2018-01-29 10:22:05 -05:00
|
|
|
## Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
|
2015-12-14 21:00:24 -05:00
|
|
|
## See the file COPYING for copying conditions.
|
|
|
|
|
|
|
|
Source: security-misc
|
|
|
|
Section: misc
|
|
|
|
Priority: optional
|
|
|
|
Maintainer: Patrick Schleizer <adrelanos@riseup.net>
|
2019-07-01 09:35:45 -04:00
|
|
|
Build-Depends: debhelper (>= 12), genmkfile, config-package-dev
|
2015-12-14 21:00:24 -05:00
|
|
|
Homepage: https://github.com/Whonix/security-misc
|
|
|
|
Vcs-Browser: https://github.com/Whonix/security-misc
|
|
|
|
Vcs-Git: https://github.com/Whonix/security-misc.git
|
2019-04-04 05:51:06 -04:00
|
|
|
Standards-Version: 4.3.0
|
2015-12-14 21:00:24 -05:00
|
|
|
|
|
|
|
Package: security-misc
|
|
|
|
Architecture: all
|
2019-07-07 19:39:58 -04:00
|
|
|
Depends: python, libglib2.0-bin, libpam-runtime, libpam-cgfs, ${misc:Depends}
|
2016-03-31 11:36:59 -04:00
|
|
|
Replaces: tcp-timestamps-disable
|
2015-12-14 21:00:24 -05:00
|
|
|
Description: enhances misc security settings
|
2016-03-31 11:53:40 -04:00
|
|
|
The following settings are changed:
|
|
|
|
.
|
|
|
|
deactivates previews in Dolphin;
|
|
|
|
deactivates previews in Nautilus;
|
2018-10-31 02:26:13 -04:00
|
|
|
deactivates thumbnails in Thunar;
|
2016-03-31 11:53:40 -04:00
|
|
|
deactivates TCP timestamps;
|
|
|
|
deactivates Netfilter's connection tracking helper;
|
2019-06-28 07:33:48 -04:00
|
|
|
implements some kernel hardening;
|
|
|
|
prevents DMA attacks;
|
2019-07-08 19:24:41 -04:00
|
|
|
restricts access to the root account;
|
|
|
|
increases the amount of hashing rounds used by shadow;
|
2016-03-31 11:53:40 -04:00
|
|
|
.
|
2017-02-19 17:37:10 -05:00
|
|
|
TCP time stamps (RFC 1323) allow for tracking clock
|
2016-03-31 11:53:40 -04:00
|
|
|
information with millisecond resolution. This may or may not allow an
|
|
|
|
attacker to learn information about the system clock at such
|
|
|
|
a resolution, depending on various issues such as network lag.
|
|
|
|
This information is available to anyone who monitors the network
|
|
|
|
somewhere between the attacked system and the destination server.
|
|
|
|
It may allow an attacker to find out how long a given
|
|
|
|
system has been running, and to distinguish several
|
|
|
|
systems running behind NAT and using the same IP address. It might
|
2017-01-15 08:11:38 -05:00
|
|
|
also allow one to look for clocks that match an expected value to find the
|
2016-03-31 11:53:40 -04:00
|
|
|
public IP used by a user.
|
|
|
|
.
|
|
|
|
Hence, this package disables this feature by shipping the
|
|
|
|
/etc/sysctl.d/tcp_timestamps.conf configuration file.
|
|
|
|
.
|
|
|
|
Note that TCP time stamps normally have some usefulness. They are
|
|
|
|
needed for:
|
|
|
|
.
|
|
|
|
* the TCP protection against wrapped sequence numbers; however, to
|
|
|
|
trigger a wrap, one needs to send roughly 2^32 packets in one
|
2017-02-19 17:37:10 -05:00
|
|
|
minute: as said in RFC 1700, "The current recommended default
|
2016-03-31 11:53:40 -04:00
|
|
|
time to live (TTL) for the Internet Protocol (IP) [45,105] is 64".
|
|
|
|
So, this probably won't be a practical problem in the context
|
|
|
|
of Anonymity Distributions.
|
|
|
|
.
|
|
|
|
* "Round-Trip Time Measurement", which is only useful when the user
|
|
|
|
manages to saturate their connection. When using Anonymity Distributions,
|
|
|
|
probably the limiting factor for transmission speed is rarely the capacity
|
|
|
|
of the user connection.
|
|
|
|
.
|
|
|
|
Netfilter's connection tracking helper module increases kernel attack
|
|
|
|
surface by enabling superfluous functionality such as IRC parsing in
|
2017-02-19 17:37:10 -05:00
|
|
|
the kernel. (!)
|
2016-03-31 11:53:40 -04:00
|
|
|
.
|
|
|
|
Hence, this package disables this feature by shipping the
|
2019-06-28 07:33:48 -04:00
|
|
|
/etc/modprobe.d/30_nf_conntrack_helper_disable.conf configuration file.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
Kernel symbols in /proc/kallsyms are hidden to prevent malware from
|
|
|
|
reading them and using them to learn more about what to attack on your system.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
Kexec is disabled as it can be used for live patching of the running kernel.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
The BPF JIT compiler is restricted to the root user and is hardened.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
ASLR effectiveness for mmap is increased.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
The ptrace system call is restricted to the root user only.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
The TCP/IP stack is hardened.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
This package makes some data spoofing attacks harder.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
SACK is disabled as it is commonly exploited and is rarely used.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
This package disables the merging of slabs of similar sizes to prevent an
|
|
|
|
attacker from exploiting them.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
Sanity checks, redzoning, and memory poisoning are enabled.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
The kernel now panics on uncorrectable errors in ECC memory which could
|
|
|
|
be exploited.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
Kernel Page Table Isolation is enabled to mitigate Meltdown and increase
|
|
|
|
KASLR effectiveness.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
SMT is disabled as it can be used to exploit the MDS vulnerability.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-06-23 15:26:03 -04:00
|
|
|
All mitigations for the MDS vulnerability are enabled.
|
2019-06-23 15:47:05 -04:00
|
|
|
.
|
2019-07-11 14:26:17 -04:00
|
|
|
Uncommon network protocols are blacklisted in
|
|
|
|
/etc/modprobe.d/uncommon-network-protocols.conf as they are rarely used and
|
2019-07-06 09:56:00 -04:00
|
|
|
may have unknown vulnerabilities.
|
2019-06-28 07:34:35 -04:00
|
|
|
.
|
2019-07-11 14:26:17 -04:00
|
|
|
The network protocols that are blacklisted are:
|
|
|
|
.
|
|
|
|
* DCCP - Datagram Congestion Control Protocol
|
|
|
|
* SCTP - Stream Control Transmission Protocol
|
|
|
|
* RDS - Reliable Datagram Sockets
|
|
|
|
* TIPC - Transparent Inter-process Communication
|
|
|
|
* HDLC - High-Level Data Link Control
|
|
|
|
* AX25 - Amateur X.25
|
|
|
|
* NetRom
|
|
|
|
* X25
|
|
|
|
* ROSE
|
|
|
|
* DECnet
|
|
|
|
* Econet
|
|
|
|
* af_802154 - IEEE 802.15.4
|
|
|
|
* IPX - Internetwork Packet Exchange
|
|
|
|
* AppleTalk
|
|
|
|
* PSNAP - Subnetwork Access Protocol
|
|
|
|
* p8023 - Novell raw IEEE 802.3
|
|
|
|
* LLC - IEEE 802.2
|
|
|
|
* p8022 - IEEE 802.2
|
2019-07-11 11:26:14 -04:00
|
|
|
.
|
2019-06-28 07:33:48 -04:00
|
|
|
The kernel logs are restricted to root only.
|
2019-06-28 07:34:35 -04:00
|
|
|
.
|
2019-06-29 06:34:48 -04:00
|
|
|
A systemd service clears System.map on boot as these contain kernel symbols
|
|
|
|
that could be useful to an attacker.
|
2019-06-28 07:34:35 -04:00
|
|
|
.
|
2019-06-28 07:33:48 -04:00
|
|
|
The SysRq key is restricted to only allow shutdowns/reboots.
|
2019-06-28 07:34:35 -04:00
|
|
|
.
|
2019-06-29 06:34:48 -04:00
|
|
|
The thunderbolt and firewire modules are blacklisted as they can be used for
|
|
|
|
DMA (Direct Memory Access) attacks.
|
2019-06-28 07:34:35 -04:00
|
|
|
.
|
2019-06-28 07:33:48 -04:00
|
|
|
IOMMU is enabled with a boot parameter to prevent DMA attacks.
|
2019-06-29 20:21:46 -04:00
|
|
|
.
|
2019-06-30 04:11:38 -04:00
|
|
|
Coredumps are disabled as they may contain important information such as
|
|
|
|
encryption keys or passwords.
|
2019-06-29 18:30:41 -04:00
|
|
|
.
|
2019-06-30 04:11:38 -04:00
|
|
|
A systemd service mounts /proc with hidepid=2 at boot to prevent users from
|
|
|
|
seeing each other's processes.
|
2019-06-30 09:16:12 -04:00
|
|
|
.
|
2019-07-01 09:37:55 -04:00
|
|
|
The default umask is changed to 006. This allows only the owner and group to
|
|
|
|
read and write to newly created files.
|
2019-07-08 19:04:47 -04:00
|
|
|
.
|
2019-07-13 12:20:14 -04:00
|
|
|
Removes read, write and execute access for others for all users who have home
|
|
|
|
folders under folder /home by running for example "chmod o-rwx /home/user"
|
|
|
|
during package installation or upgrade. This will be done only once per folder
|
|
|
|
in folder /home so users who wish to relax file permissions are free to do so.
|
|
|
|
This is to protect previously created files in user home folder which were
|
|
|
|
previously created with lax file permissions prior installation of this
|
|
|
|
package.
|
|
|
|
.
|
2019-07-08 19:04:47 -04:00
|
|
|
The kernel now panics on oopses to prevent it from continuing running a
|
|
|
|
flawed process.
|
2019-07-09 06:54:24 -04:00
|
|
|
.
|
2019-07-08 19:24:41 -04:00
|
|
|
Su is restricted to only users within the root group which prevents users from
|
|
|
|
using su to gain root access or switch user accounts.
|
|
|
|
.
|
|
|
|
Logging into the root account from a terminal is prevented.
|
|
|
|
.
|
|
|
|
The amount of hashing rounds used by shadow is bumped to 65536. This increases
|
|
|
|
the security of hashed passwords.
|