Hardening settings, explained

Each page explains one setting in plain words, tells you what you may notice after turning it on, and shows the commands to check and apply it by hand. IbexWall applies the same setting as a plan you review, with a snapshot and an undo.

Kernel

• Hide kernel addresses

  Programs without special rights can no longer read where things sit in kernel memory. Attackers use those addresses to aim exploits.

  Low risk

• Keep the kernel log for administrators

  The kernel log can reveal addresses and hardware details. Only an administrator may read it.

  Low risk

• Restrict eBPF to administrators

  eBPF lets programs run code inside the kernel and has been a steady source of flaws. This limits it to privileged programs and hardens its compiler.

  Medium risk

• Harden the eBPF compiler

  Makes the code the eBPF compiler produces harder to abuse for attacks that smuggle in chosen instructions.

  Low risk

• Do not load terminal line disciplines on demand

  Stops an ordinary program from making the kernel load rarely used terminal code that has been exploited before.

  Low risk

• Restrict userfaultfd

  An ordinary program can no longer use the kernel side of this interface, which attackers have used to time their moves precisely. Programs that handle their own memory in user space still work.

  Low risk

• Restrict performance events

  Only administrators can observe the whole system. What the CPU and kernel do stays measurable for your own programs, but a program of yours can no longer reach the kernel's measuring machinery.

  Medium risk

• Forbid loading another kernel while running

  Closes a way for an attacker with administrator rights to switch to a kernel they prepared.

  Medium risk

• Turn off the SysRq emergency keys

  The SysRq keys can reboot or dump a machine from the keyboard, and can be triggered remotely in some setups.

  Low risk

• Limit one program inspecting another

  A program may only attach to its own children, so malware in your session cannot read or change your other programs.

  Medium risk

• Turn off unprivileged sandboxes (user namespaces)

  User namespaces give ordinary programs a lot of kernel code to attack. Turning them off removes a large part of the surface.

  High risk

• Block obscure network protocols

  An ordinary program can make the kernel load old or rare network protocols (DCCP, SCTP, AX.25, ATM and others), and several have had serious flaws. Almost no computer needs them.

  Low risk

• Block rarely used file systems

  Mounting a crafted disk or stick can exploit the code of an old file system. This keeps the kernel from loading the ones almost nobody uses.

  Medium risk

• Block network file systems

  If you never mount shares from NFS or Windows file servers, the kernel does not need to carry that code.

  High risk

• Turn off Bluetooth

  Bluetooth has a long history of security flaws. If you do not use it, keeping its code out of the kernel removes that exposure.

  High risk

• Block the test video driver

  The vivid driver exists only for testing and has caused privilege escalation flaws.

  Low risk

Network

• Survive connection floods

  Keeps the machine answering when someone floods it with half-open connections.

  Low risk

• Ignore resets of closing connections

  Protects against a trick that ends a connection by sending a forged reset while it winds down.

  Low risk

• Ignore and never send ICMP redirects

  A network device can tell this computer to send its traffic through someone else. This refuses such messages and stops sending them.

  Low risk

• Refuse source-routed packets

  A packet can carry its own route, which lets an attacker steer traffic through a machine they control. This refuses them.

  Low risk

• Drop packets with a forged sender address

  Checks that a packet could really have arrived on the link it came in on, which stops address spoofing.

  Medium risk

• Ignore IPv6 router announcements

  A malicious device on the network can announce itself as the router and sit in the middle. This ignores such announcements.

  Medium risk

• Turn off selective acknowledgements

  This TCP feature has been the target of remote attacks. Turning it off removes that target.

  Low risk

File system

• Protect shared folders from link and file tricks

  Blocks the classic attacks that plant a link or a file in /tmp so a privileged program writes where the attacker wants.

  Low risk

• Do not run programs from /tmp

  Malware and exploits often drop a program into /tmp and run it. This stops anything from running there.

  High risk

Memory

• No memory dumps of privileged programs

  A crashing program that runs with extra rights no longer writes its memory, which may hold secrets, to a file.

  Low risk