Hardenize the linux kernel with security-misc (by kicksecure/whonix)

[Hardenizer]

Hi,

Just thought its a good idea to share these security enhancements done by kicksecure/whonix project to the kernel which would be useful as well if it implemented in asus-merlin: (Not all directly applicable to the firmware but many do and worth look at)

GitHub - Kicksecure/security-misc: Kernel Hardening; Protect Linux User Accounts against Brute Force Attacks; Improve Entropy Collection; Strong Linux User Account Separation; Enhances Misc Security Settings - https://www.kicksecure.com/wiki/Security

Kernel Hardening; Protect Linux User Accounts against Brute Force Attacks; Improve Entropy Collection; Strong Linux User Account Separation; Enhances Misc Security Settings - https://www.kicksecure...

github.com

 

[Hardenizer]

Since Asus-Merlin support Tor i think this is important as well:

GitHub - Kicksecure/tirdad: TCP ISN CPU Information Leak Protection. TCP Initial Sequence Numbers Randomization to prevent TCP ISN based CPU Information Leaks.

TCP ISN CPU Information Leak Protection. TCP Initial Sequence Numbers Randomization to prevent TCP ISN based CPU Information Leaks. - Kicksecure/tirdad

github.com

Hope these improvements can be implemented for better security.

 

[ColinTaylor]

Quoting generic Linux security information isn't helpful.


P.S. It's "Merlin" not "Marlin".

 

[Hardenizer]

Quoting generic Linux security information isn't helpful.

Not sure what do you mean by "Quoting", what i posted is wide tested/studied tweaks to harden linux kernel.

P.S. It's "Merlin" not "Marlin".

Ah thanks for the correction (new here), fixed.

 

[ColinTaylor]

Quoting, posting, linking... whatever you call it, generic security information isn't helpful. Most of what you linked to is either not applicable or already implemented. Are you also going to list every Linux CVE and package update for the last 10 years? A router is not a Linux server or desktop, it's an embedded device. If you have identified a particular security vulnerability that's applicable to this router then by all means report it to Asus so they can patch it upstream.

 

[Hardenizer]

I see, thought security hardening can be done by down stream.

Never the less thank you.

 

[RMerlin]

This kind of large scale security hardening is beyond the scope of this project, sorry. A lot of these wouldn't apply to this scenario, and the amount of work involved wouldn't justify whatever limited gains may be provided by them. Keep in mind the router is a very different environment from a computer/server, where you have to take into account having multiple users, while the router firmware itself runs as root, and does not provide accounts for limited users, unlike a regular workstation.

I've done a pass at at least tightening some file permissions a few years ago, so there was already some work done toward improving general security, but it's always a matter of balance between effort vs payoff.

 

[SomeWhereOverTheRainBow]

This kind of large scale security hardening is beyond the scope of this project, sorry. A lot of these wouldn't apply to this scenario, and the amount of work involved wouldn't justify whatever limited gains may be provided by them. Keep in mind the router is a very different environment from a computer/server, where you have to take into account having multiple users, while the router firmware itself runs as root, and does not provide accounts for limited users, unlike a regular workstation.

I've done a pass at at least tightening some file permissions a few years ago, so there was already some work done toward improving general security, but it's always a matter of balance between effort vs payoff.

Not only that, but alot of these "linux" security measures are taken out of necessity to solve problems introduced by the developers of said implementations. As far as I am aware, most of these concerns would not be present in our routers simply because asus in partnership with their vendors, maintains their own implementation.

 

[L&LD]

P.S. It's "Merlin" not "Marlin".

Actually, it's RMerlin.

 

[ColinTaylor]

Actually, it's RMerlin.

No it isn't. We were talking about the name of the firmware (Asuswrt-Merlin), not the username of the developer used in these forums.