Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server.

  • What would be a good, sane hardening strategy? Which tools should I use - Apparmor, SELinux, SMACK, chroot?
  • Should I use just one tool, e.g. Apparmor, or a combination of the above?
  • Which advantages/disadvantages do these tools have? Are there any others?
  • Which do have a sane configuration to security (improvement) ratio?
  • Which one would I rather use in a Desktop environment? Which one in a server environment.

So many questions.

share|improve this question
4  
A word of warning: experiment all you want, but don't turn on security systems on production systems if you don't understand them thoroughly. A lot of real-world exploits are against misconfigurations rather than core system flaws. With security, more features definitely doesn't imply better. –  Gilles Oct 23 '10 at 21:14
2  
There is no single security tool that can magically turn your computer into an unbreakable machine (this is impossible anyway). You must work hard, experiment, and combine the settings of many different tools to achieve that. This is true both for desktops and for server machines. Also, try to follow Gilles' advice. A hard part of applying security practices on multiuser machines is that legitimate users must not be affected in any way. –  faif Aug 6 '11 at 17:09

2 Answers 2

AppArmour is usually thought to be simpler then SELinux. SELinux is quite complex and may be used even in military applications while AppArmour tends to be simpler. SELinux operates on i-node level (i.e. restrictions are applied in the same way as ACL or unix permissions - on the other hand ) while AppArmour apply at path level (i.e. you specify the access based on path so when path changes it may not apply). AppArmour can also protect subproccesses (like mod_php only) but I am somehow sceptic about real use of it. AppArmour seems to find its way into mainline kernel (it is in -mm IIRC).

I don't know much about SMACK but it looks like simplified SELinux from description. There is also RSBAC if you would like to look at it.

chroot have limited scope of use and I don't think it would be much of use in desktop enviroment (it can be used to separate daemons from access of whole system - like DNS daemon).

For sure it is worth to apply 'generic' hardening such as PaX, -fstack-protector etc. Chroot you can use when your distro supports so does AppArmour/SELinux. I guess SELinux is better suited for high security areas (it has much better control over system) and AppArmour is better for simple hardening.

In general I wouldn't bother to hardened much generic desktop (except switching off unused services, update regulary etc.) unless you work in highly security area. If you want to secure anyway I would use what your distro is supporting. Many of them to be effective needs the application support (for e.x. compiling tools to support attributes, written rules) so I would advice to use what your distro is supporting.

share|improve this answer

Use GRSecurity + PAX. Everything else is just marketing bullsh*t and/or mostly based on the PAX Team's work. The main developer honcho of PAX, pipacs just won a lifetime achievement award at Black Hat 2011/PWNIE:

His technical work has had an outsize impact on security: His ideas are fundamental to security improvements in all major operating systems in recent years, and his ideas have indirectly shaped most modern memory-corruption attack techniques. No attacker can be taken seriously nowadays that does not deal with defensive inventions pioneered by our winner.

So get grsecurity+pax if you really want a secure box. GRsec gives you RBAC control over your machine, lots of filesystem (chroot) based protections, PaX closes most of the possible attack vectors hackers use. You can also test your box with paxtest, to see what kind of protections and vulnerabilites your box has.

There could be performance impacts. Read the help :).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.