Tails

#2 Updated by alant 2014-01-15 12:58:27

We have been written that “the technical team should take a look at peerblock.com and evaluate incorporating lists from iblocklist.com this would address both dangerous LAN and WAN traffic.”

#4 Updated by Dr_Whax 2014-07-10 15:48:40

Perhaps we want to have an option in the tails-greeter to boot Tails with it being disabled and a way to temporarily enable it for 5 minutes to print a document. This means that a program would have to be created for this.

However, it’s hard to say in what kind of RFC1918 range you will be on for the local network. E.g, how can you know in advance whether its a 192.168 or 10.10 range? On the mailing list[1] it’s mentioned to parse the DHCP lease to only allow traffic to the local /24 (or more, depending on the lease?).

[1] https://mailman.boum.org/pipermail/tails-dev/2012-August/001490.html

#5 Updated by intrigeri 2014-07-21 16:21:41

> Perhaps we want to have an option in the tails-greeter to boot Tails with it being disabled and a way to temporarily enable it for 5 minutes to print a document. This means that a program would have to be created for this.

To be honest, I’m not too eager to discuss solutions before we’ve finished identifying the exact problems we’re affected by (Feature #5340):

• within our threat model;
• that actually would be solved if we blocked LAN traffic.

#6 Updated by intrigeri 2015-01-10 09:20:29

As a first baby step, we could block all LAN traffic except:

• SSH
• downloading from / uploading to a FTP server
• printing a document on a network printer
• Gobby
• going through whatever steps a captive portal asks me to; this generally involves DNS and HTTP, and potentially random ports => should be open only for the browser that’s allowed to talk to the Lan
• web browsing (using something else than the Tor Browser: Feature #7976)

#12 Updated by anonym 2017-04-20 11:26:18

little-snitch is being re-implemented for linux: https://github.com/evilsocket/opensnitch