System hardening: adding hidepid to /proc?

[Brent Clark]

Good day Guys

I came across this document:

https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/

The idea is to increase security by hiding the display of running
processes, and their arguments, which belong to other users. This helps
avoid problems if users enter passwords on the command-line, and similar.

Its suggesting mount /proc with the option hidepid=2.

I would like to ask:

1) is it safe?

2) did you incur any issues?

3) what are your thoughts


The security audit tool, Lynis, also checks to see if /proc is mounted
hidepid?

[+] File systems
------------------------------------
  - Checking mount points

snippet

  - Testing /proc mount (hidepid)                             [ OK ]

Many thanks

Brent

P.s. I see its not suggested in the ''Securing Debian Manual"

[Reco]

Hi.

Post by Brent Clark
Good day Guys
https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/
The idea is to increase security by hiding the display of running
processes, and their arguments, which belong to other users. This helps
avoid problems if users enter passwords on the command-line, and similar.
Its suggesting mount /proc with the option hidepid=2.
1) is it safe?

Did not prevent boot for me (stretch, amd64, sysvinit).
Which means even if it breaks something - it should be possible to fix
without resorting to LiveCD booting and/or having console access.

Post by Brent Clark
2) did you incur any issues?

Nothing that catched my eye.

Post by Brent Clark
3) what are your thoughts

If that measure is your only defence against users that "enter passwords
on the commandline" (meaning actually that said users pass
usernames/passwords as commandline arguments so they are visible via
ps(1)) - you're doing it wrong as it's those commandline tools are
broken, not OS itself.
One should not tweak OS in such radical way without attempting to fix
those tools first. Or educating users. Or both.

Post by Brent Clark
The security audit tool, Lynis, also checks to see if /proc is mounted
hidepid?

I'm not familiar with this tool. Yet another thing I should research
once I have free time.

Reco