From 44ee76746ec6f23f3e67602770e4a04ab8471e95 Mon Sep 17 00:00:00 2001 From: Silvino Date: Sun, 9 Jun 2019 02:19:01 +0100 Subject: core index re-ordering and tools storage revision --- core/apparmor.html | 4 +- core/conf/sysctl.conf | 463 +---------------------------------------------- core/exim.html | 14 +- core/hardening.html | 48 +++-- core/index.html | 58 +++--- core/network.html | 41 +++-- core/package.html | 16 +- core/samhain.html | 8 +- core/sysctl.html | 481 ++----------------------------------------------- core/toolchain.html | 4 +- core/tty-terminal.html | 4 +- tools/storage.html | 61 ++++++- 12 files changed, 190 insertions(+), 1012 deletions(-) diff --git a/core/apparmor.html b/core/apparmor.html index 9954593..5c9b541 100644 --- a/core/apparmor.html +++ b/core/apparmor.html @@ -2,13 +2,13 @@ - 2.2.1. AppArmor + 2.6.1. AppArmor Core OS Index -

2.2.1. AppArmor

2.6.1. AppArmor

Check kernel configuration or use the provided with linux-gnu port diff --git a/core/conf/sysctl.conf b/core/conf/sysctl.conf index 4606791..771112a 100644 --- a/core/conf/sysctl.conf +++ b/core/conf/sysctl.conf @@ -3,50 +3,18 @@ # kernel.printk = 7 1 1 4 + kernel.randomize_va_space = 2 + # Shared Memory #kernel.shmmax = 500000000 # Total allocated file handlers that can be allocated # fs.file-nr= vm.mmap_min_addr=65536 + # Allow for more PIDs (to reduce rollover problems); may break some programs 32768 kernel.pid_max = 65536 -# -# Memory Protections -# - -# If you say Y here, all ioperm and iopl calls will return an error. -# Ioperm and iopl can be used to modify the running kernel. -# Unfortunately, some programs need this access to operate properly, -# the most notable of which are XFree86 and hwclock. hwclock can be -# remedied by having RTC support in the kernel, so real-time -# clock support is enabled if this option is enabled, to ensure -# that hwclock operates correctly. -# -# If you're using XFree86 or a version of Xorg from 2012 or earlier, -# you may not be able to boot into a graphical environment with this -# option enabled. In this case, you should use the RBAC system instead. -kernel.grsecurity.disable_priv_io = 1 - -# If you say Y here, attempts to bruteforce exploits against forking -# daemons such as apache or sshd, as well as against suid/sgid binaries -# will be deterred. When a child of a forking daemon is killed by PaX -# or crashes due to an illegal instruction or other suspicious signal, -# the parent process will be delayed 30 seconds upon every subsequent -# fork until the administrator is able to assess the situation and -# restart the daemon. -# In the suid/sgid case, the attempt is logged, the user has all their -# existing instances of the suid/sgid binary terminated and will -# be unable to execute any suid/sgid binaries for 15 minutes. -# -# It is recommended that you also enable signal logging in the auditing -# section so that logs are generated when a process triggers a suspicious -# signal. -# If the sysctl option is enabled, a sysctl option with name -# "deter_bruteforce" is created. -kernel.grsecurity.deter_bruteforce = 1 - # # Filesystem Protections # @@ -55,341 +23,9 @@ kernel.grsecurity.deter_bruteforce = 1 # Increase system file descriptor limit fs.file-max = 65535 -# If you say Y here, /tmp race exploits will be prevented, since users -# will no longer be able to follow symlinks owned by other users in -# world-writable +t directories (e.g. /tmp), unless the owner of the -# symlink is the owner of the directory. users will also not be -# able to hardlink to files they do not own. If the sysctl option is -# enabled, a sysctl option with name "linking_restrictions" is created. -kernel.grsecurity.linking_restrictions = 1 - - -# Apache's SymlinksIfOwnerMatch option has an inherent race condition -# that prevents it from being used as a security feature. As Apache -# verifies the symlink by performing a stat() against the target of -# the symlink before it is followed, an attacker can setup a symlink -# to point to a same-owned file, then replace the symlink with one -# that targets another user's file just after Apache "validates" the -# symlink -- a classic TOCTOU race. If you say Y here, a complete, -# race-free replacement for Apache's "SymlinksIfOwnerMatch" option -# will be in place for the group you specify. If the sysctl option -# is enabled, a sysctl option with name "enforce_symlinksifowner" is -# created. -kernel.grsecurity.enforce_symlinksifowner = 1 -kernel.grsecurity.symlinkown_gid = 15 - -# if you say Y here, users will not be able to write to FIFOs they don't -# own in world-writable +t directories (e.g. /tmp), unless the owner of -# the FIFO is the same owner of the directory it's held in. If the sysctl -# option is enabled, a sysctl option with name "fifo_restrictions" is -# created. -kernel.grsecurity.fifo_restrictions = 1 - -# If you say Y here, a sysctl option with name "romount_protect" will -# be created. By setting this option to 1 at runtime, filesystems -# will be protected in the following ways: -# * No new writable mounts will be allowed -# * Existing read-only mounts won't be able to be remounted read/write -# * Write operations will be denied on all block devices -# This option acts independently of grsec_lock: once it is set to 1, -# it cannot be turned off. Therefore, please be mindful of the resulting -# behavior if this option is enabled in an init script on a read-only -# filesystem. -# Also be aware that as with other root-focused features, GRKERNSEC_KMEM -# and GRKERNSEC_IO should be enabled and module loading disabled via -# config or at runtime. -# This feature is mainly intended for secure embedded systems. -#kernel.grsecurity.romount_protect = 1 - -# if you say Y here, the capabilities on all processes within a -# chroot jail will be lowered to stop module insertion, raw i/o, -# system and net admin tasks, rebooting the system, modifying immutable -# files, modifying IPC owned by another, and changing the system time. -# This is left an option because it can break some apps. Disable this -# if your chrooted apps are having problems performing those kinds of -# tasks. If the sysctl option is enabled, a sysctl option with -# name "chroot_caps" is created. -kernel.grsecurity.chroot_caps = 1 - -#kernel.grsecurity.chroot_deny_bad_rename = 1 - -# If you say Y here, processes inside a chroot will not be able to chmod -# or fchmod files to make them have suid or sgid bits. This protects -# against another published method of breaking a chroot. If the sysctl -# option is enabled, a sysctl option with name "chroot_deny_chmod" is -# created. -kernel.grsecurity.chroot_deny_chmod = 1 - -# If you say Y here, processes inside a chroot will not be able to chroot -# again outside the chroot. This is a widely used method of breaking -# out of a chroot jail and should not be allowed. If the sysctl -# option is enabled, a sysctl option with name -# "chroot_deny_chroot" is created. -kernel.grsecurity.chroot_deny_chroot = 1 - -# If you say Y here, a well-known method of breaking chroots by fchdir'ing -# to a file descriptor of the chrooting process that points to a directory -# outside the filesystem will be stopped. If the sysctl option -# is enabled, a sysctl option with name "chroot_deny_fchdir" is created. -kernel.grsecurity.chroot_deny_fchdir = 1 - -# If you say Y here, processes inside a chroot will not be allowed to -# mknod. The problem with using mknod inside a chroot is that it -# would allow an attacker to create a device entry that is the same -# as one on the physical root of your system, which could range from -# anything from the console device to a device for your harddrive (which -# they could then use to wipe the drive or steal data). It is recommended -# that you say Y here, unless you run into software incompatibilities. -# If the sysctl option is enabled, a sysctl option with name -# "chroot_deny_mknod" is created. -kernel.grsecurity.chroot_deny_mknod = 1 - -# If you say Y here, processes inside a chroot will not be able to -# mount or remount filesystems. If the sysctl option is enabled, a -# sysctl option with name "chroot_deny_mount" is created. -kernel.grsecurity.chroot_deny_mount = 1 - -# If you say Y here, processes inside a chroot will not be able to use -# a function called pivot_root() that was introduced in Linux 2.3.41. It -# works similar to chroot in that it changes the root filesystem. This -# function could be misused in a chrooted process to attempt to break out -# of the chroot, and therefore should not be allowed. If the sysctl -# option is enabled, a sysctl option with name "chroot_deny_pivot" is -# created. -kernel.grsecurity.chroot_deny_pivot = 1 - -# If you say Y here, processes inside a chroot will not be able to attach -# to shared memory segments that were created outside of the chroot jail. -# It is recommended that you say Y here. If the sysctl option is enabled, -# a sysctl option with name "chroot_deny_shmat" is created. -kernel.grsecurity.chroot_deny_shmat = 1 - -# If you say Y here, an attacker in a chroot will not be able to -# write to sysctl entries, either by sysctl(2) or through a /proc -# interface. It is strongly recommended that you say Y here. If the -# sysctl option is enabled, a sysctl option with name -# "chroot_deny_sysctl" is created. -kernel.grsecurity.chroot_deny_sysctl = 1 - -# If you say Y here, processes inside a chroot will not be able to -# connect to abstract (meaning not belonging to a filesystem) Unix -# domain sockets that were bound outside of a chroot. It is recommended -# that you say Y here. If the sysctl option is enabled, a sysctl option -# with name "chroot_deny_unix" is created. -kernel.grsecurity.chroot_deny_unix = 1 - -# If you say Y here, the current working directory of all newly-chrooted -# applications will be set to the the root directory of the chroot. -# The man page on chroot(2) states: -# Note that usually chhroot does not change the current working -# directory, so that `.' can be outside the tree rooted at -# `/'. In particular, the super-user can escape from a -# `chroot jail' by doing `mkdir foo; chroot foo; cd ..'. -# -# It is recommended that you say Y here, since it's not known to break -# any software. If the sysctl option is enabled, a sysctl option with -# name "chroot_enforce_chdir" is created. -kernel.grsecurity.chroot_enforce_chdir = 1 - -# If you say Y here, processes inside a chroot will not be able to -# kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, -# getsid, or view any process outside of the chroot. If the sysctl -# option is enabled, a sysctl option with name "chroot_findtask" is -# created. -kernel.grsecurity.chroot_findtask = 1 - -# If you say Y here, processes inside a chroot will not be able to raise -# the priority of processes in the chroot, or alter the priority of -# processes outside the chroot. This provides more security than simply -# removing CAP_SYS_NICE from the process' capability set. If the -# sysctl option is enabled, a sysctl option with name "chroot_restrict_nice" -# is created. -kernel.grsecurity.chroot_restrict_nice = 1 - -# -# Kernel Auditing -# - -# If you say Y here, the exec and chdir logging features will only operate -# on a group you specify. This option is recommended if you only want to -# watch certain users instead of having a large amount of logs from the -# entire system. If the sysctl option is enabled, a sysctl option with -# name "audit_group" is created. -kernel.grsecurity.audit_group = 1 - -# If you say Y here, the exec and chdir logging features will only operate -# on a group you specify. This option is recommended if you only want to -# watch certain users instead of having a large amount of logs from the -# entire system. If the sysctl option is enabled, a sysctl option with -# name "audit_group" is created. -kernel.grsecurity.audit_gid = 99 - -# If you say Y here, all execve() calls will be logged (since the -# other exec*() calls are frontends to execve(), all execution -# will be logged). Useful for shell-servers that like to keep track -# of their users. If the sysctl option is enabled, a sysctl option with -# name "exec_logging" is created. -# WARNING: This option when enabled will produce a LOT of logs, especially -# on an active system. -kernel.grsecurity.exec_logging = 0 - -# If you say Y here, all attempts to overstep resource limits will -# be logged with the resource name, the requested size, and the current -# limit. It is highly recommended that you say Y here. If the sysctl -# option is enabled, a sysctl option with name "resource_logging" is -# created. If the RBAC system is enabled, the sysctl value is ignored. -kernel.grsecurity.resource_logging = 1 - -# If you say Y here, all executions inside a chroot jail will be logged -# to syslog. This can cause a large amount of logs if certain -# applications (eg. djb's daemontools) are installed on the system, and -# is therefore left as an option. If the sysctl option is enabled, a -# sysctl option with name "chroot_execlog" is created. -kernel.grsecurity.chroot_execlog = 0 - -# If you say Y here, all attempts to attach to a process via ptrace -# will be logged. If the sysctl option is enabled, a sysctl option -# with name "audit_ptrace" is created. -#kernel.grsecurity.audit_ptrace = 1 - -# If you say Y here, all attempts to attach to a process via ptrace -# will be logged. If the sysctl option is enabled, a sysctl option -# with name "audit_ptrace" is created. -kernel.grsecurity.audit_chdir = 0 - -# If you say Y here, all mounts and unmounts will be logged. If the -# sysctl option is enabled, a sysctl option with name "audit_mount" is -# created. -kernel.grsecurity.audit_mount = 1 - -# If you say Y here, certain important signals will be logged, such as -# SIGSEGV, which will as a result inform you of when a error in a program -# occurred, which in some cases could mean a possible exploit attempt. -# If the sysctl option is enabled, a sysctl option with name -# "signal_logging" is created. -kernel.grsecurity.signal_logging = 1 - -# If you say Y here, all failed fork() attempts will be logged. -# This could suggest a fork bomb, or someone attempting to overstep -# their process limit. If the sysctl option is enabled, a sysctl option -# with name "forkfail_logging" is created. -kernel.grsecurity.forkfail_logging = 1 - -# If you say Y here, any changes of the system clock will be logged. -# If the sysctl option is enabled, a sysctl option with name -# "timechange_logging" is created. -kernel.grsecurity.timechange_logging = 1 - -# if you say Y here, calls to mmap() and mprotect() with explicit -# usage of PROT_WRITE and PROT_EXEC together will be logged when -# denied by the PAX_MPROTECT feature. This feature will also -# log other problematic scenarios that can occur when PAX_MPROTECT -# is enabled on a binary, like textrels and PT_GNU_STACK. If the -# sysctl option is enabled, a sysctl option with name "rwxmap_logging" -# is created. -kernel.grsecurity.rwxmap_logging = 1 - -# -# Executable Protections -# - - -# if you say Y here, non-root users will not be able to use dmesg(8) -# to view the contents of the kernel's circular log buffer. -# The kernel's log buffer often contains kernel addresses and other -# identifying information useful to an attacker in fingerprinting a -# system for a targeted exploit. -# If the sysctl option is enabled, a sysctl option with name "dmesg" is -# created. -kernel.grsecurity.dmesg = 1 - # Hide symbol addresses in /proc/kallsyms kernel.kptr_restrict = 2 -# If you say Y here, TTY sniffers and other malicious monitoring -# programs implemented through ptrace will be defeated. If you -# have been using the RBAC system, this option has already been -# enabled for several years for all users, with the ability to make -# fine-grained exceptions. -# -# This option only affects the ability of non-root users to ptrace -# processes that are not a descendent of the ptracing process. -# This means that strace ./binary and gdb ./binary will still work, -# but attaching to arbitrary processes will not. If the sysctl -# option is enabled, a sysctl option with name "harden_ptrace" is -# created. -kernel.grsecurity.harden_ptrace = 1 - -# If you say Y here, unprivileged users will not be able to ptrace unreadable -# binaries. This option is useful in environments that -# remove the read bits (e.g. file mode 4711) from suid binaries to -# prevent infoleaking of their contents. This option adds -# consistency to the use of that file mode, as the binary could normally -# be read out when run without privileges while ptracing. -# -# If the sysctl option is enabled, a sysctl option with name "ptrace_readexec" -# is created. -kernel.grsecurity.ptrace_readexec = 1 - -# If you say Y here, a change from a root uid to a non-root uid -# in a multithreaded application will cause the resulting uids, -# gids, supplementary groups, and capabilities in that thread -# to be propagated to the other threads of the process. In most -# cases this is unnecessary, as glibc will emulate this behavior -# on behalf of the application. Other libcs do not act in the -# same way, allowing the other threads of the process to continue -# running with root privileges. If the sysctl option is enabled, -# a sysctl option with name "consistent_setxid" is created. -kernel.grsecurity.consistent_setxid = 1 - -# If you say Y here, access to overly-permissive IPC objects (shared -# memory, message queues, and semaphores) will be denied for processes -# given the following criteria beyond normal permission checks: -# 1) If the IPC object is world-accessible and the euid doesn't match -# that of the creator or current uid for the IPC object -# 2) If the IPC object is group-accessible and the egid doesn't -# match that of the creator or current gid for the IPC object -# It's a common error to grant too much permission to these objects, -# with impact ranging from denial of service and information leaking to -# privilege escalation. This feature was developed in response to -# research by Tim Brown: -# http://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/ -# who found hundreds of such insecure usages. Processes with -# CAP_IPC_OWNER are still permitted to access these IPC objects. -# If the sysctl option is enabled, a sysctl option with name -# "harden_ipc" is created. -kernel.grsecurity.harden_ipc = 1 - -# If you say Y here, you will be able to choose a gid to add to the -# supplementary groups of users you want to mark as "untrusted." -# These users will not be able to execute any files that are not in -# root-owned directories writable only by root. If the sysctl option -# is enabled, a sysctl option with name "tpe" is created. -kernel.grsecurity.tpe = 1 -kernel.grsecurity.tpe_gid = 100 - -# If you say Y here, the group you specify in the TPE configuration will -# decide what group TPE restrictions will be *disabled* for. This -# option is useful if you want TPE restrictions to be applied to most -# users on the system. If the sysctl option is enabled, a sysctl option -# with name "tpe_invert" is created. Unlike other sysctl options, this -# entry will default to on for backward-compatibility. -kernel.grsecurity.tpe_invert = 0 - -# If you say Y here, all non-root users will be covered under -# a weaker TPE restriction. This is separate from, and in addition to, -# the main TPE options that you have selected elsewhere. Thus, if a -# "trusted" GID is chosen, this restriction applies to even that GID. -# Under this restriction, all non-root users will only be allowed to -# execute files in directories they own that are not group or -# world-writable, or in directories owned by root and writable only by -# root. If the sysctl option is enabled, a sysctl option with name -# "tpe_restrict_all" is created. -kernel.grsecurity.tpe_restrict_all = 1 - - -kernel.grsecurity.harden_tty = 1 - # # Network Protections # @@ -455,7 +91,6 @@ net.ipv4.conf.default.rp_filter = 1 #net.ipv6.conf.default.rp_filter = 1 #net.ipv6.conf.all.rp_filter = 1 - # Make sure no one can alter the routing tables # Act as a router, necessary for Access Point net.ipv4.conf.all.accept_redirects = 0 @@ -495,96 +130,4 @@ net.ipv4.tcp_keepalive_time = 1800 # Sen SynAck retries to 3 net.ipv4.tcp_synack_retries = 3 -# If you say Y here, neither TCP resets nor ICMP -# destination-unreachable packets will be sent in response to packets -# sent to ports for which no associated listening process exists. -# This feature supports both IPV4 and IPV6 and exempts the -# loopback interface from blackholing. Enabling this feature -# makes a host more resilient to DoS attacks and reduces network -# visibility against scanners. -# -# The blackhole feature as-implemented is equivalent to the FreeBSD -# blackhole feature, as it prevents RST responses to all packets, not -# just SYNs. Under most application behavior this causes no -# problems, but applications (like haproxy) may not close certain -# connections in a way that cleanly terminates them on the remote -# end, leaving the remote host in LAST_ACK state. Because of this -# side-effect and to prevent intentional LAST_ACK DoSes, this -# feature also adds automatic mitigation against such attacks. -# The mitigation drastically reduces the amount of time a socket -# can spend in LAST_ACK state. If you're using haproxy and not -# all servers it connects to have this option enabled, consider -# disabling this feature on the haproxy host. -# -# If the sysctl option is enabled, two sysctl options with names -# "ip_blackhole" and "lastack_retries" will be created. -# While "ip_blackhole" takes the standard zero/non-zero on/off -# toggle, "lastack_retries" uses the same kinds of values as -# "tcp_retries1" and "tcp_retries2". The default value of 4 -# prevents a socket from lasting more than 45 seconds in LAST_ACK -# state. -kernel.grsecurity.ip_blackhole = 1 -kernel.grsecurity.lastack_retries = 4 - -# If you say Y here, you will be able to choose a GID of whose users will -# be unable to connect to other hosts from your machine or run server -# applications from your machine. If the sysctl option is enabled, a -# sysctl option with name "socket_all" is created. -kernel.grsecurity.socket_all = 1 - -# Here you can choose the GID to disable socket access for. Remember to -# add the users you want socket access disabled for to the GID -# specified here. If the sysctl option is enabled, a sysctl option -# with name "socket_all_gid" is created. -kernel.grsecurity.socket_all_gid = 200 - -# If you say Y here, you will be able to choose a GID of whose users will -# be unable to connect to other hosts from your machine, but will be -# able to run servers. If this option is enabled, all users in the group -# you specify will have to use passive mode when initiating ftp transfers -# from the shell on your machine. If the sysctl option is enabled, a -# sysctl option with name "socket_client" is created. -kernel.grsecurity.socket_client = 1 - -# Here you can choose the GID to disable client socket access for. -# Remember to add the users you want client socket access disabled for to -# the GID specified here. If the sysctl option is enabled, a sysctl -# option with name "socket_client_gid" is created. -kernel.grsecurity.socket_client_gid = 201 - -# If you say Y here, you will be able to choose a GID of whose users will -# be unable to connect to other hosts from your machine, but will be -# able to run servers. If this option is enabled, all users in the group -# you specify will have to use passive mode when initiating ftp transfers -# from the shell on your machine. If the sysctl option is enabled, a -# sysctl option with name "socket_client" is created. -kernel.grsecurity.socket_server = 1 - -# Here you can choose the GID to disable server socket access for. -# Remember to add the users you want server socket access disabled for to -# the GID specified here. If the sysctl option is enabled, a sysctl -# option with name "socket_server_gid" is created. -kernel.grsecurity.socket_server_gid = 99 - -# -# Physical Protections -# - -# If you say Y here, a new sysctl option with name "deny_new_usb" -# will be created. Setting its value to 1 will prevent any new -# USB devices from being recognized by the OS. Any attempted USB -# device insertion will be logged. This option is intended to be -# used against custom USB devices designed to exploit vulnerabilities -# in various USB device drivers. -# -# For greatest effectiveness, this sysctl should be set after any -# relevant init scripts. This option is safe to enable in distros -# as each user can choose whether or not to toggle the sysctl. -kernel.grsecurity.deny_new_usb = 0 - -# -# Restrict grsec sysctl changes after this was set -# -kernel.grsecurity.grsec_lock = 0 - # End of file diff --git a/core/exim.html b/core/exim.html index 7e1fd28..3b86bb7 100644 --- a/core/exim.html +++ b/core/exim.html @@ -2,13 +2,13 @@ - 2.6. Exim + 2.5. Exim Core OS Index -

2.6. Exim

2.5. Exim

2.6.1. Exim Configuration

2.5.1. Exim Configuration

Exim come with default configuration we will change to mach system settings /etc/exim/exim.conf.

@@ -17,7 +17,7 @@ $ sudo prt-get depinst mailx -

2.6.2. Certificates

2.5.2. Certificates

Exim creates a key for you if you just copy exim.conf and start daemon;

@@ -64,7 +64,7 @@ # chmod 644 /etc/ssl/certs/exim.cert -

2.6.3. Aliases

2.5.3. Aliases

Exim come with default aliases we will change to mach system settings /etc/exim/aliases;

@@ -109,7 +109,7 @@ #### -

2.6.4. Smarthost

2.5.4. Smarthost

Tony Finch publish a nice configuration reference. @@ -133,7 +133,7 @@ # exim -bt bob@remote.com -

2.6. Fetchmail

2.5. Fetchmail

         $ prt-get depinst fetchmail
diff --git a/core/hardening.html b/core/hardening.html
index 1455398..8e9788f 100644
--- a/core/hardening.html
+++ b/core/hardening.html
@@ -2,25 +2,51 @@
 
     
         
-        2.2. Hardening
+        2.6. Hardening
     
     
 
         Core OS Index
 
-        2.2. Hardening
+        2.6. Hardening
 
-        Check apparmor,
-        sysctl, 
-        toolchain and
-        samhain before running tests.
+        2.6.0.1 System configuration
 
-        Mount some filesystems in read only
-        Check processes running as root
-        Check processes users premissions
+        
+            File systems
+            Check fstab and current mount options. Mount filesystems in read only, only strict necessary in rw.
+            Sys
+            Check kernel settings with sysctl.
+            Iptables
+            Check if iptables rules are loaded and are correctly logging.
+            Apparmor
+            Check if apparmor is active and enforcing policies.
+            Samhain
+            Check if samhain is running.
+            Toolchain
+            Build ports using hardened toolchain settings.
+        
+
+        System security
+
+        +        $ sudo prt-get depinst checksec
+        
+
+        
+            User / Pam
+            Normal user is not part of wheel group
+            or have administration rights.
+            Disable su.
+            Processes
+            Check processes running as root
+            Check processes users premissions
+        
+
+        2.6.0.2 Lynis
 
         -        $ sudo prt-get depinst checksec lynis
+        $ sudo prt-get depinst lynis
         
 
         Lynis gives a view of system overall configuration, without changing
@@ -44,7 +70,7 @@
 
         Core OS Index
         
This is part of the Hive System Documentation.
-        Copyright (C) 2018
+        Copyright (C) 2019
         Hive Team.
         See the file Gnu Free Documentation License
         for copying conditions.
diff --git a/core/index.html b/core/index.html
index d19f9e0..c9d5d4b 100644
--- a/core/index.html
+++ b/core/index.html
@@ -103,49 +103,47 @@
 		    2.1.6. Remove
 		
 	    
-	    2.2. Hardening
+	    
2.2. Network
 		
-		    2.2.1. AppArmor
-		    2.2.2. Sysctl
-		    2.2.3. Toolchain
-		    2.2.4. Samhain
+		    2.2.1. Resolver
+		    2.2.2. Static ip
+		    2.2.3. Iptables
+		    2.2.4. Wpa and dhcpd
+		    2.2.5. NetworkManager
 		
 	    
-	    2.3. Network
+	    
2.3. Package Management
 		
-		    2.3.1. Resolver
-		    2.3.2. Static ip
-		    2.3.3. Iptables
-		    2.3.4. Wpa and dhcpd
-		    2.3.5. NetworkManager
+		    2.3.1. Update system
+		    2.3.2. Install ports and dependencies
+		    2.3.3. Ports collections
+		    2.3.3. Show port information
+		    2.3.4. Show port dependencies
+		    2.3.5. Print information
 		
 	    
-
-	    2.4. Package Management
+	    
2.4. Terminals and shells
 		
-		    2.4.1. Update system
-		    2.4.2. Install ports and dependencies
-		    2.4.3. Ports collections
-		    2.4.3. Show port information
-		    2.4.4. Show port dependencies
-		    2.4.5. Print information
+		    2.4.1. Dash
+		    2.4.2. Bash
+		    2.4.3. Tmux
 		
 	    
-
-	    2.5. Terminals and shells
+	    
2.5. Exim
 		
-		    2.5.1. Dash
-		    2.5.2. Bash
-		    2.5.3. Tmux
+		    2.5.1. Exim configuration
+		    2.5.2. Certificates
+		    2.5.3. Aliases
+		    2.5.4. Smarthost
+		    2.5.5. Fetchmail
 		
 	    
-	    2.6. Exim
+	    
2.6. Hardening
 		
-		    2.6.1. Exim configuration
-		    2.6.2. Certificates
-		    2.6.3. Aliases
-		    2.6.4. Smarthost
-		    2.6.5. Fetchmail
+		    2.6.1. AppArmor
+		    2.6.2. Sysctl
+		    2.6.3. Toolchain
+		    2.6.4. Samhain
 		
 	    
 
diff --git a/core/network.html b/core/network.html
index c87acf9..4a412ad 100644
--- a/core/network.html
+++ b/core/network.html
@@ -2,12 +2,12 @@
 
     
         
-        2.3. Network
+        2.2. Network
     
     
         Core OS Index
 
-        2.3. Network
+        2.2. Network
 
         Operation of the network can be handle with init scripts or with
         network manager;
@@ -52,7 +52,7 @@
         described scripts then proceed to
         update system.
 
-        2.3.1. Resolver
+        2.2.1. Resolver
 
         This example will use
         Chaos Computer Club
@@ -60,7 +60,7 @@
 
         
         # /etc/resolv.conf.head can replace this line
-        nameserver 213.73.91.35
+        nameserver 2.2.73.91.35
         # /etc/resolv.conf.tail can replace this line
         
 
@@ -68,7 +68,7 @@
         # chattr +i /etc/resolv.conf

2.3.2. Static IP

2.2.2. Static IP

Current example of /etc/rc.d/net;

@@ -115,7 +115,7 @@ # ip route add default via ${GW} -

2.3.3. Iptables

2.2.3. Iptables

For more information about firewall systems read arch wiki iptables @@ -269,7 +269,7 @@ # iptables -L -n -v | less -

2.3.3.1. Iptable scripts

2.2.3.1. Iptable scripts

Scripts help to setup iptables rules so they can be saved using iptables-save and later restored using iptables-restore utilities. Init script @@ -300,7 +300,7 @@ with your network configuration, and adjust /etc/iptables/ipt-server.sh, /etc/iptables/ipt-bridge.sh, /etc/iptables/ipt-open.sh according with host necessities.

2.3.4. Wpa and dhcpd

2.2.4. Wpa and dhcpd

There is more information on Wiki Wifi Start Scripts and @@ -318,7 +318,7 @@ # iwconfig wlp2s0 essid NAME key s:ABCDE12345 -

2.3.4.1. Wpa Supplicant

2.2.4.1. Wpa Supplicant

Configure wpa supplicant edit;

@@ -348,7 +348,7 @@ init script to auto load wpa configuration and dhcp client.

2.3.4.2. Wpa Cli

2.2.4.2. Wpa Cli

         # wpa_cli
@@ -387,18 +387,33 @@
         > save_config

2.3.5. Network Manager

2.2.5. Network Manager

+ +

Wifi status;

+ +

+        $ nmcli radio wifi
+        $ nmcli radio wifi on
+

List wifi networks;

-        nmcli device wifi list
+        $ nmcli device wifi rescan
+        $ nmcli device wifi list

Connect to a wifi network;

-        nmcli device wifi connect "network name" password "network password"
+        $ nmcli device wifi connect "network name" password "network password"
+

+ +

Edit and save network configuration;

+ +

+        $ nmcli connection edit "network name"
+        nmcli> save persistent

Core OS Index diff --git a/core/package.html b/core/package.html index e0f8eae..7d4c8b5 100644 --- a/core/package.html +++ b/core/package.html @@ -2,13 +2,13 @@ - 2.4. Package Management + 2.3. Package Management Core OS Index -

2.4. Package Management

2.3. Package Management

For more information read crux handbook Package management front-end: @@ -57,7 +57,7 @@ $ prt-get depinst prt-utils prt-get-bashcompletion -

2.4.1. Update System

2.3.1. Update System

Before build software get latest version of port collections;

@@ -87,7 +87,7 @@ $ prt-get update -fr $(revdep) -

2.4.2. Install port and dependencies

2.3.2. Install port and dependencies

Installing using prt-get tool;

@@ -111,7 +111,7 @@

If you user pkgmk and pkgadd allways check if README, pre and post instal files exist.

2.4.3. Ports collections

2.3.3. Ports collections

Clone this documentation;

@@ -148,7 +148,7 @@ $ sudo ports -u 6c37 -

2.4.4. Show port information

2.3.4. Show port information

         $ prt-get info port_name
@@ -166,13 +166,13 @@
         $ pkginfo -o filename

2.4.5. Show port dependencies

2.3.5. Show port dependencies

         $ prt-get depends port_name

2.4.6. Print information

2.3.6. Print information

Example how to get ports installed from contrib. Maybe there is a "cleaner" way to this, for now is ok;

diff --git a/core/samhain.html b/core/samhain.html index d28a6d2..a209864 100644 --- a/core/samhain.html +++ b/core/samhain.html @@ -2,13 +2,13 @@ - 2.2.4. Samhain + 2.6.4. Samhain Core OS Index -

2.2.4. Samhain

2.6.4. Samhain

Read Samhain Manual, @@ -37,7 +37,7 @@

log file

2.2.4.1. Configure

2.6.4.1. Configure

For more information on configuration check Monitoring Policies. @@ -234,7 +234,7 @@ # samhain status -

2.2.4.2. Update database

2.6.4.2. Update database

Manual, You can update the database while the daemon is running, as long diff --git a/core/sysctl.html b/core/sysctl.html index d06afde..a5af197 100644 --- a/core/sysctl.html +++ b/core/sysctl.html @@ -2,24 +2,18 @@ - 2.2.2. Sysctl + 2.6.2. Sysctl Core OS Index -

2.2.2. Sysctl

2.6.2. Sysctl

Sysctl references Arch TCP/IP stack hardening, Cyberciti Nginx Hardning, - Cyberciti Security Hardening, - Grsecurity and PaX Configuration.

- -

Since kernels on machine-ports have PaX - and grsecurity, - /etc/sysctl.conf can have follow - values;

+ Cyberciti Security Hardening.

         #
@@ -27,50 +21,18 @@
         #
 
         kernel.printk = 7 1 1 4
+
         kernel.randomize_va_space = 2
+
         # Shared Memory
         #kernel.shmmax = 500000000
         # Total allocated file handlers that can be allocated
         # fs.file-nr=
         vm.mmap_min_addr=65536
+
         # Allow for more PIDs (to reduce rollover problems); may break some programs 32768
         kernel.pid_max = 65536
 
-        #
-        # Memory Protections
-        #
-
-        #  If you say Y here, all ioperm and iopl calls will return an error.
-        #  Ioperm and iopl can be used to modify the running kernel.
-        #  Unfortunately, some programs need this access to operate properly,
-        #  the most notable of which are XFree86 and hwclock.  hwclock can be
-        #  remedied by having RTC support in the kernel, so real-time
-        #  clock support is enabled if this option is enabled, to ensure
-        #  that hwclock operates correctly.
-        #
-        #  If you're using XFree86 or a version of Xorg from 2012 or earlier,
-        #  you may not be able to boot into a graphical environment with this
-        #  option enabled.  In this case, you should use the RBAC system instead.
-        kernel.grsecurity.disable_priv_io = 1
-
-        #  If you say Y here, attempts to bruteforce exploits against forking
-        #  daemons such as apache or sshd, as well as against suid/sgid binaries
-        #  will be deterred.  When a child of a forking daemon is killed by PaX
-        #  or crashes due to an illegal instruction or other suspicious signal,
-        #  the parent process will be delayed 30 seconds upon every subsequent
-        #  fork until the administrator is able to assess the situation and
-        #  restart the daemon.
-        #  In the suid/sgid case, the attempt is logged, the user has all their
-        #  existing instances of the suid/sgid binary terminated and will
-        #  be unable to execute any suid/sgid binaries for 15 minutes.
-        #
-        #  It is recommended that you also enable signal logging in the auditing
-        #  section so that logs are generated when a process triggers a suspicious
-        #  signal.
-        #  If the sysctl option is enabled, a sysctl option with name
-        #  "deter_bruteforce" is created.
-        kernel.grsecurity.deter_bruteforce = 1
-
         #
         # Filesystem Protections
         #
@@ -79,341 +41,9 @@
         # Increase system file descriptor limit
         fs.file-max = 65535
 
-        #  If you say Y here, /tmp race exploits will be prevented, since users
-        #  will no longer be able to follow symlinks owned by other users in
-        #  world-writable +t directories (e.g. /tmp), unless the owner of the
-        #  symlink is the owner of the directory. users will also not be
-        #  able to hardlink to files they do not own.  If the sysctl option is
-        #  enabled, a sysctl option with name "linking_restrictions" is created.
-        kernel.grsecurity.linking_restrictions = 1
-
-
-        #  Apache's SymlinksIfOwnerMatch option has an inherent race condition
-        #  that prevents it from being used as a security feature.  As Apache
-        #  verifies the symlink by performing a stat() against the target of
-        #  the symlink before it is followed, an attacker can setup a symlink
-        #  to point to a same-owned file, then replace the symlink with one
-        #  that targets another user's file just after Apache "validates" the
-        #  symlink -- a classic TOCTOU race.  If you say Y here, a complete,
-        #  race-free replacement for Apache's "SymlinksIfOwnerMatch" option
-        #  will be in place for the group you specify. If the sysctl option
-        #  is enabled, a sysctl option with name "enforce_symlinksifowner" is
-        #  created.
-        kernel.grsecurity.enforce_symlinksifowner = 1
-        kernel.grsecurity.symlinkown_gid = 15
-
-        #  if you say Y here, users will not be able to write to FIFOs they don't
-        #  own in world-writable +t directories (e.g. /tmp), unless the owner of
-        #  the FIFO is the same owner of the directory it's held in.  If the sysctl
-        #  option is enabled, a sysctl option with name "fifo_restrictions" is
-        #  created.
-        kernel.grsecurity.fifo_restrictions = 1
-
-        #  If you say Y here, a sysctl option with name "romount_protect" will
-        #  be created.  By setting this option to 1 at runtime, filesystems
-        #  will be protected in the following ways:
-        #  * No new writable mounts will be allowed
-        #  * Existing read-only mounts won't be able to be remounted read/write
-        #  * Write operations will be denied on all block devices
-        #  This option acts independently of grsec_lock: once it is set to 1,
-        #  it cannot be turned off.  Therefore, please be mindful of the resulting
-        #  behavior if this option is enabled in an init script on a read-only
-        #  filesystem.
-        #  Also be aware that as with other root-focused features, GRKERNSEC_KMEM
-        #  and GRKERNSEC_IO should be enabled and module loading disabled via
-        #  config or at runtime.
-        #  This feature is mainly intended for secure embedded systems.
-        #kernel.grsecurity.romount_protect = 1
-
-        #  if you say Y here, the capabilities on all processes within a
-        #  chroot jail will be lowered to stop module insertion, raw i/o,
-        #  system and net admin tasks, rebooting the system, modifying immutable
-        #  files, modifying IPC owned by another, and changing the system time.
-        #  This is left an option because it can break some apps.  Disable this
-        #  if your chrooted apps are having problems performing those kinds of
-        #  tasks.  If the sysctl option is enabled, a sysctl option with
-        #  name "chroot_caps" is created.
-        kernel.grsecurity.chroot_caps = 1
-
-        #kernel.grsecurity.chroot_deny_bad_rename = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to chmod
-        #  or fchmod files to make them have suid or sgid bits.  This protects
-        #  against another published method of breaking a chroot.  If the sysctl
-        #  option is enabled, a sysctl option with name "chroot_deny_chmod" is
-        #  created.
-        kernel.grsecurity.chroot_deny_chmod = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to chroot
-        #  again outside the chroot.  This is a widely used method of breaking
-        #  out of a chroot jail and should not be allowed.  If the sysctl
-        #  option is enabled, a sysctl option with name
-        #  "chroot_deny_chroot" is created.
-        kernel.grsecurity.chroot_deny_chroot = 1
-
-        #  If you say Y here, a well-known method of breaking chroots by fchdir'ing
-        #  to a file descriptor of the chrooting process that points to a directory
-        #  outside the filesystem will be stopped.  If the sysctl option
-        #  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-        kernel.grsecurity.chroot_deny_fchdir = 1
-
-        #  If you say Y here, processes inside a chroot will not be allowed to
-        #  mknod.  The problem with using mknod inside a chroot is that it
-        #  would allow an attacker to create a device entry that is the same
-        #  as one on the physical root of your system, which could range from
-        #  anything from the console device to a device for your harddrive (which
-        #  they could then use to wipe the drive or steal data).  It is recommended
-        #  that you say Y here, unless you run into software incompatibilities.
-        #  If the sysctl option is enabled, a sysctl option with name
-        #  "chroot_deny_mknod" is created.
-        kernel.grsecurity.chroot_deny_mknod = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to
-        #  mount or remount filesystems.  If the sysctl option is enabled, a
-        #  sysctl option with name "chroot_deny_mount" is created.
-        kernel.grsecurity.chroot_deny_mount = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to use
-        #  a function called pivot_root() that was introduced in Linux 2.3.41.  It
-        #  works similar to chroot in that it changes the root filesystem.  This
-        #  function could be misused in a chrooted process to attempt to break out
-        #  of the chroot, and therefore should not be allowed.  If the sysctl
-        #  option is enabled, a sysctl option with name "chroot_deny_pivot" is
-        #  created.
-        kernel.grsecurity.chroot_deny_pivot     = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to attach
-        #  to shared memory segments that were created outside of the chroot jail.
-        #  It is recommended that you say Y here.  If the sysctl option is enabled,
-        #  a sysctl option with name "chroot_deny_shmat" is created.
-        kernel.grsecurity.chroot_deny_shmat = 1
-
-        #  If you say Y here, an attacker in a chroot will not be able to
-        #  write to sysctl entries, either by sysctl(2) or through a /proc
-        #  interface.  It is strongly recommended that you say Y here. If the
-        #  sysctl option is enabled, a sysctl option with name
-        #  "chroot_deny_sysctl" is created.
-        kernel.grsecurity.chroot_deny_sysctl = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to
-        #  connect to abstract (meaning not belonging to a filesystem) Unix
-        #  domain sockets that were bound outside of a chroot.  It is recommended
-        #  that you say Y here.  If the sysctl option is enabled, a sysctl option
-        #  with name "chroot_deny_unix" is created.
-        kernel.grsecurity.chroot_deny_unix = 1
-
-        #  If you say Y here, the current working directory of all newly-chrooted
-        #  applications will be set to the the root directory of the chroot.
-        #  The man page on chroot(2) states:
-        #  Note that usually chhroot does not change  the  current  working
-        #  directory,  so  that `.' can be outside the tree rooted at
-        #  `/'.  In particular, the  super-user  can  escape  from  a
-        #  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-        #
-        #  It is recommended that you say Y here, since it's not known to break
-        #  any software.  If the sysctl option is enabled, a sysctl option with
-        #  name "chroot_enforce_chdir" is created.
-        kernel.grsecurity.chroot_enforce_chdir  = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to
-        #  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
-        #  getsid, or view any process outside of the chroot.  If the sysctl
-        #  option is enabled, a sysctl option with name "chroot_findtask" is
-        #  created.
-        kernel.grsecurity.chroot_findtask = 1
-
-        #  If you say Y here, processes inside a chroot will not be able to raise
-        #  the priority of processes in the chroot, or alter the priority of
-        #  processes outside the chroot.  This provides more security than simply
-        #  removing CAP_SYS_NICE from the process' capability set.  If the
-        #  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-        #  is created.
-        kernel.grsecurity.chroot_restrict_nice = 1
-
-        #
-        # Kernel Auditing
-        #
-
-        #  If you say Y here, the exec and chdir logging features will only operate
-        #  on a group you specify.  This option is recommended if you only want to
-        #  watch certain users instead of having a large amount of logs from the
-        #  entire system.  If the sysctl option is enabled, a sysctl option with
-        #  name "audit_group" is created.
-        kernel.grsecurity.audit_group = 1
-
-        #  If you say Y here, the exec and chdir logging features will only operate
-        #  on a group you specify.  This option is recommended if you only want to
-        #  watch certain users instead of having a large amount of logs from the
-        #  entire system.  If the sysctl option is enabled, a sysctl option with
-        #  name "audit_group" is created.
-        kernel.grsecurity.audit_gid = 99
-
-        #  If you say Y here, all execve() calls will be logged (since the
-        #  other exec*() calls are frontends to execve(), all execution
-        #  will be logged).  Useful for shell-servers that like to keep track
-        #  of their users.  If the sysctl option is enabled, a sysctl option with
-        #  name "exec_logging" is created.
-        #  WARNING: This option when enabled will produce a LOT of logs, especially
-        #  on an active system.
-        kernel.grsecurity.exec_logging = 0
-
-        #  If you say Y here, all attempts to overstep resource limits will
-        #  be logged with the resource name, the requested size, and the current
-        #  limit.  It is highly recommended that you say Y here.  If the sysctl
-        #  option is enabled, a sysctl option with name "resource_logging" is
-        #  created.  If the RBAC system is enabled, the sysctl value is ignored.
-        kernel.grsecurity.resource_logging = 1
-
-        #  If you say Y here, all executions inside a chroot jail will be logged
-        #  to syslog.  This can cause a large amount of logs if certain
-        #  applications (eg. djb's daemontools) are installed on the system, and
-        #  is therefore left as an option.  If the sysctl option is enabled, a
-        #  sysctl option with name "chroot_execlog" is created.
-        kernel.grsecurity.chroot_execlog = 0
-
-        #  If you say Y here, all attempts to attach to a process via ptrace
-        #  will be logged.  If the sysctl option is enabled, a sysctl option
-        #  with name "audit_ptrace" is created.
-        #kernel.grsecurity.audit_ptrace = 1
-
-        #  If you say Y here, all attempts to attach to a process via ptrace
-        #  will be logged.  If the sysctl option is enabled, a sysctl option
-        #  with name "audit_ptrace" is created.
-        kernel.grsecurity.audit_chdir = 0
-
-        #  If you say Y here, all mounts and unmounts will be logged.  If the
-        #  sysctl option is enabled, a sysctl option with name "audit_mount" is
-        #  created.
-        kernel.grsecurity.audit_mount = 1
-
-        #  If you say Y here, certain important signals will be logged, such as
-        #  SIGSEGV, which will as a result inform you of when a error in a program
-        #  occurred, which in some cases could mean a possible exploit attempt.
-        #  If the sysctl option is enabled, a sysctl option with name
-        #  "signal_logging" is created.
-        kernel.grsecurity.signal_logging = 1
-
-        #  If you say Y here, all failed fork() attempts will be logged.
-        #  This could suggest a fork bomb, or someone attempting to overstep
-        #  their process limit.  If the sysctl option is enabled, a sysctl option
-        #  with name "forkfail_logging" is created.
-        kernel.grsecurity.forkfail_logging = 1
-
-        #  If you say Y here, any changes of the system clock will be logged.
-        #  If the sysctl option is enabled, a sysctl option with name
-        #  "timechange_logging" is created.
-        kernel.grsecurity.timechange_logging = 1
-
-        #  if you say Y here, calls to mmap() and mprotect() with explicit
-        #  usage of PROT_WRITE and PROT_EXEC together will be logged when
-        #  denied by the PAX_MPROTECT feature.  This feature will also
-        #  log other problematic scenarios that can occur when PAX_MPROTECT
-        #  is enabled on a binary, like textrels and PT_GNU_STACK.  If the
-        #  sysctl option is enabled, a sysctl option with name "rwxmap_logging"
-        #  is created.
-        kernel.grsecurity.rwxmap_logging = 1
-
-        #
-        # Executable Protections
-        #
-
-
-        #  if you say Y here, non-root users will not be able to use dmesg(8)
-        #  to view the contents of the kernel's circular log buffer.
-        #  The kernel's log buffer often contains kernel addresses and other
-        #  identifying information useful to an attacker in fingerprinting a
-        #  system for a targeted exploit.
-        #  If the sysctl option is enabled, a sysctl option with name "dmesg" is
-        #  created.
-        kernel.grsecurity.dmesg = 1
-
         # Hide symbol addresses in /proc/kallsyms
         kernel.kptr_restrict = 2
 
-        #  If you say Y here, TTY sniffers and other malicious monitoring
-        #  programs implemented through ptrace will be defeated.  If you
-        #  have been using the RBAC system, this option has already been
-        #  enabled for several years for all users, with the ability to make
-        #  fine-grained exceptions.
-        #
-        #  This option only affects the ability of non-root users to ptrace
-        #  processes that are not a descendent of the ptracing process.
-        #  This means that strace ./binary and gdb ./binary will still work,
-        #  but attaching to arbitrary processes will not.  If the sysctl
-        #  option is enabled, a sysctl option with name "harden_ptrace" is
-        #  created.
-        kernel.grsecurity.harden_ptrace = 1
-
-        #  If you say Y here, unprivileged users will not be able to ptrace unreadable
-        #  binaries.  This option is useful in environments that
-        #  remove the read bits (e.g. file mode 4711) from suid binaries to
-        #  prevent infoleaking of their contents.  This option adds
-        #  consistency to the use of that file mode, as the binary could normally
-        #  be read out when run without privileges while ptracing.
-        #
-        #  If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
-        #  is created.
-        kernel.grsecurity.ptrace_readexec = 1
-
-        #  If you say Y here, a change from a root uid to a non-root uid
-        #  in a multithreaded application will cause the resulting uids,
-        #  gids, supplementary groups, and capabilities in that thread
-        #  to be propagated to the other threads of the process.  In most
-        #  cases this is unnecessary, as glibc will emulate this behavior
-        #  on behalf of the application.  Other libcs do not act in the
-        #  same way, allowing the other threads of the process to continue
-        #  running with root privileges.  If the sysctl option is enabled,
-        #  a sysctl option with name "consistent_setxid" is created.
-        kernel.grsecurity.consistent_setxid = 1
-
-        #  If you say Y here, access to overly-permissive IPC objects (shared
-        #  memory, message queues, and semaphores) will be denied for processes
-        #  given the following criteria beyond normal permission checks:
-        #  1) If the IPC object is world-accessible and the euid doesn't match
-        #     that of the creator or current uid for the IPC object
-        #  2) If the IPC object is group-accessible and the egid doesn't
-        #     match that of the creator or current gid for the IPC object
-        #  It's a common error to grant too much permission to these objects,
-        #  with impact ranging from denial of service and information leaking to
-        #  privilege escalation.  This feature was developed in response to
-        #  research by Tim Brown:
-        #  http://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/
-        #  who found hundreds of such insecure usages.  Processes with
-        #  CAP_IPC_OWNER are still permitted to access these IPC objects.
-        #  If the sysctl option is enabled, a sysctl option with name
-        #  "harden_ipc" is created.
-        kernel.grsecurity.harden_ipc = 1
-
-        #  If you say Y here, you will be able to choose a gid to add to the
-        #  supplementary groups of users you want to mark as "untrusted."
-        #  These users will not be able to execute any files that are not in
-        #  root-owned directories writable only by root.  If the sysctl option
-        #  is enabled, a sysctl option with name "tpe" is created.
-        kernel.grsecurity.tpe = 1
-        kernel.grsecurity.tpe_gid = 100
-
-        #  If you say Y here, the group you specify in the TPE configuration will
-        #  decide what group TPE restrictions will be *disabled* for.  This
-        #  option is useful if you want TPE restrictions to be applied to most
-        #  users on the system.  If the sysctl option is enabled, a sysctl option
-        #  with name "tpe_invert" is created.  Unlike other sysctl options, this
-        #  entry will default to on for backward-compatibility.
-        kernel.grsecurity.tpe_invert = 1
-
-        #  If you say Y here, all non-root users will be covered under
-        #  a weaker TPE restriction.  This is separate from, and in addition to,
-        #  the main TPE options that you have selected elsewhere.  Thus, if a
-        #  "trusted" GID is chosen, this restriction applies to even that GID.
-        #  Under this restriction, all non-root users will only be allowed to
-        #  execute files in directories they own that are not group or
-        #  world-writable, or in directories owned by root and writable only by
-        #  root.  If the sysctl option is enabled, a sysctl option with name
-        #  "tpe_restrict_all" is created.
-        kernel.grsecurity.tpe_restrict_all = 1
-
-
-        kernel.grsecurity.harden_tty = 1
-
         #
         # Network Protections
         #
@@ -519,105 +149,18 @@
         # Sen SynAck retries to 3
         net.ipv4.tcp_synack_retries = 3
 
-        #  If you say Y here, neither TCP resets nor ICMP
-        #  destination-unreachable packets will be sent in response to packets
-        #  sent to ports for which no associated listening process exists.
-        #  This feature supports both IPV4 and IPV6 and exempts the
-        #  loopback interface from blackholing.  Enabling this feature
-        #  makes a host more resilient to DoS attacks and reduces network
-        #  visibility against scanners.
-        #
-        #  The blackhole feature as-implemented is equivalent to the FreeBSD
-        #  blackhole feature, as it prevents RST responses to all packets, not
-        #  just SYNs.  Under most application behavior this causes no
-        #  problems, but applications (like haproxy) may not close certain
-        #  connections in a way that cleanly terminates them on the remote
-        #  end, leaving the remote host in LAST_ACK state.  Because of this
-        #  side-effect and to prevent intentional LAST_ACK DoSes, this
-        #  feature also adds automatic mitigation against such attacks.
-        #  The mitigation drastically reduces the amount of time a socket
-        #  can spend in LAST_ACK state.  If you're using haproxy and not
-        #  all servers it connects to have this option enabled, consider
-        #  disabling this feature on the haproxy host.
-        #
-        #  If the sysctl option is enabled, two sysctl options with names
-        #  "ip_blackhole" and "lastack_retries" will be created.
-        #  While "ip_blackhole" takes the standard zero/non-zero on/off
-        #  toggle, "lastack_retries" uses the same kinds of values as
-        #  "tcp_retries1" and "tcp_retries2".  The default value of 4
-        #  prevents a socket from lasting more than 45 seconds in LAST_ACK
-        #  state.
-        kernel.grsecurity.ip_blackhole = 1
-        kernel.grsecurity.lastack_retries = 4
-
-        #  If you say Y here, you will be able to choose a GID of whose users will
-        #  be unable to connect to other hosts from your machine or run server
-        #  applications from your machine.  If the sysctl option is enabled, a
-        #  sysctl option with name "socket_all" is created.
-        kernel.grsecurity.socket_all = 1
-
-        #  Here you can choose the GID to disable socket access for. Remember to
-        #  add the users you want socket access disabled for to the GID
-        #  specified here.  If the sysctl option is enabled, a sysctl option
-        #  with name "socket_all_gid" is created.
-        kernel.grsecurity.socket_all_gid = 200
-
-        #  If you say Y here, you will be able to choose a GID of whose users will
-        #  be unable to connect to other hosts from your machine, but will be
-        #  able to run servers.  If this option is enabled, all users in the group
-        #  you specify will have to use passive mode when initiating ftp transfers
-        #  from the shell on your machine.  If the sysctl option is enabled, a
-        #  sysctl option with name "socket_client" is created.
-        kernel.grsecurity.socket_client = 1
-
-        #  Here you can choose the GID to disable client socket access for.
-        #  Remember to add the users you want client socket access disabled for to
-        #  the GID specified here.  If the sysctl option is enabled, a sysctl
-        #  option with name "socket_client_gid" is created.
-        kernel.grsecurity.socket_client_gid = 201
-
-        #  If you say Y here, you will be able to choose a GID of whose users will
-        #  be unable to connect to other hosts from your machine, but will be
-        #  able to run servers.  If this option is enabled, all users in the group
-        #  you specify will have to use passive mode when initiating ftp transfers
-        #  from the shell on your machine.  If the sysctl option is enabled, a
-        #  sysctl option with name "socket_client" is created.
-        kernel.grsecurity.socket_server = 1
-
-        #  Here you can choose the GID to disable server socket access for.
-        #  Remember to add the users you want server socket access disabled for to
-        #  the GID specified here.  If the sysctl option is enabled, a sysctl
-        #  option with name "socket_server_gid" is created.
-        kernel.grsecurity.socket_server_gid = 99
-
-        #
-        # Physical Protections
-        #
-
-        #  If you say Y here, a new sysctl option with name "deny_new_usb"
-        #  will be created.  Setting its value to 1 will prevent any new
-        #  USB devices from being recognized by the OS.  Any attempted USB
-        #  device insertion will be logged.  This option is intended to be
-        #  used against custom USB devices designed to exploit vulnerabilities
-        #  in various USB device drivers.
-        #
-        #  For greatest effectiveness, this sysctl should be set after any
-        #  relevant init scripts.  This option is safe to enable in distros
-        #  as each user can choose whether or not to toggle the sysctl.
-        kernel.grsecurity.deny_new_usb = 0
-
-        #
-        # Restrict grsec sysctl changes after this was set
-        #
-        kernel.grsecurity.grsec_lock = 0
-
         # End of file

Reload sysctl settings;

+ +

+        # sysctl --system
+

Core OS Index

diff --git a/core/toolchain.html b/core/toolchain.html index 57113fd..9662217 100644 --- a/core/toolchain.html +++ b/core/toolchain.html @@ -2,13 +2,13 @@ - 2.2.3. Toolchain + 2.6.3. Toolchain Core OS Index -

2.2.3. Toolchain

2.6.3. Toolchain

Add flags to pkgmk configuration and change specific ports that don't build with hardening flags. More information about diff --git a/core/tty-terminal.html b/core/tty-terminal.html index 6eb08d3..d033ec2 100644 --- a/core/tty-terminal.html +++ b/core/tty-terminal.html @@ -2,13 +2,13 @@ - 2.5. Consoles, terminals and shells + 2.4. Consoles, terminals and shells Core OS Index -

2.5. Consoles, terminals and shells

2.4. Consoles, terminals and shells

Consoles