Re: [gentoo-hardened] Remove toolchain?

[basile]

schism@×××××××××.org wrote:
> On Mon, Feb 01, 2010 at 01:35:10PM +0100, Hinnerk van Bruinehsen wrote:
>
>> But there is one thing which disturbs me: Since Gentoo (and hardened
>> Gentoo) is sourcebased, i'll need a complete toolchain to keep the
>> system up to date.
>>
>> I don't like the idea of giving this tools to someone who might
>> compromise the server.
>>
>
> Removing the toolchain is an old, common misconception whose originator
> I would love to meet and slap some sense into.
>
In fact, this itself is the answer to what to do if you want to remove
the toolchain.  If you have several similar machines, you could use one
to compile and build the .tbz2 packages for updates to deploy to those
machines that do not have a toolchain.

Having said that, I agree that removing the toolchain is weak defense
and you should use rbac.

-- 

Anthony G. Basile, Ph.D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
USA

[phone]