- Update "Lockout user after three failed login attempts", file mentioned no longer contains those lines ? (relevant lines were moved to system-auth, see these two commits)
- descriptions/rationale for all the links to other articles (MAC)
- base64 /dev/urandom | dd bs=1 count=10 2>/dev/null
- use (enhanced?) ACL on partitions
- sudo timeout
- Securely Wipe HDD
- Using File Capabilities Instead Of Setuid
- VNC, proxies, ssl, etc
- browser security (requestpolicy, noscript, sand-boxing browser)
- stack protector gcc flag: Put some text in the page indicationg Archlinux has it by default (See: FS#18864)
- run services as non-root (mention that Arch does this where possible by default - but it needs improvement via feature requests)
- run services in clean namespaces
- run services in chroots
- mention issues with sudo (any X11 application can grab the password, and it is a large setuid binary with potential vulnerabilities)
- describe password expiry policies (chage, passwd -X, etc.)
--thestinger 18:09, 11 January 2011 (EST), --Det (talk) 11:35, 3 January 2013 (UTC), --Flu (talk) 13:49, 19 April 2013 (UTC) -- Ndt (talk) 22:45, 12 August 2013 (UTC) --Compwiztobe (talk) 06:15, 7 September 2020 (UTC)
CentOS Wiki OS Protection Article
This seems to be a good article to cross-reference or to use as a basis to pull in more content here. CC BY SA rights so I suspect it is compatible with the Arch Wiki. http://wiki.centos.org/HowTos/OS_Protection
I am hoping to pull some content in myself, but I am by no means a security guy. I figured some wiser heads might be able to make better use of it than I or correct any mistakes I might make while attempting to contribute.
- Of course the information itself is not licensed/licenseable, however the way it is presented is, so you either study the original article and present the same information here in an original way, or you actually adapt some content from that article, but in that case the licence clearly states that you have to credit the original authors, and I guess you can do it by mentioning the original article in the Summary of your edits, and adding a link to Security#See also.
- Just as a clarification, I know that Help:Style#Hypertext metaphor states "If the upstream documentation for the subject of your article is well-written and maintained, prefer just writing Arch-specific adaptations and linking to the official documentation for general information", however in this case we can't talk about "upstream documentation", that's why the rule doesn't apply and duplication of information is allowed, being CentOS's and Arch's wikis on the "same level" with respect to the information provided.
- -- Kynikos (talk) 02:33, 3 August 2013 (UTC)
- Let's first compare the sections in the two articles and see how they relate:
- Modifying fstab -> Security#Partitions.
- Package installs -> We have Security#Authenticating_packages and a note at the bottom of Security#Partitions.
- Physical protection -> Security#Physical_security
- Restricting root -> We have Security#Use_sudo_instead_of_su which is a good start, but does not mention Ssh#Deny_root_login. File system permissions on
/root, which I think by default are not
700(they should be) should be added to Security#Filesystem permissions.
- Umask restrictions -> We should talk about
umaskin Security#Filesystem permissions.
- Pam modifications -> Realtime process management, a wiki page in desperate need of editing.
- Reaping idle users -> We should cover this in Security#User_setup.
- Restricting cron and at -> We have no equivalent.
- Wireless has to go -> Maybe worth talking about, but this is low-priority unless we are willing to write a more detailed section called "Wireless security" that is about more than just "turn off wireless."
- Sysctl Security -> Covered in Sysctl#TCP/IP stack hardening, maybe we should just link to this.
- Using TCP Wrappers -> I could not find anything on ArchWiki discussing general security practices for
- Beefing up IPTables -> Should be adapted into Iptables, but perhaps Simple Stateful Firewall (an article that has good information, but I am not sure if its name makes sense).
- Tamper Resistance -> We should have a section on logging in general and incorporate tools like this, probably.
- Comments highly appreciated.
- -- Ndt (talk) 05:09, 3 August 2013 (UTC)
- Let's first compare the sections in the two articles and see how they relate:
Nobody as script user
Systemd/cron_functionality#The_pkgstats_service article says that it is better to use
noboby for some tipe of scripts. Is there any person who can explain further and add a note in this article?
- Following the principle of least privilege it is logical to run as many scripts as possible as an unprivileged user. But this is not possible always, e.g. when the script needs (write) access to some file(s) to function properly, you need to provide those privileges. -- Lahwaacz (talk) 13:32, 13 September 2013 (UTC)
Improving the password section
This is a call for ideas and community effort to improve the password recommendations here. I think it's generally agreed that the password section needs (and has, for a long time, needed) some work.
What does the password section need? Is it even necessary - does it make sense for someone to get this information from a wiki? How can we back up our statements, so that we know that the password recommendations made aren't just totally arbitrary (e.g, "at least one number ...")?
Citing sources, I think, is useful here - even though there's an element of password generation that is a matter of opinion, there are many recommendation that can be made that are not opinion. Just my two cents. - Ndt (talk) 21:51, 29 August 2014 (UTC)
- A part I question is:
- Insecure passwords include... Phrases of known words (e.g., all of the lights, correct horse battery staple), even with character substitution.
- How about Diceware (mentioned in Disk_encryption#Choosing_a_strong_passphrase, which is linked to at the end of the section) ? --Alad (talk) 23:48, 31 August 2014 (UTC)
- I've added some clarifications to that sentence: .
- The whole problem comes down to the bits of entropy of a passphrase: if calculated against brute-force attacks, every character from the chosen set counts, because in general they are not releated to each other. In case of Diceware, the characters inside each word are related to each other, and instead what is independent are the words themselves, so the bits must be calculated on a per-word basis (it's vulnerable to dictionary attacks, which can be seen as a form of brute-force attack with every word representing a character in a set of 7776). Now, as you can see from the table in Wikipedia:Password strength, a set of 5 Diceware words is equal to e.g. 10 ASCII characters (64 bits); 7 words == 13 ASCII. Nowadays you'd need more than that to be "safe", but in the end it mostly depends on the importance of what you want to protect. Of course if you choose a phrase of words that are also grammatically related with each other, you're exposing it to some smart dictionary attacks, which would further lower the total bits of entropy.
- Actually, that whole section could be questioned, in fact I could make a strong password even with "Root words or common strings followed or preceded by added numbers, symbols, or characters", if I chose enough "root words" and numbers; I could even make a strong password with dictionary words grammatically related, if the sentence was long enough :) I hope it makes it clearer.
- -- Kynikos (talk) 14:34, 1 September 2014 (UTC)
- In the Choosing secure passwords section, I'd like to point out that we're linking to an unencrypted webpage for testing password entropy... phil.r.dubois (talk) 23:30, 18 April 2018 (UTC)
Removal of incorrect warning
Greetings, I have removed the warning regarding SHA512 on the password hashing section. It's true that one shouldn't use plain sha512 for password hashing, but that isn't what arch (or other Linux distributions) use or are even able to use. What they call "sha512" is crypt_sha512, analogous to cryptmd5 but with the hash function replaced. Crypt_sha512 is a strong sequential function with a configurable iteration parameter. Normal configurations are fairly slow by default and are configurable to be arbritarily slow. I also updated the text to make it clear that it used an iterated sha512 so that others would be less likely to suffer from your confusion. Cheers. --Gmaxwell (talk) 23:39, 24 December 2014 (UTC)
- I was fully aware that it runs a configurable number of sha512 iterations when I made the change. It's not enough iterations to make up for how cheap it is relative to bcrypt/scrypt and it requires very little memory so it does nothing to counter doing billions of hashes per second on a GPU. I don't care enough to argue about it but you shouldn't assume that it had anything to do with confusion. -- thestinger 23:48, 24 December 2014 (UTC)
- I have rephrased the first sentence of the following paragraph to "The default Arch hash sha512 is, however, different than plain SHA512. It is very strong and there is no need to change it." in an attempt to remove the inconsistency. Please proof-read this, since I am a no cryptography expert - the only source I was using was this very discussion. Also I am not native to English, so I can't guarantee I was grammatically correct. Here is the diff to my edit:  Kmph (talk) 20:30, 24 August 2015 (UTC)
- One more thing. Your phrasing does not state whether or not these 5000 iterations, in association with storing passwords in /etc/shadow, actually are secure. With the nearby warning, an impression is made that in might not be enough and that the wiki advises the user to use something else. You have removed this important sentence: "It is very strong and there is no need to change it". If this is appropriate, could you kindly explicitly state whether or not this default Arch's hashing is considered secure enough for normal desktop use? Kmph (talk) 21:00, 24 August 2015 (UTC)
- I'm not the expert, but I'd assume 5000 iterations is "not enough". However I don't know if 999 999 999 or any arbitray high amount is "enough" either. This assessment likely changes as hardware gets more powerful, or more efficient methods are discovered.
- The fact that the hashes are stored in
/etc/shadowshould be sufficient, but I don't know how to accurately word that ("can't be copied or cracked" is vague at best). -- Alad (talk) 21:05, 24 August 2015 (UTC)
- I have practically rewritten the section with these 3 edits, adding lots of links so that people can try to better understand this complicated process.
- Functions like bcrypt and scrypt are indeed aimed at making it more expensive to brute-force passwords with custom-hardware attacks, but if we don't tell people how to decide what function to use, and how to set it up, a warning like that is only FUD...
- — Kynikos (talk) 15:29, 28 November 2015 (UTC)
Let's forget about limits.conf?
Look rapidly at this blog post.
In short: limits.conf is useless for systemd daemons, because systemd has it's own LimitNOFILE=123456, LimitETC=50K.
This is also an issue for desktop users, because users implemented via slices, services and User Manager.
To set per-user resource-limits, now do the following:
mkdir -p /firstname.lastname@example.org/ cat > /email@example.com/limits.conf << EOF [Service] LimitNFILE=131072 EOF systemd daemon-reload systemd restart user@1000
1000 -- is a user's uid. Optional.
Using systemd for more secure services
I saw this article that lists several options for systemd units to help protect one's system. I think some of these should be added to our article. In particular recommends setting/enabling
RestrictRealtime for most long-running services. Some of these are simple boolean options. Others have different levels that can be set. Lennart lists these and others here. -- Rdeckard (talk) 19:40, 3 January 2017 (UTC)
- Working on a draft of some ideas here: User:Rdeckard/Secure Systemd -- Rdeckard (talk) 14:10, 5 January 2017 (UTC)
I feel like security is a too big topic to be covered by a single page and I would prefer information on how to secure something to reside in the respective article and Security to be more like General recommendations (shorter sections linking other articles).
- Merge sections with respective articles
- Move sections with enough content to dedicated articles
- Create new articles for article-worthy topics
- I don't think it's a good idea to force out information just because some section is longer than a few sentences or doesn't conform to the overview-only style.
- Security#File systems is already short enough, moving Security#Mount options to File systems would make it loose all context (you can change the formatting to shorten the lists)
- Security#Use sudo instead of su → sudo: I agree
- Security#DNS is already short enough
- Security#SSH is already short enough
- Security#Managing SSL certificates → Transport Layer Security: I agree
- Security#Kernel hardening → Kernel hardening: I think that section alone would make a rather boring page, it is fairly short (except a few longish code blocks)
- Security#Physical security is short enough to be kept on this page
- Security#Passwords and List of applications/Security#Password managers → Password management: I agree, but some people may prefer the list staying in List of applications, in which case the split wouldn't make much sense
- Mandatory access control, Sandboxing, Firewall - I think that the new pages would be just another overview pages, the current sections are short enough to be expanded on this page
- -- Lahwaacz (talk) 23:20, 5 January 2019 (UTC)
- Regarding Security#DNS you marked the relevant DNS sections for rewrite or expansion. It's better if that is finished first. Looking at [[DNS] now, my conclusion is that it would totally overwhelm a reader to understand the main points summarised in two paras here. With Security#SSH I see it a little different, but crosslinks would get more out of context and may be redacted out by someone unsuspecting. For example, linking Google Authenticator, is more useful in this article, not? --Indigo (talk) 21:49, 6 January 2019 (UTC)
- If you own a domain name, set a Sender Policy Framework policy to combat email spoofing.
- To me this article is not purely 'overview-only' but indeed to provide security context where a topic article may have a more general focus. For example, regarding Security#Managing SSL certificates that was the reason for my original edit comment in . It sure can be reworded/maybe shortened, but again the target should be finished before it makes sense to approach such.
- With the rest of the points I agree. --Indigo (talk) 21:49, 6 January 2019 (UTC)
Enforce a delay after a failed login attempt
Would it be worth to mention that auth optional pam_faildelay.so delay=4000000 intended to first login to the system only. And doesn't work when you unlocking screen later.
The additional configuration line has to be inserted as first line of the configuration file. Otherwise it has no effect.
If hidepid is enabled there is a minor issue with rtkit-daemon errors showing up in syslog.
pam_tally and pam_tally2 deprecation
These are all deprecated according to this commit https://github.com/linux-pam/linux-pam/commit/f49166c7d8f3ae2c9d337154f7e5dc50d41ab6bf
This deprecation extends to sections like 'Enforcing strong passwords using pam_cracklib', 'Enforce a delay after a failed login attempt' and such.
- changed "Lockout user after three failed login attempts" section to reflect deprecation of pam_tally2, only pam_cracklib is left - Kazel (talk) 22:27, 20 August 2020 (UTC)
systemd unit hardening and system.conf tweaks
As described in systemd#Sandboxing application environments, it is possible to sandbox/harden service units using systemd (also see ). I think it is well worth mentioning this under Security#Sandboxing applications and maybe moving the section from the systemd article to this one.
Especially because it is so trivial to do so it should be added in my opinion. As always, it depends, but a few directives (see below) can make a unit significantly more secure. The "highlights" in my opinion are:
NoNewPrivileges, basically prevents privilege escalation. See also
ProtectHome, this is configurable and an easy way to prohibit an application from manipulating things that it should not touch. Also prevents them from doing too much damage when they explode.
CapabilitiyBoundingSet), there is no need to run e.g nginx as root anymore if you can assign the unit
CAP_NET_BIND_SERVICE, so it can bind port 80/443. This is just an example, there might be cases where it makes more sense to let the application handle the dropping of privileges.
PrivateUsers, restricts the things the unit can see and use.
- certain performance-related directives from
MemoryMax. "Prevents" running of (with one of the CPU-related directives, of course) crypto miners. This is not really a "real" argument but restricting the resources a process can devour also has a few positive security-related side effects. , e.g
There are many, many more directives but I think that only the most important ones should be mentioned in the section.
Another thing I want to mention are some
/etc/systemd/system.conf ( ) tweaks:
native. This prevents running 32-bit binaries (because it blocks these syscalls), so unfortunately not every user can set this globally. As far as I know there are some (relatively) minor security implications from allowing 32-bit syscalls. However it is possible to override this for individual units, so the user can set this and make separate units for the (graphical) 32-bit binaries they need to run. This is quite tedious though.
yes. This is mostly a nice "performance monitoring" feature but it might be useful to see when a process used quite a bit of bandwidth. This gets logged into the journal and will be visible in the
Yes, I saw the other entry for this, but it is quite old and does not include
- I'm against moving any of these instructions to Security, it would make the page unnecessarily detailed and long. I think it would be better to split off systemd#Sandboxing application environments into e.g. systemd/Sandboxing, merge Arch package guidelines/Security#Systemd services there and then add all other hardening stuff. The new page could then linked from Security#Sandboxing applications. -- nl6720 (talk) 09:34, 25 February 2021 (UTC)
Why do you list Diceware as an insecure method to generate passwords?
Your article states:
Insecure passwords include those containing:
- Common phrases or strings of dictionary words (e.g.
photocopyhauntbranchexpose) including with character substitution (e.g.
And it further elaborates:
Formerly, it was effective to use a memorable long series of unrelated words as a password. The theory is that if a sufficiently long phrase is used, the gained entropy from the password's length can counter the lost entropy from the use of dictionary words. This xkcd comic demonstrates the entropy tradeoff of this method. However, password crackers have caught on to this trick and will generate wordlists containing billions of permutations and variants of dictionary words, reducing the effective entropy of the password.
I'm not sure if I understand this line of reasoning?
There are 95 printable ASCII characters. There are 95^16 (~= 4*10^31) possible passwords consisting of 16 random characters drawn from the pool of 95 printable ASCII characters. Likewise, there are 95^15 (~= 5*10^29) possible 15-character passwords.
A standard Diceware dictionary consists of 6^5 = 7776 words. This means there are 7776^8 (~= 1*10^31) possible 8 word Diceware passwords. This means that a Diceware password is somewhat less secure than a 16 character random password, but more secure than a 15 character random password.
It doesn't seem to matter if 'passwords crackers have caught on this trick' or not. If password crackers are going to mount a brute force attack using 'wordlists containing bilions of permutations and variants of dictionary words' they will still have to try about as many combinations as if they were cracking a 15 or 16 character fully random password. And that is assuming that the crackers are using the same dictionary that was used to generate the password (and we should assume this, as per the Kerckhoffs's principle).
If this password strength is unsatisfactory then there is no need to limit ourselves just to 7776 words. There are many more words in the language to choose from. For example, on my bookshelf I have a dictionary titled '100000 necessary words'. I'm sure we can find digital dictionaries of that many or even more words, faciliting automated generation of secure Diceware passwords. If this method was used we would end up 100000^8 = 10^40 possible passwords; this is even slightly better than if we were using a 20 character random password, as there are 95^20 ~= 4*10^39.
On the other hand, I'm pretty sure that an 8 word password, even one that uses obscure words, is easier to remember & type than a 20 or even 16 character random password. Kmph (talk) 17:39, 1 March 2021 (UTC)
- Just to add more context, the 7776 word limits comes from the number of permutation available with throwing 6 sided dices ( times, that's how you get the words. Either you keep this method as base, add another dice throw and you need to have a 46656 word list (I mean, I'm all for multilingual lists!), or you somehow reduce the value of the last throw (with a modulo 3 for example).
- Otherwise, I agree with your reasoning. It doesn't matter if the word list is public or not (I mean, you could create your own word list for all that matters).
- Also, one thing to take into account is the threat model. Who are you trying to protect yourself from? The government? They have much more effective method of getting your password if they really want to that just blindly bruteforcing it. From script kiddies hacking websites? You need a password stronger than the one from your neighbor and mainly unique (that's the big problem).
- I also can't wait to have emojis in my passwords (and a way to type them easily on my computer too!). You blend in emojis in the mix and your character list jumped from 95 to 3616. Until then, passphrases are king in my kingdom.
- Gromain (talk) 09:42, 12 May 2021 (UTC)
- I fully agree with Kmph. The justification for rejecting Diceware doesn't prove anything. Also the article recommends using a mnemonic phrase (“the girl is walking down the rainy street”) to remember a password where one word encodes one character in the password. This method is inferior to Diceware since a Diceware word contains 2 times more entropy than a character. The phrase “strings of dictionary words” and the justification for rejecting Diceware should be removed. --Beroal (talk) 12:33, 16 October 2021 (UTC)
- You should only use this type of password when you can not use a password manager, e.g as your LUKS or password manager passphrase since you have to enter these manually. Most other things can have a 128-char random password or similar.
- Those things also tend to be harder to bruteforce as these are usually not accessable via the internet. The main concern here is actually shoulder surfing, so longer xkcd-style passphrases may help with that.
- -- NetSysFire (talk) 12:50, 16 October 2021 (UTC)
Adding a section for issuing ATA SECURITY FREEZE LOCK command to SSD after putting the laptop to sleep and waking up
I want to add a section to this page to discuss the problem of Solid State Drives being vulnerable to ATA SECURE ERASE commands after waking up from sleep.
I first noticed this issue in the Solid state drive/Memory cell clearing article, and even presented a semi-solution to it in the section I wrote for Acer laptops ( specifically the Warning at the end ): Acer#Aspire_3_A315-56_internal_storage_not_showing_up ( Angle Devoid is my previous wiki account )
To explain this problem very briefly, SSDs at their normal condition are in a security state defined by the ATA specification as "SEC2".
In this security state, the "Frozen" bit is set so that commands like ATA SECURE ERASE cannot be executed.
The ATA SECURE ERASE is a firmware level command that, quote: "an easy-to-use data destroy command, amounting to electronic data shredding. Executing the command causes a drive to internally completely erase all user data. If this function is executed, then all user data and the management table will be destroyed and cannot be permanently retrieved."
When you put your device to sleep and wake it up, the SSD will have changed its state from "SEC2" to "SEC1", thus loosing its "Frozen" bit and is vulnerable to ATA SECURE ERASE commands.
If you want, this is the ATA specification I used to get some of my information from: https://people.freebsd.org/~imp/asiabsdcon2015/works/d2161r5-ATAATAPI_Command_Set_-_3.pdf
I want to add a sub-section to the storage section of the wiki article to address this issue, is this the right place to do?
- Interesting find! Does it occur on all systems that the SSD transitions from SEC2 to SEC1 when unsuspending? Is it only some SSD models that do this? Thanks, CodingKoopa (talk) 07:04, 28 May 2022 (UTC)
- There is Solid state drive#Security which doesn't even seem linked from this article.
- Perhaps it would be better if you added a subsection there, and linked that Security section from Security#Storage.
- -- Kynikos (talk) 12:25, 28 May 2022 (UTC)
- The article you mentioned does not give any kind of solution for sending ATA SECURITY FREEZE LOCK after waking up from sleep, this is the point I'm trying to make.
- The solution itself is very trivial, just put a script in /usr/lib/systemd/system-sleep/ to be run after waking up from sleep to issue an ATA SECURITY FREEZE LOCK.
- I'm not using systemd and I've even made a script to be run by elogind that does this for me, and from what I know, the syntax and rules do not differ, so my script can be easily copy and pasted into /usr/lib/systemd/system-sleep/:
#!/bin/sh if [ "$1" = 'post' ]; then sleep 1 DEV='/dev/disk/by-id/ata-Samsung_SSD_860_EVO_250GB' if hdparm --security-freeze "$DEV"; then logger "$0: ssd freeze command executed successfuly" else logger "$0: ssd freeze command failed" fi fi
- Perhaps I didn't make myself well understood: what I'm suggesting is that you add your proposed content under Solid state drive#Security instead of directly to this article, since that page is more specific to SSDs.
- Then, as an additional suggestion, I recommended adding a link to Solid state drive#Security from Security#Storage.
- -- Kynikos (talk) 20:04, 30 May 2022 (UTC)
- While expanding Solid state drive#Security for it works, because it already explains the subject, another option is to add a section to Hdparm#Tips and tricks with respective service units. This in turn can be linked from the storage section of this article and SSD#Security. Hdparm already contains examples for boot (e.g. Hdparm#Putting a drive to sleep directly after boot) and resume (Hdparm#APM level reset after suspend) units, which can be easily adapted or referred to. The point is: it is up to the drive/bios manufacturer whether a drive will be frozen at cold boot (as Lancia's is). Hence, both, cold boot and resume, may be useful to cover. In addition, you can also --security-freeze a HDD, but the tool is always hdparm.
- --Indigo (talk) 22:08, 30 May 2022 (UTC)