From 5992a7f026b1ee22c1ab82411048b58e89ed0dc2 Mon Sep 17 00:00:00 2001 From: HulaHoopWhonix Date: Thu, 31 Mar 2016 02:48:06 +0000 Subject: [PATCH 1/6] Create tcp_timestamps.conf --- etc/sysctl.d/tcp_timestamps.conf | 1 + 1 file changed, 1 insertion(+) create mode 100644 etc/sysctl.d/tcp_timestamps.conf diff --git a/etc/sysctl.d/tcp_timestamps.conf b/etc/sysctl.d/tcp_timestamps.conf new file mode 100644 index 0000000..f47b8d3 --- /dev/null +++ b/etc/sysctl.d/tcp_timestamps.conf @@ -0,0 +1 @@ +net.ipv4.tcp_timestamps=0 From 92d738db56f048f2ee5de0239ddd6ba141373f99 Mon Sep 17 00:00:00 2001 From: HulaHoopWhonix Date: Thu, 31 Mar 2016 02:53:12 +0000 Subject: [PATCH 2/6] Create nf_conntrack_helper.conf --- etc/sysctl.d/nf_conntrack_helper.conf | 1 + 1 file changed, 1 insertion(+) create mode 100644 etc/sysctl.d/nf_conntrack_helper.conf diff --git a/etc/sysctl.d/nf_conntrack_helper.conf b/etc/sysctl.d/nf_conntrack_helper.conf new file mode 100644 index 0000000..a6bc3fb --- /dev/null +++ b/etc/sysctl.d/nf_conntrack_helper.conf @@ -0,0 +1 @@ +net.netfilter.nf_conntrack_helper=0 From 27200cd98f6d2be7e55765a8d17a075299db7b2e Mon Sep 17 00:00:00 2001 From: HulaHoopWhonix Date: Thu, 31 Mar 2016 02:57:15 +0000 Subject: [PATCH 3/6] Update README.md --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 1176221..79aee4b 100644 --- a/README.md +++ b/README.md @@ -2,8 +2,10 @@ - deactivates previews in Dolphin - deactivates previews in Nautilus +- deactivates TCP timestamps +- deactivates Netfilter's connection tracking helper -This package only takes effect for newly created user accounts. Not for +Changes to the file browser only take effect for newly created user accounts. Not for existing user accounts. This package is most useful to help Linux distribution maintainers setting divergent defaults. From c7d88571e48fface5fc24d7d471724303e374f37 Mon Sep 17 00:00:00 2001 From: HulaHoopWhonix Date: Thu, 31 Mar 2016 03:16:10 +0000 Subject: [PATCH 4/6] Update control --- debian/control | 47 ++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/debian/control b/debian/control index da44545..2163aa8 100644 --- a/debian/control +++ b/debian/control @@ -16,8 +16,45 @@ Architecture: all Depends: ${misc:Depends} Description: enhances misc security settings - deactivates previews in Dolphin - - deactivates previews in Nautilus - . - This package only takes effect for newly created user accounts. Not for - existing user accounts. This package is most useful to help Linux distribution - maintainers setting divergent defaults. +- deactivates previews in Nautilus +- deactivates TCP timestamps +- deactivates Netfilter's connection tracking helper +. +Changes to the file browser only take effect for newly created user accounts. Not for +existing user accounts. This package is most useful to help Linux distribution +maintainers setting divergent defaults. +. +TCP time stamps (rfc 1323) allow for tracking clock +information with millisecond resolution. This may or may not allow an +attacker to learn information about the system clock at such +a resolution, depending on various issues such as network lag. +This information is available to anyone who monitors the network +somewhere between the attacked system and the destination server. +It may allow an attacker to find out how long a given +system has been running, and to distinguish several +systems running behind NAT and using the same IP address. It might +also allow to look for clocks that match an expected value to find the +public IP used by a user. +. +Hence, this package disables this feature by shipping the +/etc/sysctl.d/tcp_timestamps.conf configuration file. +. +Note that TCP time stamps normally have some usefulness. They are +needed for: +. +* the TCP protection against wrapped sequence numbers; however, to + trigger a wrap, one needs to send roughly 2^32 packets in one + minute: as said in rfc 1700, "The current recommended default + time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". + So, this probably won't be a practical problem in the context + of Anonymity Distributions. +. +* "Round-Trip Time Measurement", which is only useful when the user + manages to saturate their connection. When using Anonymity Distributions, + probably the limiting factor for transmission speed is rarely the capacity + of the user connection. +. +Netfilter's connection tracking helper module increases kernel attack surface by enabling superfluous functionality such as IRC parsing in the kernel (!) +. +Hence, this package disables this feature by shipping the +/etc/sysctl.d/nf_conntrack_helper.conf configuration file. From 989f2f54e22ff676df83463edaca439a4695af49 Mon Sep 17 00:00:00 2001 From: HulaHoopWhonix Date: Thu, 31 Mar 2016 03:18:05 +0000 Subject: [PATCH 5/6] Update control --- debian/control | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/debian/control b/debian/control index 2163aa8..f404fc1 100644 --- a/debian/control +++ b/debian/control @@ -15,7 +15,7 @@ Package: security-misc Architecture: all Depends: ${misc:Depends} Description: enhances misc security settings - - deactivates previews in Dolphin +- deactivates previews in Dolphin - deactivates previews in Nautilus - deactivates TCP timestamps - deactivates Netfilter's connection tracking helper @@ -54,7 +54,9 @@ needed for: probably the limiting factor for transmission speed is rarely the capacity of the user connection. . -Netfilter's connection tracking helper module increases kernel attack surface by enabling superfluous functionality such as IRC parsing in the kernel (!) +Netfilter's connection tracking helper module increases kernel attack +surface by enabling superfluous functionality such as IRC parsing in +the kernel (!) . Hence, this package disables this feature by shipping the /etc/sysctl.d/nf_conntrack_helper.conf configuration file. From d0eceae0c84a42bce4ade28c593fd6ba002a67b9 Mon Sep 17 00:00:00 2001 From: HulaHoopWhonix Date: Thu, 31 Mar 2016 03:18:38 +0000 Subject: [PATCH 6/6] Update README.md --- README.md | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 79aee4b..8561e75 100644 --- a/README.md +++ b/README.md @@ -4,10 +4,47 @@ - deactivates previews in Nautilus - deactivates TCP timestamps - deactivates Netfilter's connection tracking helper - +. Changes to the file browser only take effect for newly created user accounts. Not for existing user accounts. This package is most useful to help Linux distribution maintainers setting divergent defaults. +. +TCP time stamps (rfc 1323) allow for tracking clock +information with millisecond resolution. This may or may not allow an +attacker to learn information about the system clock at such +a resolution, depending on various issues such as network lag. +This information is available to anyone who monitors the network +somewhere between the attacked system and the destination server. +It may allow an attacker to find out how long a given +system has been running, and to distinguish several +systems running behind NAT and using the same IP address. It might +also allow to look for clocks that match an expected value to find the +public IP used by a user. +. +Hence, this package disables this feature by shipping the +/etc/sysctl.d/tcp_timestamps.conf configuration file. +. +Note that TCP time stamps normally have some usefulness. They are +needed for: +. +* the TCP protection against wrapped sequence numbers; however, to + trigger a wrap, one needs to send roughly 2^32 packets in one + minute: as said in rfc 1700, "The current recommended default + time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". + So, this probably won't be a practical problem in the context + of Anonymity Distributions. +. +* "Round-Trip Time Measurement", which is only useful when the user + manages to saturate their connection. When using Anonymity Distributions, + probably the limiting factor for transmission speed is rarely the capacity + of the user connection. +. +Netfilter's connection tracking helper module increases kernel attack +surface by enabling superfluous functionality such as IRC parsing in +the kernel (!) +. +Hence, this package disables this feature by shipping the +/etc/sysctl.d/nf_conntrack_helper.conf configuration file. (This package description has been [automatically](https://github.com/Whonix/whonix-developer-meta-files/blob/master/debug-steps/packaging-helper-script) extracted and mirrored from `debian/control`.)