[gentoo-hardened] Re: Hardened with 1 user and 0 services?

[7v5w7go9ub0o]

Alex Efros wrote:
> Hi!
>
> On Sun, Feb 24, 2008 at 06:15:22AM -0800, Grant wrote:
>> Are a hardened profile, kernel, and related USE flags beneficial on a
>> machine on which only I log in and no ports are open?
>
> If you open website, or download and run mp3, or download and open .xls,
> etc. - do any action which result in receiving and processing complex data
> format (i.e. not plain text :)), then there may be a security hole in
> software which will process that data. In this case hardened MAY protect
> you.
>
> To be honest I never heard about hacking Linux workstation this way, Linux
> is usually hacking by attacking network services.
>
> But this way to hack is very popular on Windows, and nobody can guarantee
> you'll never will be hacked this way on Linux (or course, on Linux only
> your current user's account will be compromised, but if this attack will
> result in removing all files in your home directory you will not be very
> happy with the fact this attack doesn't compromised your root and other
> user's accounts).
>


Think this is right on. And there are ways in which you can 
significantly leverage the advantages provided by a hardened kernel - 
e.g. the use of the hardened chroot jails provided by GRSecurity.

STM we've turned a corner - thanks to Mepis, PClos, etc. - and there are 
thousands (?) of windows users now annually converting to 'ix and MAC, 
They represent an increasingly visible potential for mischief, 
especially given they take their multi-platform windows tools (FireFox, 
TBird, Pidgeon, etc.) with them.

The "attacks" will come from net clients, not boot sectors nor 
exclusively servers. Browsers seem particularly vulnerable; able to be 
spoofed and/or redirected to malevolent sites that'll explore for 
vulnerabilities. This especially true if you occasionally surf "on the 
wild side" :-)

(Browser indeed. A lot of folks will take a reasonably secure browser - 
Firefox - and load it up with dozens of un-controlled third-party 
extensions and plugins; presuming that the unknown authors of these 
addons have great coding skill (many do not), the best of intentions 
(who knows?), and are using secure web sites to distribute their 
un-hacked code through unspoofed servers.)

The hardened toolchain'll protect you outright against some types of 
memory attacks; GRSEC'll provide additional PAX protections; putting 
net-clients into the much-harder jails provided by some hardened kernels 
(e.g. grsecurity) will confine damage (e.g. my browsers, mail clients, 
media players, chat client, ooffice, etc. are each in their own 
hardened-chroot jail), plus RBAC will stop a browser that suddenly 
decides to browse about the box (well, within the jail :-) ) looking for 
information, or trying to effect changes.

But don't look for a lot of confirmation regarding hardened desktops 
from other 'nix users - most are justifiably thrilled with the dramatic 
security improvements provided by Ubuntu straight out of the box, and 
don't want to consider the possibility of taking additional steps.

-- 
gentoo-hardened@l.g.o mailing list