mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-02 04:15:01 +07:00
Code Issues Packages Projects Releases Wiki Activity

description / comments

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-03 02:18:32 -05:00
parent d26ba05c47
commit 0c25a96b59
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
debian/control vendored
View File

@ -103,8 +103,12 @@ Description: enhances misc security settings
* Load jitterentropy_rng kernel module.
/usr/lib/modules-load.d/30_security-misc.conf
.
* Distrusts the CPU for initial entropy at boot as it is
not possible to audit and may be backdoored. /etc/default/grub.d/40_distrust_cpu.cfg
* Distrusts the CPU for initial entropy at boot as it is not possible to
audit, may contain weaknesses or a backdoor.
* https://en.wikipedia.org/wiki/RDRAND#Reception
* https://twitter.com/pid_eins/status/1149649806056280069
* For more references, see:
* /etc/default/grub.d/40_distrust_cpu.cfg
.
Uncommon network protocols are blacklisted:
These are rarely used and may have unknown vulnerabilities.

8
etc/default/grub.d/40_distrust_cpu.cfg
View File

@ -1,9 +1,11 @@
## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.
## Distrust the CPU for initial entropy as it is not possible to audit
## and may have unknown backdoors.
## Distrusts the CPU for initial entropy at boot as it is not possible to
## audit, may contain weaknesses or a backdoor.
##
## https://en.wikipedia.org/wiki/RDRAND#Reception
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566/
## https://twitter.com/pid_eins/status/1149649806056280069
## https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
## https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX random.trust_cpu=off"