3 ms·
I do things like disabling ipv6 (to avoid thinking about ipv6 firewall), setting various sysctl settings (e.g. to make sure ipv4 forwarding is disabled), mounti
by tryauuum 4y ago
I do things like disabling ipv6 (to avoid thinking about ipv6 firewall), setting various sysctl settings (e.g. to make sure ipv4 forwarding is disabled), mounting /proc with hidepid option. I think this matters on any distro.
There's no perfect guide. You should collect things that make sense to you, put them in git and apply to your servers via Ansible/SaltStack
- aprdm 4y agoWhat does mounting /proc with hidepid option brings us?
- CameronNemo 4y agoMakes privilege escalation more difficult by tightening the information available to unprivileged processes.
- mindwok 4y agoIt means that unprivileged users cannot see what other processes are running. Basically just prevents exposing information that might help an attacker, but it does break some tools that might rely on parsing /proc for system information if they are running unprivileged.