Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-15 23:07:09 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add option to disable the entire IPv6 stack functionality

Browse Source
This commit is contained in:
Raja Grewal 2024-07-15 01:59:04 +10:00
parent a33d4cd099
commit f550fbe07c
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -113,6 +113,8 @@ configuration file.
- Obtain more entropy at boot from RAM as the runtime memory allocator is
being initialised.
- Provide option to disable the entire IPv6 stack to reduce attack surface.
Disallow sensitive kernel information leaks in the console during boot. See
the `/etc/default/grub.d/40_quiet_boot.cfg` configuration file.

15
etc/default/grub.d/40_kernel_hardening.cfg
View File

@ -9,6 +9,7 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru
## 1. Kernel Space
## 2. Direct Memory Access
## 3. Entropy
## 4. Networking
## See the documentation below for details on the majority of the selected commands.
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
@ -171,3 +172,17 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy"
## 4. Networking
##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-boot-parameters
## Disable the entire IPv6 stack functionality.
## Removes attack surface associated with the IPv6 module.
##
## https://www.kernel.org/doc/html/latest/networking/ipv6.html
## https://wiki.archlinux.org/title/IPv6#Disable_IPv6
##
## Enabling makes redundant many network hardening sysctl's in usr/lib/sysctl.d/990-security-misc.conf.
##
#ipv6.disable=1