mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-26 23:51:12 +07:00
Code Issues Packages Projects Releases Wiki Activity

readme

Browse Source
This commit is contained in:
Patrick Schleizer 2016-11-21 17:42:55 +00:00
parent 6cda8b1496
commit 4416ea5cf9
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 24 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
README.md
View File

@ -1,14 +1,12 @@
# enhances misc security settings # # enhances misc security settings #
- deactivates previews in Dolphin The following settings are changed:
- deactivates previews in Nautilus
- deactivates TCP timestamps deactivates previews in Dolphin;
- deactivates Netfilter's connection tracking helper deactivates previews in Nautilus;
. deactivates TCP timestamps;
Changes to the file browser only take effect for newly created user accounts. Not for deactivates Netfilter's connection tracking helper;
existing user accounts. This package is most useful to help Linux distribution
maintainers setting divergent defaults.
.
TCP time stamps (rfc 1323) allow for tracking clock TCP time stamps (rfc 1323) allow for tracking clock
information with millisecond resolution. This may or may not allow an information with millisecond resolution. This may or may not allow an
attacker to learn information about the system clock at such attacker to learn information about the system clock at such
@ -20,29 +18,29 @@ system has been running, and to distinguish several
systems running behind NAT and using the same IP address. It might systems running behind NAT and using the same IP address. It might
also allow to look for clocks that match an expected value to find the also allow to look for clocks that match an expected value to find the
public IP used by a user. public IP used by a user.
.
Hence, this package disables this feature by shipping the Hence, this package disables this feature by shipping the
/etc/sysctl.d/tcp_timestamps.conf configuration file. /etc/sysctl.d/tcp_timestamps.conf configuration file.
.
Note that TCP time stamps normally have some usefulness. They are Note that TCP time stamps normally have some usefulness. They are
needed for: needed for:
.
* the TCP protection against wrapped sequence numbers; however, to * the TCP protection against wrapped sequence numbers; however, to
trigger a wrap, one needs to send roughly 2^32 packets in one trigger a wrap, one needs to send roughly 2^32 packets in one
minute: as said in rfc 1700, "The current recommended default minute: as said in rfc 1700, "The current recommended default
time to live (TTL) for the Internet Protocol (IP) [45,105] is 64". time to live (TTL) for the Internet Protocol (IP) [45,105] is 64".
So, this probably won't be a practical problem in the context So, this probably won't be a practical problem in the context
of Anonymity Distributions. of Anonymity Distributions.
.
* "Round-Trip Time Measurement", which is only useful when the user * "Round-Trip Time Measurement", which is only useful when the user
manages to saturate their connection. When using Anonymity Distributions, manages to saturate their connection. When using Anonymity Distributions,
probably the limiting factor for transmission speed is rarely the capacity probably the limiting factor for transmission speed is rarely the capacity
of the user connection. of the user connection.
.
Netfilter's connection tracking helper module increases kernel attack Netfilter's connection tracking helper module increases kernel attack
surface by enabling superfluous functionality such as IRC parsing in surface by enabling superfluous functionality such as IRC parsing in
the kernel (!) the kernel (!)
.
Hence, this package disables this feature by shipping the Hence, this package disables this feature by shipping the
/etc/sysctl.d/nf_conntrack_helper.conf configuration file. /etc/sysctl.d/nf_conntrack_helper.conf configuration file.
@ -93,7 +91,7 @@ gpg --export 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA | sudo apt-key add -
3\. Add Whonix's APT repository. 3\. Add Whonix's APT repository.
``` ```
echo "deb http://sourceforge.net/projects/whonixdevelopermetafiles/files/internal/ wheezy main" > /etc/apt/sources.list.d/whonix.list echo "deb http://deb.whonix.org jessie main" > /etc/apt/sources.list.d/whonix.list
``` ```
4\. Update your package lists. 4\. Update your package lists.