Re: [gentoo-hardened] Remove toolchain?

[Ed W]

On 02/02/2010 11:34, basile wrote:
> schism@×××××××××.org wrote:
>
>> On Mon, Feb 01, 2010 at 01:35:10PM +0100, Hinnerk van Bruinehsen wrote:
>>
>>
>>> But there is one thing which disturbs me: Since Gentoo (and hardened
>>> Gentoo) is sourcebased, i'll need a complete toolchain to keep the
>>> system up to date.
>>>
>>> I don't like the idea of giving this tools to someone who might
>>> compromise the server.
>>>
>>>
>> Removing the toolchain is an old, common misconception whose originator
>> I would love to meet and slap some sense into.
>>
>>
> In fact, this itself is the answer to what to do if you want to remove
> the toolchain.  If you have several similar machines, you could use one
> to compile and build the .tbz2 packages for updates to deploy to those
> machines that do not have a toolchain.
>
> Having said that, I agree that removing the toolchain is weak defense
> and you should use rbac.
>
>

I personally like the hardened project, but I think it's easy to 
overlook that usually the biggest weaknesses (and most probed areas of 
exploit right now) are something like:

- Bad passwords for ssh/mysql (and other apps...)
- Various bad practices in web applications which allow remote 
exploit/access/sql injection/xss, etc
- Trojans/viruses which target client workstations and can capture 
information without breaking into the server
- Internal attacks... Admin's who leave. Disgruntled employees..

I think it's easy to overlook that the above is often your biggest 
source of risk and continue polishing something which is normally pretty 
resistant to external attack.  As a rough rule of thumb I can only think 
of perhaps a tiny handful of exploits in the last few years which would 
have allowed remote breakin to a non hardened box running your usual 
remote access services, say Apache or email or similar (I will discount 
Bind and Sendmail from this analysis...).  However, lots of unix boxes 
have been rooted through simple holes in web applications and a bunch of 
distros that leave remotely accessible accounts with known guessable 
passwords...

Virtualisation is also a big step forward for helping contain the 
effects of a compromised machine - I'm very impressed with what we have 
been able to do since we started using it on all our servers..!

Good luck

Ed W