├── src
├── .ssh
│ ├── authorized_keys
│ └── config
├── .config
│ ├── transmission-daemon
│ └── transmission
│ │ └── settings.json
├── .bash_profile
├── .purple
│ ├── blist.xml
│ ├── status.xml
│ ├── accounts.xml
│ └── prefs.xml
├── .bashrc
└── .gnupg
│ ├── gpg.conf
│ └── sks-keyservers.netCA.pem
├── Makefile
└── README.md
/src/.ssh/authorized_keys:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/src/.config/transmission-daemon:
--------------------------------------------------------------------------------
1 | transmission/
--------------------------------------------------------------------------------
/src/.bash_profile:
--------------------------------------------------------------------------------
1 | #
2 | # ~/.bash_profile
3 | #
4 |
5 | [[ -f ~/.bashrc ]] && . ~/.bashrc
6 |
--------------------------------------------------------------------------------
/src/.purple/blist.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
--------------------------------------------------------------------------------
/src/.bashrc:
--------------------------------------------------------------------------------
1 | # An umask that only gives read permissions to users in our group
2 | umask 027
3 |
4 | # If not running interactively, don't do anything
5 | [[ $- != *i* ]] && return
6 |
7 | # Prompt is user@hostname pwd$
8 | export PS1='[\u@\h \W]\$ '
9 |
--------------------------------------------------------------------------------
/src/.purple/status.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | available
6 |
7 |
8 |
--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
1 | # Sync /etc/skel with whatever is in src/ after fixing file modes
2 | install: set-file-modes
3 | rsync -av src/ /etc/skel/
4 |
5 | # Since git doesn't care about file modes we have to set them manually
6 | # here
7 | set-file-modes: ssh-file-modes
8 |
9 | ssh-file-modes:
10 | chmod 700 src/.ssh src/.gnupg
11 | chmod 600 src/.ssh/authorized_keys src/.gnupg/*
12 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | duraskel - a collection of hardened configurations for new user accounts
2 |
3 | For hardened configurations for servers see
4 | [duraconf](https://github.com/ioerror/duraconf)
5 |
6 | ## Installation
7 |
8 | Run `make install` as root. It needs rsync.
9 |
10 | ## Contributions
11 |
12 | I'm using gitflow. Please create your branches from the *develop*
13 | branch.
14 |
--------------------------------------------------------------------------------
/src/.ssh/config:
--------------------------------------------------------------------------------
1 | Host *
2 | # Don't use protocol 1
3 | Protocol 2
4 | # Use a socket on secondary connections
5 | ControlMaster auto
6 | ControlPath ~/.ssh/%r@%h:%p
7 | # Host verification and privacy
8 | VerifyHostKeyDNS yes
9 | HashKnownHosts yes
10 | CheckHostIP yes
11 | StrictHostKeyChecking ask
12 | # Connection security
13 | # Old ssh servers may need you to change these two options (do it per
14 | # host)
15 | Ciphers aes256-ctr
16 | MACs hmac-sha2-512
17 | Compression yes
18 | # Uncomment this if you want any host to become a secure SOCKS5 proxy or
19 | # set it per host
20 | # DynamicForward 8081
21 |
22 | # Add your per host configurations here...
23 |
--------------------------------------------------------------------------------
/src/.purple/accounts.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | prpl-bonjour
6 | User
7 |
8 | 0
9 |
10 |
11 |
12 | 5298
13 |
14 | Name
15 | User
16 | 1
17 |
18 |
19 | 1
20 |
21 |
22 |
23 |
24 |
--------------------------------------------------------------------------------
/src/.gnupg/gpg.conf:
--------------------------------------------------------------------------------
1 | # From duraconf
2 | # personal digest preferences
3 | personal-digest-preferences SHA512
4 |
5 | # message digest algorithm used when signing a key
6 | cert-digest-algo SHA512
7 |
8 | # Set the list of default preferences to string.
9 | # used for new keys and default for "setpref"
10 | default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
11 |
12 | # From
13 | # https://crabgrass.riseup.net/riseuplabs+paow/openpgp-best-practices
14 | # Only use secure keyservers
15 | keyserver hkps://hkps.pool.sks-keyservers.net
16 | keyserver-options ca-cert-file=~/.gnupg/sks-keyservers.netCA.pem
17 | keyserver-options no-honor-keyserver-url
18 |
19 | # when outputting certificates, view user IDs distinctly from keys:
20 | fixed-list-mode
21 |
22 | # short-keyids are trivially spoofed; it's easy to create a long-keyid
23 | # collision; if you care about strong key identifiers, you always want
24 | # to see the fingerprint:
25 | keyid-format 0xlong
26 | fingerprint
27 |
28 | # when multiple digests are supported by all recipients, choose the
29 | # strongest one:
30 | personal-digest-preferences SHA512 SHA384 SHA256 SHA224
31 |
32 | # If you use a graphical environment (and even if you don't)
33 | # you should be using an agent: (similar arguments as
34 | # https://www.debian-administration.org/users/dkg/weblog/64)
35 | use-agent
36 |
37 | # You should always know at a glance which User IDs gpg thinks are
38 | # legitimately bound to the keys in your keyring:
39 | verify-options show-uid-validity
40 | list-options show-uid-validity
41 |
42 | # include an unambiguous indicator of which key made a signature: (see
43 | # http://thread.gmane.org/gmane.mail.notmuch.general/3721/focus=7234)
44 | sig-notation issuer-fpr@notations.openpgp.fifthhorseman.net=%g
45 |
46 | # Anonymize the encryption by removing the key IDs from the pgp packet
47 | throw-keyids
48 |
--------------------------------------------------------------------------------
/src/.gnupg/sks-keyservers.netCA.pem:
--------------------------------------------------------------------------------
1 | -----BEGIN CERTIFICATE-----
2 | MIIFizCCA3OgAwIBAgIJAK9zyLTPn4CPMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNV
3 | BAYTAk5PMQ0wCwYDVQQIDARPc2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5u
4 | ZXQgQ0ExHjAcBgNVBAMMFXNrcy1rZXlzZXJ2ZXJzLm5ldCBDQTAeFw0xMjEwMDkw
5 | MDMzMzdaFw0yMjEwMDcwMDMzMzdaMFwxCzAJBgNVBAYTAk5PMQ0wCwYDVQQIDARP
6 | c2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5uZXQgQ0ExHjAcBgNVBAMMFXNr
7 | cy1rZXlzZXJ2ZXJzLm5ldCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
8 | ggIBANdsWy4PXWNUCkS3L//nrd0GqN3dVwoBGZ6w94Tw2jPDPifegwxQozFXkG6I
9 | 6A4TK1CJLXPvfz0UP0aBYyPmTNadDinaB9T4jIwd4rnxl+59GiEmqkN3IfPsv5Jj
10 | MkKUmJnvOT0DEVlEaO1UZIwx5WpfprB3mR81/qm4XkAgmYrmgnLXd/pJDAMk7y1F
11 | 45b5zWofiD5l677lplcIPRbFhpJ6kDTODXh/XEdtF71EAeaOdEGOvyGDmCO0GWqS
12 | FDkMMPTlieLA/0rgFTcz4xwUYj/cD5e0ZBuSkYsYFAU3hd1cGfBue0cPZaQH2HYx
13 | Qk4zXD8S3F4690fRhr+tki5gyG6JDR67aKp3BIGLqm7f45WkX1hYp+YXywmEziM4
14 | aSbGYhx8hoFGfq9UcfPEvp2aoc8u5sdqjDslhyUzM1v3m3ZGbhwEOnVjljY6JJLx
15 | MxagxnZZSAY424ZZ3t71E/Mn27dm2w+xFRuoy8JEjv1d+BT3eChM5KaNwrj0IO/y
16 | u8kFIgWYA1vZ/15qMT+tyJTfyrNVV/7Df7TNeWyNqjJ5rBmt0M6NpHG7CrUSkBy9
17 | p8JhimgjP5r0FlEkgg+lyD+V79H98gQfVgP3pbJICz0SpBQf2F/2tyS4rLm+49rP
18 | fcOajiXEuyhpcmzgusAj/1FjrtlynH1r9mnNaX4e+rLWzvU5AgMBAAGjUDBOMB0G
19 | A1UdDgQWBBTkwyoJFGfYTVISTpM8E+igjdq28zAfBgNVHSMEGDAWgBTkwyoJFGfY
20 | TVISTpM8E+igjdq28zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQAR
21 | OXnYwu3g1ZjHyley3fZI5aLPsaE17cOImVTehC8DcIphm2HOMR/hYTTL+V0G4P+u
22 | gH+6xeRLKSHMHZTtSBIa6GDL03434y9CBuwGvAFCMU2GV8w92/Z7apkAhdLToZA/
23 | X/iWP2jeaVJhxgEcH8uPrnSlqoPBcKC9PrgUzQYfSZJkLmB+3jEa3HKruy1abJP5
24 | gAdQvwvcPpvYRnIzUc9fZODsVmlHVFBCl2dlu/iHh2h4GmL4Da2rRkUMlbVTdioB
25 | UYIvMycdOkpH5wJftzw7cpjsudGas0PARDXCFfGyKhwBRFY7Xp7lbjtU5Rz0Gc04
26 | lPrhDf0pFE98Aw4jJRpFeWMjpXUEaG1cq7D641RpgcMfPFvOHY47rvDTS7XJOaUT
27 | BwRjmDt896s6vMDcaG/uXJbQjuzmmx3W2Idyh3s5SI0GTHb0IwMKYb4eBUIpQOnB
28 | cE77VnCYqKvN1NVYAqhWjXbY7XasZvszCRcOG+W3FqNaHOK/n/0ueb0uijdLan+U
29 | f4p1bjbAox8eAOQS/8a3bzkJzdyBNUKGx1BIK2IBL9bn/HravSDOiNRSnZ/R3l9G
30 | ZauX0tu7IIDlRCILXSyeazu0aj/vdT3YFQXPcvt5Fkf5wiNTo53f72/jYEJd6qph
31 | WrpoKqrwGwTpRUCMhYIUt65hsTxCiJJ5nKe39h46sg==
32 | -----END CERTIFICATE-----
33 |
--------------------------------------------------------------------------------
/src/.config/transmission/settings.json:
--------------------------------------------------------------------------------
1 | {
2 | "alt-speed-down": 50,
3 | "alt-speed-enabled": false,
4 | "alt-speed-time-begin": 540,
5 | "alt-speed-time-day": 127,
6 | "alt-speed-time-enabled": false,
7 | "alt-speed-time-end": 1020,
8 | "alt-speed-up": 50,
9 | "bind-address-ipv4": "0.0.0.0",
10 | "bind-address-ipv6": "::",
11 | "blocklist-date": 1387199068,
12 | "blocklist-enabled": true,
13 | "blocklist-updates-enabled": true,
14 | "blocklist-url": "http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz",
15 | "cache-size-mb": 4,
16 | "compact-view": false,
17 | "dht-enabled": true,
18 | "download-dir": "~/Downloads",
19 | "download-queue-enabled": true,
20 | "download-queue-size": 5,
21 | "encryption": 2,
22 | "idle-seeding-limit": 30,
23 | "idle-seeding-limit-enabled": true,
24 | "incomplete-dir": "",
25 | "incomplete-dir-enabled": false,
26 | "inhibit-desktop-hibernation": false,
27 | "lpd-enabled": true,
28 | "main-window-height": 714,
29 | "main-window-is-maximized": 1,
30 | "main-window-width": 1024,
31 | "main-window-x": 0,
32 | "main-window-y": 30,
33 | "message-level": 2,
34 | "open-dialog-dir": "",
35 | "peer-congestion-algorithm": "",
36 | "peer-id-ttl-hours": 6,
37 | "peer-limit-global": 240,
38 | "peer-limit-per-torrent": 60,
39 | "peer-port": 51413,
40 | "peer-port-random-high": 65535,
41 | "peer-port-random-low": 49152,
42 | "peer-port-random-on-start": true,
43 | "peer-socket-tos": "default",
44 | "pex-enabled": true,
45 | "port-forwarding-enabled": true,
46 | "preallocation": 1,
47 | "prefetch-enabled": 1,
48 | "queue-stalled-enabled": true,
49 | "queue-stalled-minutes": 30,
50 | "ratio-limit": 2,
51 | "ratio-limit-enabled": true,
52 | "rename-partial-files": true,
53 | "rpc-authentication-required": false,
54 | "rpc-bind-address": "127.0.0.1",
55 | "rpc-enabled": true,
56 | "rpc-password": "{b4d2e6b7db60f3e639b78f7ed869f1264c4f04f0U.hFGv21",
57 | "rpc-port": 9091,
58 | "rpc-url": "/transmission/",
59 | "rpc-username": "",
60 | "rpc-whitelist": "127.0.0.1",
61 | "rpc-whitelist-enabled": true,
62 | "scrape-paused-torrents-enabled": true,
63 | "script-torrent-done-enabled": false,
64 | "script-torrent-done-filename": "",
65 | "seed-queue-enabled": false,
66 | "seed-queue-size": 10,
67 | "show-backup-trackers": true,
68 | "show-extra-peer-details": false,
69 | "show-filterbar": true,
70 | "show-notification-area-icon": true,
71 | "show-options-window": true,
72 | "show-statusbar": true,
73 | "show-toolbar": false,
74 | "show-tracker-scrapes": true,
75 | "sort-mode": "sort-by-name",
76 | "sort-reversed": false,
77 | "speed-limit-down": 100,
78 | "speed-limit-down-enabled": false,
79 | "speed-limit-up": 100,
80 | "speed-limit-up-enabled": false,
81 | "start-added-torrents": true,
82 | "statusbar-stats": "total-ratio",
83 | "torrent-added-notification-enabled": false,
84 | "torrent-complete-notification-enabled": true,
85 | "torrent-complete-sound-command": "canberra-gtk-play -i complete-download -d 'transmission torrent downloaded'",
86 | "torrent-complete-sound-enabled": false,
87 | "trash-can-enabled": true,
88 | "trash-original-torrent-files": false,
89 | "umask": 18,
90 | "upload-slots-per-torrent": 14,
91 | "user-has-given-informed-consent": false,
92 | "utp-enabled": true,
93 | "watch-dir": "",
94 | "watch-dir-enabled": false
95 | }
96 |
97 |
--------------------------------------------------------------------------------
/src/.purple/prefs.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
48 |
49 |
50 |
51 |
52 |
53 |
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 |
76 |
77 |
78 |
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
91 |
92 |
93 |
94 |
95 |
96 |
97 |
98 |
99 |
100 |
101 |
102 |
103 |
104 |
105 |
106 |
107 |
108 |
109 |
110 |
111 |
112 |
113 |
114 |
115 |
116 |
117 |
118 |
119 |
120 |
121 |
122 |
123 |
124 |
125 |
126 |
127 |
128 |
129 |
130 |
131 |
132 |
133 |
134 |
135 |
136 |
137 |
138 |
139 |
140 |
141 |
142 |
143 |
144 |
145 |
146 |
147 |
148 |
149 |
150 |
151 |
152 |
153 |
154 |
155 |
156 |
157 |
158 |
159 |
160 |
161 |
162 |
163 |
164 |
165 |
166 |
167 |
168 |
169 |
170 |
171 |
172 |
173 |
174 |
175 |
176 |
177 |
178 |
179 |
180 |
181 |
182 |
183 |
184 |
185 |
186 |
187 |
188 |
189 |
190 |
191 |
192 |
193 |
194 |
195 |
196 |
197 |
198 |
199 |
200 |
201 |
202 |
203 |
204 |
205 |
206 |
207 |
208 |
209 |
210 |
211 |
212 |
213 |
214 |
215 |
216 |
217 |
218 |
219 |
220 |
221 |
222 |
223 |
224 |
225 |
226 |
227 |
228 |
229 |
230 |
231 |
232 |
233 |
234 |
235 |
236 |
237 |
238 |
239 |
240 |
241 |
242 |
243 |
244 |
245 |
246 |
247 |
248 |
249 |
250 |
251 |
252 |
253 |
254 |
255 |
256 |
257 |
258 |
259 |
260 |
261 |
262 |
263 |
264 |
265 |
266 |
267 |
268 |
269 |
270 |
271 |
272 |
273 |
274 |
275 |
276 |
277 |
278 |
279 |
280 |
281 |
282 |
283 |
284 |
285 |
286 |
287 |
288 |
289 |
290 |
291 |
292 |
293 |
294 |
295 |
296 |
297 |
298 |
299 |
300 |
301 |
302 |
303 |
304 |
305 |
306 |
307 |
308 |
309 |
310 |
311 |
312 |
313 |
314 |
315 |
316 |
317 |
318 |
319 |
320 |
321 |
322 |
323 |
324 |
325 |
326 |
327 |
328 |
329 |
330 |
331 |
332 |
333 |
334 |
335 |
336 |
337 |
338 |
339 |
340 |
341 |
342 |
343 |
344 |
345 |
346 |
347 |
348 |
349 |
350 |
351 |
352 |
353 |
354 |
355 |
356 |
357 |
358 |
359 |
360 |
361 |
362 |
363 |
364 |
365 |
366 |
367 |
368 |
369 |
370 |
371 |
372 |
373 |
374 |
375 |
376 |
377 |
378 |
379 |
380 |
381 |
382 |
383 |
384 |
385 |
386 |
387 |
388 |
389 |
390 |
391 |
392 |
393 |
394 |
395 |
396 |
397 |
398 |
399 |
400 |
401 |
402 |
403 |
404 |
405 |
406 |
407 |
408 |
409 |
410 |
411 |
412 |
413 |
414 |
415 |
416 |
417 |
418 |
419 |
420 |
421 |
422 |
--------------------------------------------------------------------------------