Re: [gentoo-hardened] Production server security

[Ed W]

Hans-Thomas Mueller wrote:
> Another option instead of Xen or SELinux is to set up vservers_, with
> Grsec+Pax.  The performance impact is minimal but you still get clean
> and isolated environments for your services.

I have a test server running under vserver and it was very easy to get 
it up and running, and although there appear to be some slight 
complications with networking, it's a really cool system.  Thumbs up

I look forward to flexing this system a bit more, but the big win seems 
to be that all the memory and disk is still shared, unlike under Xen 
where you allocate it out and have to live with your decisions.

In the case where you don't normally expect hostile users to be trying 
to run more CPU or disk than they should then this is an enormously more 
flexible solution.  For sure Xen may make more sense for certain hosted 
environments though (and you can pin VM machines down to certain limits 
even on vserver)

Give it a whirl - there are pre-merged patch sets for vserver + grsec + 
pax.

Ed W
-- 
gentoo-hardened@g.o mailing list