## Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP ## See the file COPYING for copying conditions. Source: security-misc Section: misc Priority: optional Maintainer: Patrick Schleizer Build-Depends: debhelper (>= 12), genmkfile, config-package-dev Homepage: https://github.com/Whonix/security-misc Vcs-Browser: https://github.com/Whonix/security-misc Vcs-Git: https://github.com/Whonix/security-misc.git Standards-Version: 4.3.0 Package: security-misc Architecture: all Depends: python, libglib2.0-bin, libpam-runtime, libpam-cgfs, ${misc:Depends} Replaces: tcp-timestamps-disable Description: enhances misc security settings The following settings are changed: . deactivates previews in Dolphin; deactivates previews in Nautilus; deactivates thumbnails in Thunar; deactivates TCP timestamps; deactivates Netfilter's connection tracking helper; implements some kernel hardening; prevents DMA attacks; restricts access to the root account; increases the amount of hashing rounds used by shadow; . TCP time stamps (RFC 1323) allow for tracking clock information with millisecond resolution. This may or may not allow an attacker to learn information about the system clock at such a resolution, depending on various issues such as network lag. This information is available to anyone who monitors the network somewhere between the attacked system and the destination server. It may allow an attacker to find out how long a given system has been running, and to distinguish several systems running behind NAT and using the same IP address. It might also allow one to look for clocks that match an expected value to find the public IP used by a user. . Hence, this package disables this feature by shipping the /etc/sysctl.d/tcp_timestamps.conf configuration file. . Note that TCP time stamps normally have some usefulness. They are needed for: . * the TCP protection against wrapped sequence numbers; however, to trigger a wrap, one needs to send roughly 2^32 packets in one minute: as said in RFC 1700, "The current recommended default time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". So, this probably won't be a practical problem in the context of Anonymity Distributions. . * "Round-Trip Time Measurement", which is only useful when the user manages to saturate their connection. When using Anonymity Distributions, probably the limiting factor for transmission speed is rarely the capacity of the user connection. . Netfilter's connection tracking helper module increases kernel attack surface by enabling superfluous functionality such as IRC parsing in the kernel. (!) . Hence, this package disables this feature by shipping the /etc/modprobe.d/30_nf_conntrack_helper_disable.conf configuration file. . Kernel symbols in /proc/kallsyms are hidden to prevent malware from reading them and using them to learn more about what to attack on your system. . Kexec is disabled as it can be used for live patching of the running kernel. . The BPF JIT compiler is restricted to the root user and is hardened. . ASLR effectiveness for mmap is increased. . The ptrace system call is restricted to the root user only. . The TCP/IP stack is hardened. . This package makes some data spoofing attacks harder. . SACK is disabled as it is commonly exploited and is rarely used. . This package disables the merging of slabs of similar sizes to prevent an attacker from exploiting them. . Sanity checks, redzoning, and memory poisoning are enabled. . The kernel now panics on uncorrectable errors in ECC memory which could be exploited. . Kernel Page Table Isolation is enabled to mitigate Meltdown and increase KASLR effectiveness. . SMT is disabled as it can be used to exploit the MDS vulnerability. . All mitigations for the MDS vulnerability are enabled. . Uncommon network protocols are blacklisted as they are rarely used and may have unknown vulnerabilities. . The kernel logs are restricted to root only. . A systemd service clears System.map on boot as these contain kernel symbols that could be useful to an attacker. . The SysRq key is restricted to only allow shutdowns/reboots. . The thunderbolt and firewire modules are blacklisted as they can be used for DMA (Direct Memory Access) attacks. . IOMMU is enabled with a boot parameter to prevent DMA attacks. . Coredumps are disabled as they may contain important information such as encryption keys or passwords. . A systemd service mounts /proc with hidepid=2 at boot to prevent users from seeing each other's processes. . The default umask is changed to 006. This allows only the owner and group to read and write to newly created files. . The kernel now panics on oopses to prevent it from continuing running a flawed process. . Su is restricted to only users within the root group which prevents users from using su to gain root access or switch user accounts. . Logging into the root account from a terminal is prevented. . The amount of hashing rounds used by shadow is bumped to 65536. This increases the security of hashed passwords.