Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-13 02:19:28 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix bluetooth in readme

Browse Source 
fixes https://github.com/Kicksecure/security-misc/issues/180
This commit is contained in:
Patrick Schleizer 2023-12-25 09:10:31 -05:00
parent 37b4ab15a8
commit 0810c1ce3c
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 25 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
README.md
View File

@ -236,24 +236,34 @@ See:
- `/usr/lib/NetworkManager/conf.d/80_randomize-mac.conf`
- `/usr/lib/systemd/networkd.conf.d/80_ipv6-privacy-extensions.conf`
## Network & Bluetooth hardening
## Bluetooth Hardening
- Bluetooth is 'enabled' for the system. Unlike the usual default behavior, we
start bluetooth turned off on system start and it stays that way unless the
user explicitly chooses to turn bluetooth on. The user is left with the
freedom to easily switch bluetooth on and off the usual way with his own
discretion. We set significantly more private defaults for bluetooth
connections by enforcing private addresses and strict timeout settings for
discoverability and visibility. That being said, the most secure and private
bluetooth connection might inherently come with risks by its nature and may
be prone to exploits, as it has a history of having new security
vulnurabilities often. So users are recommended to choose not to use
bluetooth when given the option.
### Bluetooth Status: Enabled but Defaulted to Off
See:
- **Default Behavior**: Although Bluetooth capability is 'enabled' in the kernel, security-misc deviates from the usual behavior by starting with Bluetooth turned off at system start. This setting remains until the user explicitly opts to activate Bluetooth.
- `/etc/bluetooth/30_security-misc.conf`
- https://github.com/Kicksecure/security-misc/pull/145
- **User Control**: Users have the freedom to easily switch Bluetooth on and off in the usual way, exercising their own discretion. This can be done via the Bluetooth toggle through the usual way, that is either through GUI settings application or command line commands.
- **Enhanced Privacy Settings**: We enforce more private defaults for Bluetooth connections. This includes the use of private addresses and strict timeout settings for discoverability and visibility.
- **Security Considerations**: Despite these measures, it's important to note that Bluetooth technology, by its nature, may still be prone to exploits due to its history of security vulnerabilities. Thus, we recommend users to opt-out of using Bluetooth when possible.
### Configuration Details
- See configuration: `/etc/bluetooth/30_security-misc.conf`
- For more information and discussion: [GitHub Pull Request](https://github.com/Kicksecure/security-misc/pull/145)
### Understanding Bluetooth Terms
- **Disabling Bluetooth**: This means the absence of the Bluetooth kernel module. When disabled, Bluetooth is non-existent in the system - it cannot be seen, set, configured, or interacted with in any way.
- **Turning Bluetooth On/Off**: This refers to a software toggle. Normally, on Debian systems, Bluetooth is 'on' when the system boots up. It actively searches for known devices to auto-connect and may be discoverable or visible under certain conditions. Our default ensures that Bluetooth is off on startup. However, it remains 'enabled' in the kernel, meaning the kernel can use the Bluetooth protocol and has the necessary modules.
### Quick Toggle Guide
- **Turning Bluetooth On**: Simply click the Bluetooth button in the settings application or on the tray, and switch the toggle. It's a straightforward action that can be completed in less than a second.
- **Turning Bluetooth Off**: Follow the same procedure as turning it on but switch the toggle to the off position.
## Entropy collection improvements