Re: [gentoo-user] New Server, considering hardened, need pointers to tfm...

[Matthew Finkel]

On Sat, Dec 10, 2011 at 12:45 PM, Tanstaafl <tanstaafl@×××××××××××.org>wrote:

> Hello all,
>
> I'm considering rolling out a new server with gentoo, but wanted to base
> it on the hardened profile, but the docs I've read so far all seem to be a
> bit vague about all the details.
>
> I've been using gentoo for a while on my hobby server, but I installed it
> about 8 years ago, and chose the 'server' profile, and I must say it has
> been a real pleasure to maintain, and the only real hiccup I ever
> experienced was the mailman update that moved the directories for the lists
> without telling me what to do about it (the fix was simple, and the devs
> swiftly fixed the lack of post-install docs).
>
> Does anyone know of a good How-To that covers *all* of the bases? Ie,
> which model is best - grsecurity, PAX, SeLinux - and how best to implement
> it?
>
> Thanks...
>
>
You may be able to get a better response from the -hardened list, but I
built a hardened server a few months ago without much difficulty. As far as
I know, the correct model to use depends on what you want to do with the
server/what security you are looking to implement. When I went hardened, I
used PaX and grsec [1] because it offered the security I was looking for
but didn't restrict userland usability on a server on which I was the only
user. My understanding is that this restriction would be a consequence of
using SeLinux.

[1] http://www.gentoo.org/proj/en/hardened/grsecurity.xml

As for a solid comparison of the different models and tutorials for them, I
don't know of any. I just used [1] as well as the PaX page to install and
configure them and I didn't run into any problems.

hope that helps a bit (and I hopefully didn't describe anything
incorrectly).

- Matt