Dale Pontius wrote:
7v5w7go9ub0o wrote:
Romain BERGE wrote:
Hey list,
I am planning buying a laptop. I would like to install a hardened
(workstation) profile on it.
Which hardware features/components should I take care of ? (to be
the most compatible with hardened) In the opposite, are there
some hardware components/brand to avoid ?
Thanks
Went through a similar exercise a few years ago; concluded that
one:
- first chooses the laptop that meets his needs (I wanted a 2
pounder with good screen and graphics to carry about in a back
pack, with frequent stops at hotspots)
- second googles about for linux success/failure stories about that
laptop. Gentoo has some great documentation and explanations
concerning Linux; Ubuntu has some great user lists regarding
specific hardware. My Sony was 95% Linux good to go, with detailed
Ubuntu discussions about xorg.conf.
- third if it works on Linux, it'll likely work for hardened. (this
was true for 32bit on my laptop; 64 may be different; I'll know
shortly )
FWIW, IMHO a hardened profile, along with other precautions, makes
a lot of sense on a laptop as there is all sorts of mischief
occurring at anonymous, college and Saturday-afternoon hotspots -
some of it quite sophisticated due to "pen test" software. It's a
wild west that you'll not experience on your firewalled desktop.
Just a side comment on this... I have scripts that figure out where
the heck I am when networking comes up, and based on that decide
what, if any, service(s) to bring up. When the current network is on
"other", NO services are started at all - even X is started with
"-tcp nolisten" so there are no open ports. Scratch that - dnsmasq
is listening on loopback, but that's it.
Maybe it's not all that's necessary, but it's a good first line of
defense.
Dale Pontius
Heh.....clever idea; makes good sense to me. :-)
(Some might argue for a VPN so as to avoid DNS poisoning or an
attack against Mara directly - guess that would depend upon the nature
of one's business at the hotspot. FWIW, I run unbound (DNS) in its own
jail. I'll shut it down and use a VPN when doing banking/other
sensitive stuff)
(Given I use individual, hardened (grsecurity) jails for anything that
connects outside, I can't totally block X - but I do firewall it; and
also confine it through xhost to local host only.
As far as running services - nope! Heh.... mindful of poisoning or
buffer-overflow attacks, I'll passively monitor the place with kismet
for a minute or two before announcing my presence, and then bring up
DHCPCD in a hardened jail for 3 seconds - long enough to set the network
assignments - then automatically kill it. Arpon can passively monitor
external ARP activity.)
