Re: [gentoo-hardened] Recommendations for Production Server with MySQL, Apache, PHP, Postfix?

[Mikhail P.]

On Sunday 14 December 2003 00:28, Gavin wrote:
> I really need your expert advice on which path is more likely to lead to
> success (e.g. grsecurity vs. selinux).  I can invest about a week of my
> time into the setup process, but no more.  Thus I dare not try 3 or 4 of
> the various secure kernal packages before selecting a final one.  If things
> don't work after a week, everything is a bust for me.  I can find and fix
> bugs in Apache 2 and PHP source code, but I'm not yet familiar with the
> inner working of grsecurity, pax, propolice, selinux .. there's only 24
> hours in each day ;)   I would like the security features of grsecurity 2,
> including pax, but am not glued to the idea of using grsecurity.

Probably not an expert's advice, but I highly suggest grsecurity in this case. 
From my opinion, it is easier to setup than SELinux (which seems to be 
offering the most flexible ACLs on everything) and has all necessaries for 
production server.
GRSecurity has basic demo ACLs in standard setup, based on those you can 
"lock" the server and allow only "trusted" processes/actions.

regards,
M.


--
gentoo-hardened@g.o mailing list