| 1 |
Hi Chris, |
| 2 |
I was in the same situation a couple months back. I wanted to setup my |
| 3 |
new Opteron server with Gentoo AMD64. After a lot of research and some |
| 4 |
initial testing I decided that (at least for me) AMD64 platform isn't |
| 5 |
ready just yet for normal usage on a server. |
| 6 |
|
| 7 |
I applaud the efforts of the AMD64 team and I plan one day to switch, |
| 8 |
but for now you may want to really analyze if you need the 64 bits for |
| 9 |
your server. If you don't really need them, you may be better off with |
| 10 |
the 32 bit versions for now, especially in a production environment. |
| 11 |
|
| 12 |
I speak from somewhat of a newbie perspective, if you are a seasoned |
| 13 |
professional then obviously you will be able to deal with the issues |
| 14 |
that come up. |
| 15 |
|
| 16 |
Best regards, |
| 17 |
Chris |
| 18 |
|
| 19 |
|
| 20 |
Chris Smart wrote: |
| 21 |
> Greetings, |
| 22 |
> |
| 23 |
> I am looking to build a new Opteron server soon, and I want to look at |
| 24 |
> securing it with SELinux (and 64bit only). |
| 25 |
> |
| 26 |
> Due to my own ignorance, I am a little confused as to the differences |
| 27 |
> between the Hardened project and SELinux, PaX, GRSecurity etc. |
| 28 |
> |
| 29 |
> My feeling is that the hardened project is really a collection of |
| 30 |
> like-minded security projects (ie selinux, grsecurity, pax). |
| 31 |
> And that using the hardened USE flag, binaries that support it will |
| 32 |
> build with hardened security features. |
| 33 |
> |
| 34 |
> As I am building this new 64bit opteron system from scratch, where |
| 35 |
> should I start? What stage tarball should I be using? What livecd? |
| 36 |
> |
| 37 |
> Most importantly what profile do I use? |
| 38 |
> profiles/hardened/amd64/ or profiles/selinux/2005.1/amd64/ ? |
| 39 |
> |
| 40 |
> Should I be using the selinux USE flag these days, or is that |
| 41 |
> depreciated in favour of the selinux profile? Should I have both? |
| 42 |
> |
| 43 |
> My guess is that I should use the a PaX enabled kernel with SELinux, or |
| 44 |
> perhaps GRSecurity, or even both. |
| 45 |
> |
| 46 |
> Any pointers to get me started would be most appreciated. |
| 47 |
> |
| 48 |
> Update: |
| 49 |
> I have tried using stage3-x86-hardened-2005.0 with both hardened and |
| 50 |
> selinux profiles. At various stages it complains about either multilib |
| 51 |
> or some 32bit libraries that the system is expecting. I could not get it |
| 52 |
> to work with selinux profile. |
| 53 |
> |
| 54 |
> However the last thing I have tried seems promising - it's the |
| 55 |
> /usr/portage/profiles/hardened/amd64/ profile. |
| 56 |
> It stops at a bug for libperl: |
| 57 |
> |
| 58 |
> oio.c:37: error: conflicting types for 'shmat' |
| 59 |
> /usr/include/sys/../gentoo-multilib/default/sys/shm.h:58: error: |
| 60 |
> previous declaration of 'shmat' was here |
| 61 |
> doio.c:37: error: conflicting types for 'shmat' |
| 62 |
> /usr/include/sys/../gentoo-multilib/default/sys/shm.h:58: error: |
| 63 |
> previous declaration of 'shmat' was here |
| 64 |
> make: *** [doio.o] Error 1 |
| 65 |
> |
| 66 |
> It is a known bug that prevents libperl from compiling on a non-multilib |
| 67 |
> system and at present there is no fix :( |
| 68 |
> |
| 69 |
> There is no stage3 amd64 hardened/selinux tarball that I can find. Am I |
| 70 |
> barking up the wrong tree? |
| 71 |
> |
| 72 |
> Cheers and thanks for your time, |
| 73 |
> |
| 74 |
> Chris |
| 75 |
> |
| 76 |
> -- |
| 77 |
> gentoo-hardened@g.o mailing list |
| 78 |
|
| 79 |
-- |
| 80 |
gentoo-hardened@g.o mailing list |
Archives