4

The Kovri User Guide has a Step 2. (Recommended) Operational security. It is currently as follows:

  • Consider creating a designated kovri user and run kovri only using that user
  • If using Linux, consider using a hardened kernel (such as grsec with RBAC)
  • After installing the appropriate resources in your kovri data path, considering setting appropriate access control with setfacl, umask, or whatever your OS uses for ACL
  • Don't share your port number with anyone as it will effect your anonymity!

I'm mainly curious about the third item. How might running Kovri put my computer at risk, and how would those named softwares, or similar softwares, be used to mitigate those risks? What are some specific examples (or even one specific example) of what a user would do to follow the third item in this step? After following that third step, how it my system more safe/hardened?

If this may require a distro-specific response, I'm most familiar with (and therefore most curious about) Debian-based linux distros, and I've got Kovri currently on an Ubuntu 16.04.3 box.

  • Did you get Kovri running? I followed the User Guide but still have a slew of errors. – Lorax Sep 15 '17 at 1:55
2

The third point is about general operating system security with regards to which system users have read, write and executable permissions on files and folders in the kovri data path. setfacl (or chmod) can be used to set permissions on existing files / directories and umask is used to set permissions for newly created files in a directory.

Which users / groups you grant what access to is specific to your setup and needs.

As an example, if you only want the korvi user to have any access you could run: chmod 700 && umask 0077

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.