Re: [gentoo-hardened] Current proposed way of installing gentoo hardened

[Kevin]

Hi Ed,

First, thank you very kindly for such a long and thoughtful reply.  I 
really appreciate it.  But I'm still not quite clear on a couple of 
things, so perhaps I can elaborate below?

On Friday 30 April 2004 05:15, Ed Wildgoose wrote:
> Hi Kevin,
>
> I'm just a beginner like you, but here is my take on things
>
> >That last sentence describes me, so I go there...
> >
> >So I follow the _Gentoo Hardened_ link which points to
> >http://hardened.gentoo.org from which I get redirected to
> >http://www.gentoo.org/proj/en/hardened/
> >
> >Here I see a link: _SELinux x86 Install Guide_ which I followed.
>
> Yep, looking at the docs you came to reasonable conclusion.  However,
> the fact remains if you re-read that page closely and read the couple
> of previous threads on this list (in the last few days).  You can see
> that the "Hardened" project (capital H) covers a host of technologies.

Well, I saw that from the beginning.  That page (above) lists all of those 
different technologies (or maybe most of them) as the subprojects of the 
Hardened Project.  But knowing a little bit about how SELinux works, I 
figured that it was a fundamental part of the Hardened Project and that 
it needed to be integrated from the very beginning; during the install 
process.  Plus, with SELinux being the first Subproject listed in the 
collection of Subprojects for Hardened, it lends credence to that 
impression (IMO).  And under "6. Resources" on that page, I see an 
Install Guide for x86 architectures (only install guide there), so I used 
it, realizing that it was for only one subproject (SELinux) of the 
Hardened Project, but thinking that I could add in the other subprojects 
after getting a fully functional Gentoo box with SELinux support running.

In responding to my first post in this thread, you initially wrote:
On Thursday 29 April 2004 18:24, Ed Wildgoose wrote:
> >after untarring the stage1 tarball
> >(stage1-pentium4-pie-ssp-2004.0.tar.bz2), there is no
> >directory /mnt/gentoo/selinux to use as a mountpoint for an selinuxfs
> > (as
>
> I guess that is because you used the hardened stage 1, not the selinux
> stage 1 !  I think hardened doesn't need selinux?  As in they are not
> equivalent (part of the same team though)

But...

The iso image that I downloaded in accordance with the Gentoo x86 SELinux 
Installation Guide 
(http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml) 
and then burned onto a CD comes right out and says something along the 
lines of: "Welcome to the Gentoo Hardened Project."  I mean, I'm reading 
docs for SELinux (an apparently major subproject of the Hardened Project) 
which tell me to get an iso image, and after booting, I get a splash 
screen that states: Hardened Gentoo (cap H).

So, if I understand correctly, I got a Hardened Gentoo iso image (or so it 
calls itself), I got a Hardened stage 1 tarball (found in 
http://gentoo.oregonstate.edu/releases/x86/2004.0/stages/x86/hardened/), 
and I'm reading the SELinux install guide to do this.  Where would I find 
an SELinux iso image and an SELinux stage 1 tarball?

I seem to need three different items that were designed to be used with 
each other: iso image, stage 1 tarball (docs say Hardened can only be 
built this way, not via stage2 or 3), and some documentation.  Which ones 
do I use to do a Hardened install?  Which ones do I use to just do an 
SELinux install?

> Some are patches to gcc or the kernel to basically tackle "stack
> overflows" (See Ned Ludd's links for a better description"), this means
> hardened-gcc + a PaX kernel, ie grsecurity).  The other side of
> hardened is kernel level mandatory access controls, ie even root can't
> do everything (this bring linux up to the security levels of a *well*
> setup Windows machine, *dig, dig*) - this is the selinux part.
>
> So the hardened stages are compiled with a compiler that has added some
> extra code to watch for the stack being trampled.  Selinux stages refer
> to using a kernel that has access controls *on every file*.
>
> Unfortunately you and I have arrived at a time when the gcc stuff is
> being migrated from an old style way of doing things to a much more
> gentoo and integrated way.  In fact I get the impression that once this
> is sorted, then the whole of gentoo will likely get the "hardened"
> (little h) flag set by default...?  However, right now, it's slightly
> broken I think?
>
> >Um... I'm trying to build a production server here.  Should I stay
> > away from this stuff?  It sounds like kinks and problems and
> > documentation are still being worked out.  If I want a Gentoo server
> > and I want it to be providing public services on the Internet (albeit
> > through a firewall), what plan should I be using here (ie, what
> > combination of boot CD image, stage1 tarball, and documentation URL
> > should I be using?)?
>
> Tough call really...  Lets look at it this way.  I haven't tried Suse,
> but I am building my gentoo server to replace a Redhat webserver.  I
> really like the way it just stays up to date, no fiddling round with
> packages and conf files every time you update.  I have also never had a
> problem with updating to later versions of packages either, which is
> something that terrifies me on a production machine, and although I
> have read stories of other people getting caught, it is really easy to
> roll back to the older package if neccessary!
>
> However, the hardened project is taking some really complex stuff and
> integrating it into the gentoo system so that you can just click a
> button and have it work.  This will be really worth having, but since
> you are probably a busy sysadmin with little appetite to take risks on
> a system right now, then I would suggest that you be cautious about
> getting on the bleeding edge.

Exactly what is it that's bleeding edge right now?  I see "bleeding edge" 
and think, "not appropriate for production servers."  Is that what you 
mean?  So what's bleeding edge?  SELinux?  All of the Hardened 
subprojects?  Just some of them?  Which ones?

>
> Why not look to take the stage2-hardened build (if there is such a
> thing). And ignore the selinux stuff for the time being?  I'm in pretty

From 
http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-install.xml:
================================================
8. Stage tarballs and chroot

Selecting the desired stage tarball 

Now, you need to decide which one you would like to use as a basis for the 
install if you have not already.

Since we are compiling everything "from-scracth", as is currently required 
by the Gentoo SELinux install...                  ^^^^^^^^^^^^^^^^^^^^^^^
================================================

> much the same situation, but having 2 gentoo servers already I have a
> bit more confidence.  However, I am considering starting with a stage-x
> hardened, (and then pretty much following the normal gentoo install)
>
> You need some confirmation from the experts, but with the hardened
> builds, it is basically a normal install but with a different compiler,
> and choose a pax kernel as well.  You need confirmation though as to
> whether:
>
> a) you stick with the hardened gcc ebuild which is now obselete
> b) upgrade to gcc 3.3.2 which is stable, and add -fstack-protector to
> your CFLAGS
> c) Upgrade to gcc 3.3.3-r2 and how that none of the bugs bite (less
> likely with a stage-2 or stage-3 build...?), and add USE="hardened"
>
> b) is the safest for a production machine, and worst case you will have
> less protection that you wanted, but better than a standard build.
> Everything should compile ok.
>
> >I've already
> >uncovered a bug in the ebuild for the gs_sources kernel (involving the
> >Device Mapper patch) which is supposedly for production servers.
>
> Bad luck.  gs_sources is slightly unstable I think?  Well, remember

From the Gentoo Linux Kernel Guide 
(http://www.gentoo.org/doc/en/gentoo-kernel.xml):
================================================
gs-sources 

For users to whom desktop interactive performance comes as a secondary 
priority to reliability and hardware support, we have the gs-sources. GS 
stands for Gentoo Stable (creative, aren't we?). This patch set is tuned 
and tested to provide the best support for the latest hardware and 
ensures that your mission critical servers will be up when you need them. 
================================================


> that it isn't a Linus kernel so it is going to be patches that haven't
> been merged into stable yet....  I think it was just bad luck though,
> you would presumably have the same problems if you took a stable kernel
> and added your own patches...

No, I recently patched a plain Linux kernel from kernel.org with the 
Device Mapper patch (and some others) myself and built it and am running 
it on one of my production servers in a SuSE distro.

> Personally I prefer the 2.6 kernels, try
> -MM for a bleeding edge that seems to be pretty stable.

Well, I need to use OpenAFS for which there is currently no support in the 
2.6.x kernels.

>
> >I'm
> >starting to get the impression that Gentoo is just not ready (with or
> >without Hardened or SELinux) for production servers,
>
> Disagree, but in return for possibly finding a few bugs, you get a
> lovely distribution.  Redhat and Suse have plenty of gremlins in my
> experience.  You have been unfortunate to find a few in Gentoo.
>
> Personally, I found that all problems I ever found in gentoo were
> fairly easy to fix, and I wouldn't class myself as much of a linux
> expert.  In contrast I can do a lot more with gentoo than with my
> redhat machines. Well worth it in my experience.
>
> >and almost certainly
> >not with Hardened or SELinux.
>
> Perhaps...  I haven't used hardened enough to comment.  But from what I
> have seen, this time next year all linux builds will be "hardened"
> (little h), and secure sites will use selinux.  I can't see selinux
> becoming mainstream for a good few years yet though.
>
> Consider trying selinux only via user-mode linux for now...?
>
> >Could someone give me the skinny on this?
> >Am I barking up the wrong tree trying to use Gentoo to build a
> > production server?  Though I'm no developer, I am a reasonably
> > sophisticated Linux geek with about 9 years doing sysadmin on Linux
> > boxen, and I'm having real problems here.  Should I go back to SuSE?
>
> Nah.  You will find gentoo a piece of cake.

Well, that's just it... About 2-3 months ago, I did my first Gentoo 
installation on a non-critical workstation and really liked everything 
about it.  So, I am running Gentoo on a workstation I use frequently.  I 
really liked the install process, I really liked all the features of 
portage... I mean, after doing that one Gentoo install, I think Gentoo is 
the Cat's Meow in Linux distros, but I'm having real trouble doing even a 
standard Gentoo install right now (2 months later) on this production 
server.  I first reported problems with the gs-sources kernel to 
gentoo-user and gentoo-dev lists about a week ago, and John Nilsson on 
the dev list confirmed my problems with device mapper, and found a bug 
report documenting the same problem (Bugzilla Bug 48973 
gs-sources-2.4.25_pre7-gss-r3 compile error).

>
> The situation is as clear as this.  Gentoo has a dead easy installer,
> but it is manual.  ie you read the docs, type in all the commands in

I'll agree that it is very easy when there are no bugs.  It's wonderful.  
I have no problems with manual.  Love it, in fact.

> sequence, and you get a build out the other end.  After that it takes
> about 10 mins a month to keep it up and running.  Other distros are
> easier to get going, but to be honest, after I built the first few
> machines I have absolutely no problem with the manual setup - agreed it
> looks annoying the first time (Actually I think a small shell script

Not really.

> would just do the whole lot and I wonder why there aren't more basic
> installers available..?)
>
> Suggest that if you have probs then just revert to a normal gentoo
> build.  Follow the install, perhaps with a stage-2 or 3 the first time,

Well, see above...  My first install I did a stage1 and no problems 
whatsoever.  Now, I can't get gentoo-sources or gs-sources to build in a 
standard (normal) gentoo stage1 process.

> and play with the finished machine.  Then try again with hardened or
> whatever.

As far as I can tell, there is no hardened install guide other than the 
SELinux install guide.

> The point is it is pretty easy when you have done it once,
> and worth the effort

As I said, I think Gentoo is excellent.  That's why I'm working so hard to 
get it up on this server.  But right now the effort is tremendous.  I've 
been working on this for more than a week and I so far I haven't been 
able to get past the kernel build step because of bugs.

What I really need is for someone with more experience than you or me to 
either say, "Hey Kev, Hardened Gentoo with SELinux and the other 
subprojects will work and this is how you do it: get this iso image, get 
this stage1 tarball, and read these docs (for there are so many of each 
of these three that it's quite difficult to figure out which are meant 
for which) and you'll have a perfectly sound and stable system that is 
fine for use in a production server." or... "Hey Kev, we're really still 
hashing out problems in the Hardened Gentoo project and/or several of the 
subprojects, so you might want to stay away from these subprojects for 
now unless you want to help us test them."

Could some experienced Hardened Project folks say one or the other to me?  
Please?  I really think Gentoo is great, and I don't mind investing the 
time to do it up front as long as I can feel somewhat confident that I 
will have a system that is appropriate for a production server when I'm 
done.  I just need to know (a) if I am reasonable to have such 
confidence, and (b) how to get there if so.

Ed, thanks again for the long reply.  If this post sounds like a rant, 
then I'm sorry.  The bottom line is that I'm delighted with everything 
Gentoo has to offer, and I don't mind putting up with minor bugs here and 
there, but I would like to know how to proceed with setting up Hardened 
or if I should even try doing so with a production server.

Thanks to all who read this and apologies if it sounds rantish.

-- 
-Kevin

--
gentoo-hardened@g.o mailing list