Inicio Explorar Axuda
Iniciar sesión
noah
/
videopc-infra
1
0
Fork 0
Ficheiros Incidencias 0 Pull Requests 0 Wiki

an IaC solution for seamless projector control in production environments

Árbore: 31b8d7b627
Ramas Etiquetas
videopc-infra
ZIP TAR.GZ
Noah Vogt 31b8d7b627 remove more uneeded packages and fix hyprland config hai 1 ano
dot-config 31b8d7b627 remove more uneeded packages and fix hyprland config hai 1 ano
local-bin 4df57cabf8 add security considerations + remove unused code made for hid interaction hai 1 ano
LICENSE 2017c36f62 clean history commit %!s(int64=2) %!d(string=hai) anos
README.md 4df57cabf8 add security considerations + remove unused code made for hid interaction hai 1 ano
apply-dotfiles ac46dc345d migrate dotfiles here %!s(int64=2) %!d(string=hai) anos
arch.sh a95540c7b3 move over again to BIOS boot %!s(int64=2) %!d(string=hai) anos
chroot.sh a95540c7b3 move over again to BIOS boot %!s(int64=2) %!d(string=hai) anos
videopc-bootstrap.sh 31b8d7b627 remove more uneeded packages and fix hyprland config hai 1 ano

README.md

Security Considerations

  • boot security
    • add BIOS password
    • use motherboard with TPM2.0 and BIOS password not stored in volatile memory
    • use secure boot
    • use full disk encryption with TPM keys
    • disable unneeded device ports in BIOS
  • prevent user input
    • blacklist all HID modules
      • usb
      • serial decies /dev/tty* (or more fine-grained) using a udev rule
    • disable unneeded device ports in software
  • prevent leakage through network
    • use https
      • use a self-signed certificate as to not worry about expiration
    • use firewall to block all ports except the two needed
  • vulnerabilty exploits
    • reduce software stack
    • apply some hardening
    • add update schedule