. [/QUOTE]

Verification