System Hardening Checklist
Jump to navigation
Jump to search
Donate
| About this System Hardening Checklist Page Contributor maintained wiki page. | |
|---|---|
| Support Status | stable |
| Difficulty | easy |
| Contributor | torjunkie
|
| Support | Support |
Kicksecure comes with many security features. Kicksecure is hardened by default and also provides extensive Documentation including this System Hardening Checklist. The more you know, the safer you can be.
This page is targeted at users who wish to improve the security of their systems for even greater protection.
Introduction[edit]
Recommendations specific to Kicksecure-Qubes or Kicksecure are marked accordingly.
It is possible to significantly harden the Kicksecure and/or host platform. This reduces the likelihood of a temporary or persistent compromise, while increasing the chances of successful, secure activity. Hardening is dependent upon a user's skill set, motivation and available hardware. The checklist below is intended to provide a quick overview of important issues, categorized by difficulty level - easy, moderate, difficult and expert.
Easy[edit]
Command Line Operations[edit]
- Do not run commands unless they are completely understood -- first refer to a suitable Kicksecure wiki resource if available.
- If root privileges are required, run the command with
sudorather than logging in as root or usingsudo su. [1]- Consider disabling the root account permanently. [2]
- To prevent malware sniffing the root password, before performing administrative tasks that require root access, create an
adminuser account with sudo permissions. - Prefer
sudoeditfor better security when editing files. [3]
- Defeat login spoofing by using the Secure Access Key ("Sak";
SysRq+k) procedure. - Consider enabling SysRq "Security Keys" functionality as insurance against system malfunctions -- this assists in system recovery efforts and limits the potential harm of a malware compromise.
Disabling and Minimizing Hardware Risks[edit]
- Unplug external devices when not needed.
- Consider disabling microphones where possible (muting on the host) or better, physically removing them.
- Since speakers (all audio output devices) can be turned into microphones, if possible, physically remove speakers on the host and remove/disable the beeper. [4]
- Preferably detach webcams or even better, physically cover webcams with a sticker or switch unless they are in use.
- If using Kicksecure-Qubes, assign the webcam to an untrusted VM (if needed).
- Avoid using wireless devices, since they are insecure.
- Preferably disable or remove Bluetooth hardware modules.
- Disable or remove problematic devices like ExpressCard, PCMCIA, FireWire or Thunderbolt which may allow attackers with physical access to read RAM.
- Do not enable audio input to any VM unless strictly required.
- Apply CPU microcode updates [5]. [6]
- Consider restricting hardware information to the root user in Kicksecure. [7]
- In Kicksecure-Qubes, only use a mouse and keyboard utilizing PS/2 ports (not USB ports) to prevent malicious compromise of dom0 (PS/2 adapters and available controllers are required).
Entropy[edit]
- To mitigate against inadequate entropy seeding by the Linux Random Number Generator (RNG), it is recommended to install daemons that inject more randomness into the pool.
- From Debian Stable, jitterentropy-rngd is available; see footnote. [8]
- haveged also uses CPU timer jitter to generate entropy and additional entropy sources cannot hurt; see footnote. [9]
- From Debian Stable
File Handling[edit]
Kicksecure-Qubes only.
- In File Manager, disable previews of files from untrusted sources. Change file preferences in the Template's File Manager so future App Qubes inherit this feature.
- Files received or downloaded from untrusted sources (the internet, via email etc.) should not be opened in a trusted VM. Instead, open them in a Disposables:
Right-click→Open In Disposables - Untrusted PDFs should be opened in a Disposables or converted into a trusted (sanitized) PDF to prevent exploitation of the PDF reader and potential infection of the VM.
File Folder Permissions[edit]
- Linux user account
nobodyhas no special meaning. - Also linux user group
nogrouphas no special meaning either. - Therefore the user should avoid running programs under user
nobodyand/or groupnogroupas well as avoid setting file or folder permissions to that user / group.
File Storage Location[edit]
- Avoid storing files directly in the root home folder and create appropriate sub-folders instead.
- Move files downloaded by Firefox from the
~/Downloadsfolder to another specially created one. [11]
Mandatory Access Control[edit]
- Enable all available apparmor profiles in the Kicksecure Templates.
- Enable seccomp on Kicksecure (
kicksecureProxyVM).
Mobile Devices[edit]
Phones, smartphones, smartwatches, tablets and similar mobile devices are vulnerable to advanced malware and can be abused for eavesdropping, espionage, location tracing and more. Since the mobile devices security best practices for risk mitigation are often difficult / infeasible to adhere, it might be easier to physically move all mobiles devices to a distant physical location such as a different room and close the door and/or to power off mobile devices.
Passwords and Logins[edit]
- Use strong, unique and random passwords for all online accounts, system logins and encryption / decryption purposes to prevent the feasibility of brute-forcing attacks.
- Use a trusted password manager (KeePassXC) [12], so hundreds of different passwords can be kept stored in an encrypted password database, protected by one strong master password. [13]
- For high-entropy passwords, consider using Diceware passphrases. [14]
- In Kicksecure-Qubes, store all login credentials and passwords in an offline vault VM (preferably with KeePassXC) and securely cut and paste them into the browser. [15]
- Read and follow all the principles for stronger passwords.
Screensavers[edit]
- At a minimum, lock the screen of the host when it is unattended.
- For better security, shut down the computer entirely -- screensavers are notoriously insecure. [16] [17]
Secure Downloads[edit]
- Download Internet files securely using scurl instead of wget from the command line.
- When downloading with a browser, prevent SSLstrip attacks by typing
https://links directly into the URL / address bar.
Secure Qubes Operation[edit]
Kicksecure-Qubes only.
- Refer to the Kicksecure-Qubes security recommendations and always follow the latest security news and advice from the Qubes team.
Secure Software Installation[edit]
- Default to Debian's official package manager APT for installing software, and avoid third party package managers.
- When possible, use mechanisms which simplify and automate software upgrades and installations, like apt functions.
- Prefer installation of software from signed (Debian) GNU/Linux repositories and avoid manually installing software, particularly if it is unsigned.
- Set the Qubes, Debian and Kicksecure package updates to Tor onion service repositories. [18]
- For safer installations or updates, first stop all activity/applications and rotate the Tor circuits.
- Always verify key fingerprints and digital signatures of signed software before importing keys or installing software.
- Avoid using keyservers if possible.
- It is safer to securely download the key from a source that is logically connected to the owner, if possible, outside the keyserver model. [19]
Updates[edit]
- Operating System Updates: It is crucial to regularly check for operating system updates on the host operating system Kicksecure (or in a VM).
- Stay tuned: It is absolutely crucial to subscribe to and read the latest Kicksecure news category 'important-news' to stay in touch with ongoing developments. This way users benefit from notifications concerning important security advisories, potential upgrade issues and improved releases which address identified issues, like those affecting the updater or other core elements. Follow Kicksecure Developments.
- Debian Security Announcements: Since Kicksecure is based on Debian, users should consider subscribing to the Debian security announcement mailing list to stay informed about the latest security advisories. See also chapter Debian Security Announcements.
Virtual Machines[edit]
All Virtualizers[edit]
- Remove the virtual audio controller to VMs from getting access to a microphone (eavesdropping risk) or speaker (profiling threat).
VirtualBox[edit]
- Remove a host of VirtualBox features to reduce the attack surface.
- Take regular, clean VM snapshots that are not used for any activities.
- Spoof the initial virtual hardware clock offset.
- Consider disabling clipboard sharing to reduce the risk of identity correlation. [20]
- Shared folders are discouraged because they weaken isolation between the guest and the host. [21]
Warrant Canary[edit]
- Learn more about warrant canaries -- see Kicksecure Warrant Canary (forum discussion) and limitations of warrant canaries.
Moderate[edit]
Create a USB Qube[edit]
Kicksecure-Qubes only.
- Prepare and safely utilize a USB qube. [22] [23]
- Configure a disposable
sys-usb.
Kicksecure as a Host Operating System Hardening[edit]
All Platforms[edit]
- Use Full Disk Encryption (FDE) on Kicksecure.
- Apply a BIOS password for BIOS setup and boot.
- Follow all other Kicksecure recommendations to further harden the host OS against physical attacks.
Kernels / Kernel Modules[edit]
Note:
- To benefit from additional protections, [26] consider installing newer kernels.
- On Kicksecure as a host and/or VM.
- Qubes: in dom0 and in Qubes VMs (see Qubes VM Kernel). [27] [28] [29]
- On Kicksecure
- In Kicksecure-Qubes, consider installing the tirdad kernel module to protect against TCP ISN-based CPU information leaks. [30] [31]
- Advanced users can undertake host kernel hardening to significantly increase security and privacy.
Live-mode[edit]
Kicksecure only.
- Consider running it in Kicksecure, so all writes go to RAM instead of the hard disk.
- Disable swap and program crash dumps as an anti-forensics precaution.
- When using Live Mode in a VM consider enabling read-only hard drive mode to make it harder for malware to gain persistence. [32]
Networking[edit]
All Platforms[edit]
- If possible, use a dedicated network connection (LAN, WiFi etc.) that is not shared with other potentially compromised computers.
- If using a shared network via a common cable modem/router or ADSL router, configure a de-militarized zone (perimeter network). [33]
- Test the LAN's router/firewall with either an internet port scanning service or preferably a port scanning application from an external IP address.
- Change the default administration password on the router to a unique, random, and suitably long Diceware passphrase to prevent bruteforcing attacks.
- WiFi users should default to the WPA2-AES (avoid TKIP) or WPA3 standard; the protocols are safer and have stronger encryption. [34] [35]
- Follow all other Kicksecure recommendations to lock down the router.
- Disable TCP Selective Acknowledgement (SACK) unless it is required, since it is a commonly exploited option in the TCP protocol and not needed for many people; see footnotes. [36] [37] [38]
Kicksecure-Qubes Only[edit]
- Prefer the Kicksecure Template for networking (
sys-netandsys-firewall) since it is minimal in nature and does not "ping home", unlike the Fedora Template. [39] - Consider using customized minimal templates for NetVMs to reduce the attack surface and memory requirements.
Sandboxing[edit]
- Consider using Firejail to restrict Firefox-ESR, VLC and other regularly used applications -- note this comes with an increased fingerprinting risk and any vulnerability in Firejail can allow escalation to root privileges.
- In a future Kicksecure release, consider using
sandbox-app-launcher(Sandboxed Application Launcher) to restrict applications within a bubblewrap sandbox and confined by AppArmor. [40]
Spoof MAC Addresses[edit]
Tip: MAC spoofing is only necessary if traveling with your laptop or PC. It is not required for home PCs that do not change locations.
- In Kicksecure-Qubes, follow these steps to spoof the MAC address on the Kicksecure or Fedora Template used for network connections.
- In Kicksecure, follow these steps (.onion
) to spoof the MAC address of the network card.
Time Related[edit]
- Kicksecure only: Disable ICMP timestamps and TCP timestamps on the host operating system to prevent leakage of information. [41]
- Kicksecure only: Uninstall the NTP client on the host operating system and disable systemd's timdatectl NTP synchronization feature. [42]
- Prevent possible time leaks by blocking networking until sdwdate finishes.
Tor Settings[edit]
Tor is used in Kicksecure for updates, time fixes and other operations.
- Consider enabling Tor connection padding (.onion) for potentially better protected connection; note it is unclear whether this provides any additional benefit (see footnote). [43]
- Consider installing newer Tor versions.
- Avoid regenerating the Tor state file (.onion) or manually rotating Tor guards (.onion) because it degrades security.
- Avoid configuring non-persistent entry guards (.onion), as this severely degrades security.
- Consider using bridges (.onion) if Tor is blocked, dangerous or deemed suspicious in your location.
- If using a bridge, configure alternating bridges (.onion) for different physical locations.
- Heavily censored users should configure a meek-azure bridge. [44]
Kicksecure VM Security[edit]
- Consider disabling the Control Port Filter Proxy (.onion) to reduce the attack surface on Kicksecure.
- Consider hardening systemcheck.
- Consider the periodic deletion and recreation of VMs that are used for sensitive operations.
- If a compromise of Kicksecure is suspected, follow the compromise recovery instructions.
Difficult[edit]
Anti-Evil Maid[edit]
- Consider the Android Haven application for sensitive devices -- motion, sound, vibration and light sensors can monitor and protect physical areas. [45]
- If a Trusted Platform Module (TPM) is available, enable it in BIOS/UEFI and configure the required services to protect against Evil Maid Attacks.
- Kicksecure-Qubes: Utilize AEM protection to attest that only desired (trusted) components are loaded and executed during the system boot. [46]
- Kicksecure-Qubes: Utilize AEM protection
Disposabless[edit]
Qubes / Kicksecure-Qubes only.
Note: Some traces of Disposables usage and data contents will leak into the dom0 filesystem and survive reboots; see here for further information. (This is a Qubes-specific issue and unrelated to Kicksecure.)
- Run all instances of Firefox in a Disposables (.onion) which is preferably uncustomized to resist fingerprinting.
- Configure each ServiceVM as a static Disposables to mitigate the threat from persistent malware accross VM reboots. [47]
Email[edit]
All Platforms[edit]
- Follow the Kicksecure recommendations to select an email provider compatible with security and privacy.
- Use Mozilla Thunderbird (.onion) as an email client. [48]
- For greater email or message security, consider using the OneTime application or a physical one-time pad (.onion) for military-grade encryption.
- Follow all other email principles for greater safety.
Kicksecure-Qubes Only[edit]
- Use split-GPG for email to reduce the risk of key theft used for encryption / decryption and signing.
- Create an App Qube that is exclusively used for email and change the VM's firewall settings to only allow network connections to the email server and nothing else ("Deny network access except...").
- Only open untrusted email attachments in a Disposables to prevent possible infection.
Ethernet/FDDI Station Activity Monitor[edit]
- Consider running ArpON as a daemon to defend against ARP attacks like ARP spoofing, ARP cache poisoning and ARP poison routing. [49]
- Consider utilizing Arpwatch to be alerted about any changes to the database of Ethernet MAC addresses seen on the network. [50]
Flash the Router with Opensource Firmware[edit]
Warning: risk of bricking your router!
- Flash the insecure, limited-utility, proprietary firmware on the router with a powerful, open-source GNU/Linux alternative.
Multi-Factor User Authentication[edit]
- Set up two-factor authentication (2FA) to strengthen the security of online accounts, smartphones, web services, access to physical locations and other implementations.
- Configure PAM USB as a module that only allows user authentication by inserting a token (a USB stick), in which a one-time password is stored.
- For secure account logins, utilize a Nitrokey hardware authentication device which supports one-time passwords, public-key encryption, and the Universal 2nd Factor (U2F) and FIDO2 protcols.
- Qubes: Follow the YubiKey instructions (you can adjust it to be compatible with nitrokey) to enhance the security of Qubes user authentication, mitigate the risk of password snooping, and to improve USB keyboard security.
- Qubes: Follow the YubiKey
Systemd Sandboxing[edit]
- Create drop-in
.conffiles to sandbox systemd services.
Expert[edit]
Disable Intel ME Functionality[edit]
Warning: high risk of bricking your computer!
- It is possible to partially deblob Intel's despicable ME firmware image by removing unnecessary partitions from it.
- Alternatively, Intel ME's "High-Assurance Platform" mode can be set manually to disable most ME capabilities.
Disable SUID-enabled Binaries[edit]
This is an experimental feature recommended for testers.
- Consider enforcing the SUID Disabler and Permission Hardener to increase the security of the system; see here for instructions. [51]
Opensource Firmware[edit]
- Libreboot is no longer recommended as a proprietary firmware alternative; see footnote. [52]
- Coreboot is a possible BIOS/UEFI firmware alternative -- consider purchasing hardware that has it pre-installed (like Chromebooks), or research flashing procedures for the handful of refurbished motherboards that support it.
- Note: The open Qubes ticket on Research support for libreboot/coreboot-based systems makes the opensource firmware recommendation generally unsuitable for Kicksecure-Qubes at present.
- Exception: Several laptops meet Qubes' Certified Hardware requirements and are configured with Coreboot, Heads and a partially disabled Intel Management Engine.
- Note: The open Qubes ticket on Research support for libreboot/coreboot-based systems
Footnotes[edit]
- ↑ This reduces the likelihood of a successful root or non-root user compromise.
- ↑ Kicksecure 16 and later versions disable the root account by default.
- ↑
https://forums.whonix.org/t/use-sudoedit-in-whonix-documentation/7599
- ↑
This addresses spying techniques:
- SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
- relying on watermarked, (in)audible sounds that can link multiple devices, as well as headphones/speakers being covertly used as a microphone.
- SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit
- ↑ This applies to both Intel and AMD architecture.
- ↑ While this may introduce new vulnerabilities, this is objectively better than running a system that is vulnerable to known attacks.
- ↑ This hides hardware identifiers from unprivileged users.
- ↑ sudo apt install jitterentropy-rngd
- ↑ sudo apt install haveged
- ↑
https://forums.whonix.org/t/delete-disable-nobody-user-from-whonix-passwd/14085
- ↑ The reason is AppArmor profiles (and possibly other mandatory access control frameworks) are unlikely to allow access to these folders by default.
- ↑
Debian KeePassXC package.
- ↑ For greater security, store the password manager off-line.
- ↑ To estimate strength, an 8-word Diceware passphrase provides ~90 bits of entropy, while a 10-word passphrase provides ~128 bits of entropy.
- ↑ For greater safety, copy something else into the clipboard after pasting so the password is purged and cannot be accidentally pasted elsewhere.
- ↑
For example, sensitive notifications (pop up dialog boxes) can appear over the screensaver while locked, and screensaver bypass bugs are common.
Screen Locker (In)Security - Can we disable these at least 4 backdoors?
- ↑ Also see: Disconnecting a video output can cause XScreenSaver to crash (QSB-068, CVE-2021-34557).
- ↑ The Kicksecure and Debian repositories are no longer set to onion mirrors by default due to stability issues. This decision will be reviewed in the future once v3 onions have further matured.
- ↑ If a keyserver is required, utilize the v3 onion address for
keys.openpgp.org:http://zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion - ↑ Bidirectional clipboard sharing is currently enabled by default in Kicksecure VirtualBox VMs. There are security reasons to disable clipboard sharing, for example to prevent the accidental copying of something (non-)anonymous and pasting it in its (non-)anonymous counterpart such as a browser, which would lead to identity correlation.
- ↑ Providing a mechanism to access files of the host system from within the guest system via a specially defined path necessarily enlarges the attack surface and provides a potential pathway for malicious actors to compromise the host.
- ↑ A USB qube is automatically created as of Qubes R4.0.
- ↑ USB keyboards and mice expose dom0 to attacks, and all USB devices are potential side channel attack vectors.
- ↑ The Truth about Linux 4.6:
The real "hard truth" about Linux kernel security is that there's no such thing as a free lunch. Keeping up to date on the latest upstream kernel will generally net all the bug fixes that have been created thus far, but with it of course brings completely new features, new code, new bugs, and new attack surface. The majority of vulnerabilities in the Linux kernel are ones that have been released just recently, something any honest person active in kernel development can attest to.
- ↑ Kicksecure contributor madaidan has noted:
LTS kernels have less hardening features and not all bug fixes are backported but it has less attack surface and potentially less chance of having bugs. Stable kernels have more hardening features and all bug fixes but more attack surface and more bugs.
- ↑ Including grsecurity elements being mainlined by the Kernel Self Protection Project.
- ↑ This will likely become the default in future, see: Simplify and promote using in-vm kernel.
- ↑ Do not raise Qubes VM Kernel issues at Kicksecure. Instead, contact Qubes support.
- ↑ https://forums.whonix.org/t/what-to-post-in-this-qubes-whonix-forum-and-what-not/2275
- ↑ The TCP Initial Sequence Numbers (ISNs) are randomized.
- ↑ tirdad is installed in Kicksecure by default.
- ↑ This prevents remounting of the hard drive as read-write.
- ↑ This restricts Kicksecure accessibility to/from other nodes on the network such as printers, phones and laptops.
- ↑ WPA3 protocol improvements include:
- Protection against brute force “dictionary” attacks -- adversaries cannot make multiple login attempts with commonly used passwords.
- Stronger encryption: WPA2 relies on a 64-bit or 128-bit encryption key, but WPA3 uses 192-bit encryption.
- Use of individualized data encryption in open networks to strengthen user privacy.
- Forward secrecy: if an adversary captures encrypted Wi-Fi transmissions and cracks the password, they cannot use it to read older data.
- ↑ Do not rely on WiFi Protected Set-up (WPS), which has major security flaws.
- ↑ For example, it has been used for remote denial of service attacks and can even lead to a Linux kernel panic.
- ↑
1. Open file
/etc/sysctl.d/30_security-misc.confin an editor with root rights.
Kicksecure
This box uses
sudoeditfor better security.
Others and Alternatives
- This is just an example. Other tools could achieve the same goal.
- If this example does not work for you or if you are not using Kicksecure, please refer to this link.
sudoedit /etc/sysctl.d/30_security-misc.conf
2. Uncomment all lines starting with
net.ipv4.Note: This procedure can also be repeated in Kicksecure.
TCP SACK is not disabled by default because on some systems it can greatly decrease network performance.
- ↑
https://forums.whonix.org/t/disabling-tcp-sack-dsack-fack/8109/5
- ↑ https://forums.whonix.org/t/disable-sys-net-pings-to-fedoraproject-org/1952
- ↑ Although not implemented yet, all user-installed applications will be automatically configured to run in the sandbox and a prompt will ask which permissions should be granted to the application.
- ↑ Such as system information, host time, system uptime, and fingerprinting of devices behind a router.
- ↑ This prevents time-related attack vectors which rely on leakage of the host time.
- ↑ https://forums.whonix.org/t/tor-connectionpadding/7477
- ↑ For example, Kicksecure users residing in China.
- ↑ Notifications are made in real time for any potentially suspicious activity.
- ↑ Unauthorized modifications to BIOS or the boot partition will be notified.
- ↑ Users can configure
sys-net,sys-firewallandsys-usbas static Disposabless. This option has been available from Qubes R4 onward. - ↑ Reminder: The Subject: line and other header fields are not encrypted in the current configuration.
- ↑ Attackers use these methods to redirect local network traffic and execute Man-in-the-middle Attacks.
- ↑ Administrators are advised of any changes via email, such as new station/activity, flip-flops and re-used/changed old addresses.
- ↑ This reduces the attack surface by disabling SUID-enabled binaries and improves Strong Linux User Account Isolation. Some SUID binaries have a history of privilege escalation security vulnerabilities. This feature is part of security-misc.
- ↑ Although Libreboot is a free, opensource BIOS or UEFI replacement that initializes the hardware and starts the bootloader for the OS, the absence of proprietary firmware means important microcode security updates are unavailable. Also, even experts risk bricking their hardware during the process and it is incompatible with newer architectures, making it impractical for the majority of the Kicksecure population.
Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.
Kicksecure
A secure by default operating system with the latest security research in place.
A secure by default operating system with the latest security research in place.
Follow us on social media
FREE · PLUS · PREMIUM Support
At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
By using this website, you acknowledge you have read, understood, and agree to be bound by these these agreements:
Terms of Service,
Privacy Policy,
Cookie Policy,
E-Sign Consent,
DMCA,
Imprint
2012-2024 ENCRYPTED SUPPORT LP
2012-2024 ENCRYPTED SUPPORT LP
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!