systemcheck Hardening
From Whonix
Rationale[edit]
Although systemcheck already has apparmor and systemd hardening, some marginal security and anonymity benefits are gained by reducing: the number of network connections, the amount of code running, and unnecessary functionality. This is not the default configuration, since that would come at the cost of decreased usability for the entire Whonix ™ population.
Hardening Steps[edit]
Prevent Autostart[edit]
To prevent systemcheck from automatically starting, run.
sudo systemctl mask systemcheck
Prevent Whonix ™ Warrant Canary Check and User Census Counting[edit]
Refer to the following systemcheck chapters:
Prevent Polluting TransPort[edit]
- Whonix-Workstation ™ only.
- This is only useful when running
systemcheck --leak-tests. However, running this command with the TorTransPorttest disabled makes little sense; in that case it would be useful as a TorSocksPortconnectivity test.
Deactivate the TransPort Test for better Stream Isolation.
Open file /etc/systemcheck.d/50_user.conf in an editor with root rights.
This box uses sudoedit for better security [archive]. This is an example and other tools can also achieve the same goal. If this example does not work for you or if you are not using Whonix ™, please refer to this link.
sudoedit /etc/systemcheck.d/50_user.conf
Add the following content.
SYSTEMCHECK_DISABLE_TRANS_PORT_TEST="1"
Save.
Prevent Running APT[edit]
Complete these steps on both Whonix-Gateway ™ and Whonix-Workstation ™.
This prevents the running of APT by systemcheck.
Open file /etc/systemcheck.d/50_user.conf in an editor with root rights.
This box uses sudoedit for better security [archive]. This is an example and other tools can also achieve the same goal. If this example does not work for you or if you are not using Whonix ™, please refer to this link.
sudoedit /etc/systemcheck.d/50_user.conf
Add the following content.
systemcheck_skip_functions+=" check_operating_system "
Prevent torproject.org Connections[edit]
Connections to The Tor Project are prevented by default, therefore no action is required.
systemcheck only connects to torproject.org if the command systemcheck --leak-tests is manually run.
Footnotes[edit]
Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.
|
100px |
| Fosshost | About Advertisements |
Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki
.svg.png&filetimestamp=20200623163525&.html){kind=small}
Want to get involved with Whonix ™? Check out our Contribute page.
Priority Support | Investors | Professional Support
Whonix ™ | © ENCRYPTED SUPPORT LP | 
Freedom Software / 
Open Source (Why?)
The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.