security-misc/etc/modprobe.d/uncommon-network-protocols.conf

# Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.
#
# Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these.
# 
# > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.
#
# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
#
install dccp /bin/true
install sctp /bin/true
install rds /bin/true
install tipc /bin/true
install n-hdlc /bin/true
install ax25 /bin/true
install netrom /bin/true
install x25 /bin/true
install rose /bin/true
install decnet /bin/true
install econet /bin/true
install af_802154 /bin/true
install ipx /bin/true
install appletalk /bin/true
install psnap /bin/true
install p8023 /bin/true
install llc /bin/true
install p8022 /bin/true
Create uncommon-network-protocols.conf 2019-05-16 16:30:49 -04:00			`# Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.`
Update uncommon-network-protocols.conf 2019-07-11 11:28:56 -04:00			`#`
			`# Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these.`
			`#`
			`# > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.`
			`#`
			`# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.`
			`#`
Create uncommon-network-protocols.conf 2019-05-16 16:30:49 -04:00			`install dccp /bin/true`
			`install sctp /bin/true`
			`install rds /bin/true`
			`install tipc /bin/true`
Blacklist n-hdlc 2019-07-04 10:24:44 -04:00			`install n-hdlc /bin/true`
Blacklist more uncommon network protocols 2019-07-09 17:55:37 -04:00			`install ax25 /bin/true`
			`install netrom /bin/true`
			`install x25 /bin/true`
			`install rose /bin/true`
			`install decnet /bin/true`
			`install econet /bin/true`
			`install af_802154 /bin/true`
Blacklist more uncommon network protocols 2019-07-10 10:27:19 -04:00			`install ipx /bin/true`
			`install appletalk /bin/true`
			`install psnap /bin/true`
			`install p8023 /bin/true`
			`install llc /bin/true`
			`install p8022 /bin/true`