Actions

systemcheck Hardening

From Whonix

(Redirected from Whonixcheck Hardening)



Whonixcheckhard.jpg

Rationale[edit]

Although systemcheck already has apparmor and systemd hardening, some marginal security and anonymity benefits are gained by reducing: the number of network connections, the amount of code running, and unnecessary functionality. This is not the default configuration, since that would come at the cost of decreased usability for the entire Whonix ™ population.

Hardening Steps[edit]

Prevent Autostart[edit]

To prevent systemcheck from automatically starting, run.

sudo systemctl mask systemcheck

Prevent Whonix ™ Warrant Canary Check and User Census Counting[edit]

Refer to the following systemcheck chapters:

Prevent Polluting TransPort[edit]

Info

  • Whonix-Workstation ™ only.
  • This is only useful when running systemcheck --leak-tests. However, running this command with the Tor TransPort test disabled makes little sense; in that case it would be useful as a Tor SocksPort connectivity test.

Deactivate the TransPort Test for better Stream Isolation.

Open file /etc/systemcheck.d/50_user.conf in an editor with root rights.

(Qubes-Whonix ™: In Template)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/systemcheck.d/50_user.conf

Add the following content.

SYSTEMCHECK_DISABLE_TRANS_PORT_TEST="1"

Save.

Prevent Running apt-get[edit]

Info Complete these steps on both Whonix-Gateway ™ and Whonix-Workstation ™.

This prevents the running of apt-get by systemcheck.

Open file /etc/systemcheck.d/50_user.conf in an editor with root rights.

(Qubes-Whonix ™: In Template)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/systemcheck.d/50_user.conf

Add the following content.

systemcheck_skip_functions+=" check_operating_system "

Prevent torproject.org Connections[edit]

Connections to The Tor Project are prevented by default, therefore no action is required.

systemcheck only connects to torproject.org if the command systemcheck --leak-tests is manually run.

Footnotes[edit]



Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: Discourse logo.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png link=mailto:?subject=Systemcheck Hardening&body=https://www.whonix.org/wiki/Systemcheck_Hardening link=https://reddit.com/submit?url=https://www.whonix.org/wiki/Systemcheck_Hardening&title=Systemcheck Hardening link=https://news.ycombinator.com/submitlink?u=https://www.whonix.org/wiki/Systemcheck_Hardening&t=Systemcheck Hardening link=https://mastodon.technology/share?message=Systemcheck Hardening%20https://www.whonix.org/wiki/Systemcheck_Hardening&t=Systemcheck Hardening

Follow us on Twitter.png Twitter / Facebook.png Facebook.

https link onion link Priority Support | Investors | Professional Support

Whonix | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.