Obviously a generic hostname is advisable, but in practice, there are limited other solutions available at present. One is to turn off any protocols that are not strictly necessary and which leak hostnames, particularly when insecure places are visited. This reduces the attack surface, but is impractical for certain protocols; for example, DHCP is necessary for Internet connectivity and many services depend on protocols such as mDNS. Another option is to use different hostnames for different purposes, rather than relying on a global hostname - this option is available on some OSes. Ultimately, a randomized hostname protocol is necessary to protect privacy, similar to methods utilized for MAC addresses.
What is a randomized hostname protocol?
sudo hostname shows
localhost
Patrick
September 9, 2024, 10:41am
2
Related:
opened 01:11PM - 06 Jan 24 UTC
https://github.com/Kicksecure/security-misc/blob/master/usr/lib/NetworkManager/c… onf.d/80_randomize-mac.conf
```
[device-mac-randomization]
wifi.scan-rand-mac-address=yes
[connection-mac-randomization]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random
```
1) Breaks root servers, namely broke kicksecure.com. This is what the server provide sent by e-mail.
```
We have detected that your server is using different MAC addresses from those allowed by your Robot account.
Please take all necessary measures to avoid this in the future and to solve the issue.
We also request that you send a short response to us. This response should contain information about how this could have happened and what you intend to do about it.
In the event that the following steps are not completed successfully, your server can be locked at any time after 2024-01-17 16:51:11 +0100.
How to proceed:
- Solve the issue
- Please note, in case you have fixed the problem, please wait at least 10 minutes before rechecking: ...
- After successfully testing that the issue is resolved, send us a statement by using the following link:...
Please visit our FAQ here, if you are unsure how to proceed:
https://docs.hetzner.com/robot/dedicated-server/faq/error-faq/#mac-errors
Important note:
When replying to us, please leave the abuse ID [...] unchanged in the subject line. Manual replies will only be handled in the event of a lock.
Please note that we do not provide telephone support in our department. If you have any questions, please send them to us by responding to this email.
Kind regards
Network department
```
2) Breaks VirtualBox DHCP when using Network Manger (in Kicksecure) after VM reboot (`sudo reboot`). It is functional for the first start after powering off and powering on the VM. [1]
Might be related:
https://forums.virtualbox.org/viewtopic.php?t=86753
Could be a Network Manager issue:
https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1116421
https://askubuntu.com/questions/307717/networkmanager-problem-with-cloned-mac-address
----
[1] Before someone says that's a VirtualBox issue, no, I mean, maybe, but that doesn't matter.
VirtualBox is a valid environment. If that breaks, other environments will break as well.
Broken networking is extremely frustrating. MAC randomization would be suitable for Kicksecure, but only if stable.
It's not important enough to break common network configurations in common environments.
----
TODO: This bug has to be reported to Network Manager (NM) as above bug reports apparently never have reached upstream NM.
Which is blocked by:
opened 04:40PM - 13 Jan 24 UTC
Servers and workstations differ heavily, and there is no universal hardening tha… t is also fine grained for both. A server is inherently a network. This package should prioritize workstations, as kicksecure is meant to be one. I do not support the idea of also being a server system. Firstly, [some of hardening](https://github.com/Kicksecure/security-misc/blob/master/usr/lib/sysctl.d/990-security-misc.conf) already eliminates the possibilty of kicksecure usage on specific server types, like a file sync or an email server might already face problems because of network hardening. They may have gone unnoticed, but this doesn't change the fact. The two reasonable options are:
* Primarily good option: Forget about servers, do not try to keep support for them universally. This strips us of a very very big area of possible hardening options. If we want to support both, in terms of security, we will be the "jack of all trades, master of none". Nothing would be hardened to its full extend in this case.
* Secondary, in my opinion the least favorable option, because of the unnecessary work it would require: Split this package in two. One package ```security-misc-desktop``` and one ```security-misc-server```. At this point you can choose any other name you like.
But this has to be addressed in the near future, for the project to develop further.
MAC randomization is an extremely difficult technical challenge.
Neither is a priority for Kicksecure at this point due to:
So unless contributed, this won’t happen for a very long time.
Not at time of writing.