Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Ed Wildgoose]

Hi Kevin,

I'm just a beginner like you, but here is my take on things

>That last sentence describes me, so I go there...
>
>So I follow the _Gentoo Hardened_ link which points to
>http://hardened.gentoo.org from which I get redirected to
>http://www.gentoo.org/proj/en/hardened/
>
>Here I see a link: _SELinux x86 Install Guide_ which I followed.
>
>

Yep, looking at the docs you came to reasonable conclusion.  However, 
the fact remains if you re-read that page closely and read the couple of 
previous threads on this list (in the last few days).  You can see that 
the "Hardened" project (capital H) covers a host of technologies.  Some 
are patches to gcc or the kernel to basically tackle "stack overflows" 
(See Ned Ludd's links for a better description"), this means 
hardened-gcc + a PaX kernel, ie grsecurity).  The other side of hardened 
is kernel level mandatory access controls, ie even root can't do 
everything (this bring linux up to the security levels of a *well* setup 
Windows machine, *dig, dig*) - this is the selinux part.

So the hardened stages are compiled with a compiler that has added some 
extra code to watch for the stack being trampled.  Selinux stages refer 
to using a kernel that has access controls *on every file*.

Unfortunately you and I have arrived at a time when the gcc stuff is 
being migrated from an old style way of doing things to a much more 
gentoo and integrated way.  In fact I get the impression that once this 
is sorted, then the whole of gentoo will likely get the "hardened" 
(little h) flag set by default...?  However, right now, it's slightly 
broken I think?


>Um... I'm trying to build a production server here.  Should I stay away
>from this stuff?  It sounds like kinks and problems and documentation are
>still being worked out.  If I want a Gentoo server and I want it to be
>providing public services on the Internet (albeit through a firewall),
>what plan should I be using here (ie, what combination of boot CD image,
>stage1 tarball, and documentation URL should I be using?)?
>

Tough call really...  Lets look at it this way.  I haven't tried Suse, 
but I am building my gentoo server to replace a Redhat webserver.  I 
really like the way it just stays up to date, no fiddling round with 
packages and conf files every time you update.  I have also never had a 
problem with updating to later versions of packages either, which is 
something that terrifies me on a production machine, and although I have 
read stories of other people getting caught, it is really easy to roll 
back to the older package if neccessary!

However, the hardened project is taking some really complex stuff and 
integrating it into the gentoo system so that you can just click a 
button and have it work.  This will be really worth having, but since 
you are probably a busy sysadmin with little appetite to take risks on a 
system right now, then I would suggest that you be cautious about 
getting on the bleeding edge.

Why not look to take the stage2-hardened build (if there is such a 
thing). And ignore the selinux stuff for the time being?  I'm in pretty 
much the same situation, but having 2 gentoo servers already I have a 
bit more confidence.  However, I am considering starting with a stage-x 
hardened, (and then pretty much following the normal gentoo install)

You need some confirmation from the experts, but with the hardened 
builds, it is basically a normal install but with a different compiler, 
and choose a pax kernel as well.  You need confirmation though as to 
whether:

a) you stick with the hardened gcc ebuild which is now obselete
b) upgrade to gcc 3.3.2 which is stable, and add -fstack-protector to 
your CFLAGS
c) Upgrade to gcc 3.3.3-r2 and how that none of the bugs bite (less 
likely with a stage-2 or stage-3 build...?), and add USE="hardened"

b) is the safest for a production machine, and worst case you will have 
less protection that you wanted, but better than a standard build.  
Everything should compile ok.

>I've already
>uncovered a bug in the ebuild for the gs_sources kernel (involving the
>Device Mapper patch) which is supposedly for production servers.
>

Bad luck.  gs_sources is slightly unstable I think?  Well, remember that 
it isn't a Linus kernel so it is going to be patches that haven't been 
merged into stable yet....  I think it was just bad luck though, you 
would presumably have the same problems if you took a stable kernel and 
added your own patches...  Personally I prefer the 2.6 kernels, try -MM 
for a bleeding edge that seems to be pretty stable.

>I'm
>starting to get the impression that Gentoo is just not ready (with or
>without Hardened or SELinux) for production servers,
>

Disagree, but in return for possibly finding a few bugs, you get a 
lovely distribution.  Redhat and Suse have plenty of gremlins in my 
experience.  You have been unfortunate to find a few in Gentoo.

Personally, I found that all problems I ever found in gentoo were fairly 
easy to fix, and I wouldn't class myself as much of a linux expert.  In 
contrast I can do a lot more with gentoo than with my redhat machines.  
Well worth it in my experience.

>and almost certainly
>not with Hardened or SELinux.
>

Perhaps...  I haven't used hardened enough to comment.  But from what I 
have seen, this time next year all linux builds will be "hardened" 
(little h), and secure sites will use selinux.  I can't see selinux 
becoming mainstream for a good few years yet though.

Consider trying selinux only via user-mode linux for now...?

>Could someone give me the skinny on this?
>Am I barking up the wrong tree trying to use Gentoo to build a production
>server?  Though I'm no developer, I am a reasonably sophisticated Linux
>geek with about 9 years doing sysadmin on Linux boxen, and I'm having
>real problems here.  Should I go back to SuSE?
>

Nah.  You will find gentoo a piece of cake. 

The situation is as clear as this.  Gentoo has a dead easy installer, 
but it is manual.  ie you read the docs, type in all the commands in 
sequence, and you get a build out the other end.  After that it takes 
about 10 mins a month to keep it up and running.  Other distros are 
easier to get going, but to be honest, after I built the first few 
machines I have absolutely no problem with the manual setup - agreed it 
looks annoying the first time (Actually I think a small shell script 
would just do the whole lot and I wonder why there aren't more basic 
installers available..?)

Suggest that if you have probs then just revert to a normal gentoo 
build.  Follow the install, perhaps with a stage-2 or 3 the first time, 
and play with the finished machine.  Then try again with hardened or 
whatever.  The point is it is pretty easy when you have done it once, 
and worth the effort

Ed W

--
gentoo-hardened@g.o mailing list