Re: [gentoo-hardened] Re: Which laptop compatible with hardened-workstation ?

[Dale Pontius]

7v5w7go9ub0o wrote:
> Romain BERGE wrote:
>> Hey list,
>>
>> I am planning buying a laptop. I would like to install a hardened
>> (workstation) profile on it.
>>
>> Which hardware features/components should I take care of ? (to be the
>>  most compatible with hardened) In the opposite, are there some
>> hardware components/brand to avoid ?
>>
>> Thanks
>>
>>
>
> Went through a similar exercise a few years ago; concluded that one:
>
> - first chooses the laptop that meets his needs (I wanted a 2 pounder
> with good screen and graphics to carry about in a back pack, with
> frequent stops at hotspots)
>
> - second googles about for linux success/failure stories about that
> laptop. Gentoo has some great documentation and explanations concerning
> Linux; Ubuntu has some great user lists regarding specific hardware.  My
> Sony was 95% Linux good to go, with detailed Ubuntu discussions about
> xorg.conf.
>
> - third if it works on Linux, it'll likely work for hardened. (this was
> true for 32bit on my laptop; 64 may be different; I'll know shortly  )
>
> FWIW, IMHO a hardened profile, along with other precautions, makes a
> lot of sense on a laptop as there is all sorts of mischief occurring at
> anonymous, college and Saturday-afternoon hotspots - some of it quite
> sophisticated due to "pen test" software. It's a wild west that you'll
> not experience on your firewalled desktop.
>
Just a side comment on this... I have scripts that figure out where the
heck I am when networking comes up, and based on that decide what, if
any, service(s) to bring up.  When the current network is on "other", NO
services are started at all - even X is started with "-tcp nolisten" so
there are no open ports.  Scratch that - dnsmasq is listening on
loopback, but that's it.

Maybe it's not all that's necessary, but it's a good first line of defense.

Dale Pontius