I don’t like the state of information available for hardening Debian. (Official) Resources are obsolete and blog articles are usually recipes with no background . Whonix wiki seems to be the only thing that’s relevant for general advice. Good job everyone!
More restrictive Umask settings
A metapackage to remove bloat and insecure packages [?]
Non-permissive iptables settings [?] :would probably be wonky since use cases would be juggled between vanilla debian and Whonix, though
More aggressive service disables in systemd[?]
Make new services disabled-by-default instead of enabled-on-install
Speaking of keeping dependencies down, if you could limit the dependencies to only what is necessary I will help you port the packages to Ubuntu. I started doing this for Whonix packages a couple years ago but there was enough differences in the Ubuntu/Debian KDE versions and dependancies that it became impossible so I dropped it. But I think if you stuck to minimal dependancies this will be much easier.
Dependencies for individual packages are minimal. Necessary stuff only.
Could you please have a look at some packages and let me know if
dependencies are non-minimal?
Many years ago (maybe up to Whonix 7 or so) there were no separate
packages but only packages like whonix-shared, whonix-gateway and
whonix-workstation with all files but that has long been deprecated in
favor of separate packages.
Hardened Debian would make a great introduction to Linux for Windows users who might want to try Linux out for the first time. Much of the documentation from the proposed "whonix-can-become-a-distribution-targeting-first-time-linux-users" project could be used for this. Maybe even combine the two projects for maximum usefulness? I think that would be very reasonable with some community contributions.
Very true indeed no diluting the hard (pun unintended) earned recogniztion allowed.
There is always that pre-existing notion in many users mind when they encounter the term “hardened” . Clearly the efforts often stray towards the notion with a “kernel” centric focus.
I am pretty sure Whonix efforts continue to encompass more.
The first word or English adjective that came to mind was “enhanced”
Perhaps to add to the consideration, the other words include
terms such as fortified, or reinforced.
Would you smile if I think out aloud with Whonix Steel / Whonix Stahl or even Whonix Stalo (in Esperanto)
@0brand Wow SecLix that name when said real quick sounds cheeky LOL @Patrick - WOW… indeed its high time we make SEO work to our benefit
BTW… I was wondering if you and your entourage have already ideas on this effort become a darling template in Qubes as well. (No No but not as a HVM puhleese) Am I dreaming…? pinch me
Thats just wont happen for new comers to GNU/Linux. its self contradictory statement because Windows is for noobs when they come to Debian needs alot of changes and when there is “Hardened Debian” thats requires even more.
But if hardened debian going to be so idiotic one based on newbies configurations just like Ubuntu then no need the headache , freshly minimized Debian way much better in this case. (and most likely wont be considered hardened anyway…)
Generally we don’t encourage any derivatives to use parts of Debian’s name in their name, as it increases likelihood of confusion that it’s an official product of the Debian Project.
That said, we are perfectly happy with derivatives saying true statements like “…, based on Debian” or “Debian based”.
