mkimage-profiles/features.in/control/config.mk

use/control:
	@$(call add_feature)
	@$(call add,THE_PACKAGES,control)
	@$(call xport,CONTROL)

# some presets
use/control/sudo-su: use/control
	@$(call add,CONTROL,su:public sudo:public)

# recommended by ldv@ ;-)
# note that:
# - sshd-allow-groups results in "AllowGroups wheel users"
# - unprivileged su is used to drop privileges, not gain those
use/control/server/ldv: use/control
	@$(call add,CONTROL,mount:unprivileged)
	@$(call add,CONTROL,passwdqc-enforce:everyone)
	@$(call add,CONTROL,ping:netadmin)
	@$(call add,CONTROL,ping6:restricted)
	@$(call add,CONTROL,postqueue:mailadm)
	@$(call add,CONTROL,sftp:disabled)
	@$(call add,CONTROL,sshd-allow-groups:enabled)
	@$(call add,CONTROL,sshd-password-auth:disabled)
	@$(call add,CONTROL,su:restricted)
initial control feature TODO--, and this one was pretty expected after the "invention" of iterators. 2013-07-05 22:43:16 +04:00			`use/control:`
			`@$(call add_feature)`
			`@$(call add,THE_PACKAGES,control)`
			`@$(call xport,CONTROL)`

			`# some presets`
control: fix sudo-su target use/control/sudo-su apparently lacked dependency on plain use/control thus defeating the whole affair; thanks msp@ for spotting and reporting this. 2013-08-06 15:02:33 +04:00			`use/control/sudo-su: use/control`
initial control feature TODO--, and this one was pretty expected after the "invention" of iterators. 2013-07-05 22:43:16 +04:00			`@$(call add,CONTROL,su:public sudo:public)`
control: added some actual ldv@'s settings As noted in the comment, these include a few quite strong ones: - sshd(8) will only allow in "wheel" and "users" members by keys, no password access is allowed; - password change even by root is subject to quality checks; - su(8) is only useful to lower privileges and not gain those (so root access is available either through local console or via use of ssh keys). Don't use if frowned upon. 2016-01-29 22:29:45 +03:00
			`# recommended by ldv@ ;-)`
			`# note that:`
			`# - sshd-allow-groups results in "AllowGroups wheel users"`
			`# - unprivileged su is used to drop privileges, not gain those`
			`use/control/server/ldv: use/control`
			`@$(call add,CONTROL,mount:unprivileged)`
			`@$(call add,CONTROL,passwdqc-enforce:everyone)`
			`@$(call add,CONTROL,ping:netadmin)`
			`@$(call add,CONTROL,ping6:restricted)`
			`@$(call add,CONTROL,postqueue:mailadm)`
			`@$(call add,CONTROL,sftp:disabled)`
			`@$(call add,CONTROL,sshd-allow-groups:enabled)`
			`@$(call add,CONTROL,sshd-password-auth:disabled)`
			`@$(call add,CONTROL,su:restricted)`