Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-07 13:52:40 -04:00
Code Issues Projects Releases Packages Wiki Activity

Add option to disable the entire IPv6 stack functionality

Browse source
This commit is contained in:
Raja Grewal 2024-07-15 01:59:04 +10:00
parent a33d4cd099
commit f550fbe07c
No known key found for this signature in database
GPG key ID: 92CA473C156B64C4
2 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -113,6 +113,8 @@ configuration file.
- Obtain more entropy at boot from RAM as the runtime memory allocator is - Obtain more entropy at boot from RAM as the runtime memory allocator is
being initialised. being initialised.
- Provide option to disable the entire IPv6 stack to reduce attack surface.
Disallow sensitive kernel information leaks in the console during boot. See Disallow sensitive kernel information leaks in the console during boot. See
the `/etc/default/grub.d/40_quiet_boot.cfg` configuration file. the `/etc/default/grub.d/40_quiet_boot.cfg` configuration file.

15
etc/default/grub.d/40_kernel_hardening.cfg
View file

@ -9,6 +9,7 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru
## 1. Kernel Space ## 1. Kernel Space
## 2. Direct Memory Access ## 2. Direct Memory Access
## 3. Entropy ## 3. Entropy
## 4. Networking
## See the documentation below for details on the majority of the selected commands. ## See the documentation below for details on the majority of the selected commands.
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html ## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
@ -171,3 +172,17 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"
## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4 ## https://github.com/anthraxx/linux-hardened/commit/a04458f97fe1f7e95888c77c0165b646375db9c4
## ##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX extra_latent_entropy"
## 4. Networking
##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-boot-parameters
## Disable the entire IPv6 stack functionality.
## Removes attack surface associated with the IPv6 module.
##
## https://www.kernel.org/doc/html/latest/networking/ipv6.html
## https://wiki.archlinux.org/title/IPv6#Disable_IPv6
##
## Enabling makes redundant many network hardening sysctl's in usr/lib/sysctl.d/990-security-misc.conf.
##
#ipv6.disable=1