-
Notifications
You must be signed in to change notification settings - Fork 0
Enhance security
We're going to protect our machine to prevent tempering with the boot process. To do that, we're going to use the secure boot functionnality from our BIOS. We're also going to create our own keys and sign any EFI binaries so we're in complete control of our machine. This will prevent all kind of attacks such as an Evil Maid attack or prevent any third party control of your secure BIOS keys. Of course, you'll have to keep your private key secure or else an attacker could simply sign a malicious binary with your keys. We're going to install the following packages
sudo pacman -S efitools openssl sbsigntools
First we're going to generate our own keys using a script found in this well written article. We will create a folder called efitools in our home folder to create our keys.
mkdir ~/efitools
vim ~/efitools/keys.sh
Paste the content of this script in keys.sh
#!/bin/bash
# Copyright (c) 2015 by Roderick W. Smith
# Licensed under the terms of the GPL v3
echo -n "Enter a Common Name to embed in the keys: "
read NAME
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME PK/" -keyout PK.key \
-out PK.crt -days 3650 -nodes -sha256
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME KEK/" -keyout KEK.key \
-out KEK.crt -days 3650 -nodes -sha256
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME DB/" -keyout DB.key \
-out DB.crt -days 3650 -nodes -sha256
openssl x509 -in PK.crt -out PK.cer -outform DER
openssl x509 -in KEK.crt -out KEK.cer -outform DER
openssl x509 -in DB.crt -out DB.cer -outform DER
GUID=`python3 -c 'import uuid; print(str(uuid.uuid1()))'`
echo $GUID > myGUID.txt
cert-to-efi-sig-list -g $GUID PK.crt PK.esl
cert-to-efi-sig-list -g $GUID KEK.crt KEK.esl
cert-to-efi-sig-list -g $GUID DB.crt DB.esl
rm -f noPK.esl
touch noPK.esl
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k PK.key -c PK.crt PK PK.esl PK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k PK.key -c PK.crt PK noPK.esl noPK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k PK.key -c PK.crt KEK KEK.esl KEK.auth
sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
-k KEK.key -c KEK.crt db DB.esl DB.auth
chmod 0600 *.key
echo ""
echo ""
echo "For use with KeyTool, copy the *.auth and *.esl files to a FAT USB"
echo "flash drive or to your EFI System Partition (ESP)."
echo "For use with most UEFIs' built-in key managers, copy the *.cer files;"
echo "but some UEFIs require the *.auth files."
echo ""
Make it a runnable script and execute it
chmod +x ~/efitools/keys.sh
./efitools/keys.sh
Follow the instructions and you should get all the necessary files created. Remember that you'll have to protect those keys from being accessed by an intruder.
Now that we have our own secure boot keys, we can sign any binary (here our GRUB) we want by running the following
sudo sbsign --key ~/efitools/DB.key --cert ~/efitools/DB.crt --output /boot/efi/EFI/artix/grubx64-signed.efi /boot/efi/EFI/artix/grubx64.efi
sudo mv grubx64-signed.efi grubx64.efi
Now we're going to setup KeyTool provided by efitools
to manage our keys in our BIOS. It might not be usefull for some BIOS that provide the option to manage your keys but for simplicity and ease of use, we're going to install it. The .efi
is located in /usr/share/efitools/efi/KeyTool.efi
.
Sign it by running
sudo mkdir /boot/efi/EFI/keytool
sudo sbsign --key ~/efitools/DB.key --cert ~/efitools/DB.crt --output /boot/efi/EFI/keytool/KeyTool.efi /usr/share/efitools/efi/KeyTool.efi
Now we're going to add it to our GRUB menu so we can access it easily.
Access your BIOS by restarting your computer and using the key (ESC, F5, ...) linked to your motherboard.
Finally, to prevent an attacker from just disabling our secure boot, we're going to add an administrator password. You can find that setting in your BIOS.
Congrats, now boot in your system and run the command
od --address-radix=n --format=u1 /sys/firmware/efi/efivars/SecureBoot-*
Your result should end with a 1
if you booted using secure boot. If so, your system is now even more secure! Remember that you'll need to either disable secure boot temporarily or sign your USB stick or whatever you want to boot to if you want to be able to use it to.
Once you're back in your system, login as a user. I assume you know what a firewall is all about so we're going to install one called nftables
. You could just configure your iptables
to create the same rules.
sudo pacman -S nftables nftables-dinit
Edit and comment the tcp sshd line
sudo vim /etc/nftables.conf
And enable the service by running
dinitctl enable nftables
You can now see the rules used currently
sudo nft list ruleset
We already installed the hardened version of the Linux kernel so we just have to tweak a few network kernel parameters
sudo mkdir /etc/sysctl.d/
sudo vim /etc/sysctl.d/99-network.conf
Add this config
# Do not act as a router
net.ipv4.ip_forward = 0
# SYN flood protection
net.ipv4.tcp_syncookies = 1
# Disable ICMP redirect
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
# Don't send ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
Finally apply your changes by running
sysctl --system
If you want to disable ipv6 you can do so by creating the file /etc/sysctl.d/40-ipv6.conf
and add this config
# Disable IPv6
net.ipv6.conf.all.disable_ipv6 = 1
Don't forget to reload your config
You also need to edit your dhcpcd config located at /etc/dhcpcd.conf
noipv6rs
noipv6
You can check that you don't have any ipv6 left in your interfaces
ip -c addr
You can now test pinging something with ipv6. It should fail!
ping -6 wiki.archlinux.org
The MAC address of an interface is a unique identifier that can be used to track us. We're going to randomize it when we boot our system. To achieve that, we can install a GNU package called macchager
yay -S macchanger-git
Next we're going to create a udev
rule called 81-mac-spoof.rules
and paste this
ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="original MAC of interface", RUN+="/usr/bin/macchanger -r interfaceName"
The original MAC of interface
is the orginal address of your interface and interfaceName
is the name of the interface. You can find both by running
ip -c addr
You can add a new line for each interface your PC has but do not change your lo
MAC adress. Now, each time you reboot you'll get a new MAC address!
TODO: wifi (https://wiki.archlinux.org/title/MAC_address_spoofing#iwd)
TODO DNSCrypt https://dnsleaktest.com/
doas mkdir /media
doas chmod 775 /media
doas chown root:wheel /media
yay -S autofs