diff --git a/README.md b/README.md index 3898143..d196675 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,7 @@ Hardening applied: - Installing Chromium instead of Firefox in the base image [Why chromium?](https://grapheneos.org/usage#web-browsing) [Why not flatpak chromium?](https://forum.vivaldi.net/post/669805) - Including a hardened chromium config that sets numerous hardened defaults [details](https://github.com/secureblue/secureblue/blob/live/config/files/usr/etc/chromium/policies/managed/hardening.json.readme.md) and disables JIT javascript [why?](https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/#is-jit-worth-it) - Pushing upstream fedora to harden the build for all fedora users, including secureblue users ([for example, by enabling CFI](https://bugzilla.redhat.com/show_bug.cgi?id=2252874)) -- Require a password for sudo every time it's called +- Reduce the sudo timeout to 1 minute - Disable passwordless sudo for `rpm-ostree install` [why?](https://github.com/rohanssrao/silverblue-privesc) - Brute force protection by locking user accounts for 24 hours after 50 failed login attempts, hardened password encryption and password quality suggestions - Installing chkrootkit, usbguard, and bubblejail diff --git a/config/files/usr/etc/sudoers.d/timeout b/config/files/usr/etc/sudoers.d/timeout index 098f4f1..845a2e9 100644 --- a/config/files/usr/etc/sudoers.d/timeout +++ b/config/files/usr/etc/sudoers.d/timeout @@ -1 +1 @@ -Defaults timestamp_timeout = 0 \ No newline at end of file +Defaults timestamp_timeout = 1 \ No newline at end of file