-1

I currently try to harden the system and the security of a Debian server running a database and a source code management. I just want networking and me (one user) to be able to login. Which runlevel is best for this?

I found out that my current runlevel is 2, but maybe 1 or 3 would be better. If so, how can I achieve this?

  • 1
    Asking "which runlevel" for security seems like a weird way of going about approaching such a problem. – Chris Down Dec 27 '13 at 16:00
  • Why do you think it would be better? – schaiba Dec 27 '13 at 16:00
  • 1
    On Debian, runlevels 2-5 are equivalent. 1 is single-user and typicially your database or network will not be up when at runlevel 1 – fpmurphy Dec 27 '13 at 16:02
  • Based on Wikipedia: runlevel 1 is a Single-user mode (in Debian systems), ... if I am the only user that runs the services, than the server rejects any other user connection, is this so? – Erdinc Ay Dec 27 '13 at 16:03
  • 1
    Single-user mode is not intended for normal operation (and note the "single user" must be root). Network connections don't necessarily involve any logins, unless your software implements them for authentication (e.g., sshd). A problem with single-user mode for a server is generally you want server programs to run non-root, some of them will only work that way. – goldilocks Dec 27 '13 at 16:33
1

Essentially, Runlevels 2-4 are equivalent on many Linux Distros.

It seems this is different on debian.

Take a look at this wiki article for more info

As long as your system is in a multiuser runlevel, you should be fine, and there is essentially no real difference other than a GUI/display manager starting.


You may want to know the following:

Halt/Shutdown

Usually runlevel 0, used to shutdown the system

Single-User Mode

Generally runlevel 1, used for changes on the system by root

Multi-User Mode

Usually Runlevels 2-5, some of these run levels start the display manager.

Reboot

Usually Runlevel 6, only to reboot the system


I would suggest looking into other ways to "harden" your system, instead of thinking about user runlevels.

  • +1 But: I think in stock debian, 3-5 are identical and all start a GUI, meaning the only multi-user, non-graphical runlevel is 2 (making that appropriate for a headless server). – goldilocks Dec 27 '13 at 16:24
  • I changed my post, I re-read the documentation. I was wrong. thanks for the help. – Nathan McCoy Dec 27 '13 at 17:01
  • but a single user mode could be much more performant and secure, doesnt single user mode increase security? – Erdinc Ay Dec 28 '13 at 13:33
  • 1
    it depends on what you mean by "increase security". It does not increase performance per se, it only disallows multi-user access, which could free resources since other users will not be executing any processes. It will definitely make your system more insecure, since you are always using root to perform any task, meaning all software would be run as root with full privileges on the system, (not to mention any other human error that may occur during use). This means any bug, malicious or not, could do what ever it wanted to do, say calling read() or write() for example, without errors. – Nathan McCoy Dec 30 '13 at 16:24
1

The runlevel does not have any security implication.

Runlevels S, 0, 1 and 6 are special-purpose (for startup, shutdown, maintenance and reboot respectively). The system configuration in these runlevels is incomplete (for example, the network may be down or heavily restricted), and application servers such as a database are supposed to be off.

Runlevels 2, 3, 4 and 5 are general-purpose. Under Debian, they are configured in exactly the same way by default.

You can introduce a distinction between (for example) runlevels 2 and 3, but don't do it for the sake of introducing a distinction. Do it only if you find a reason why you would be running different sets of services at different times. There is generally no point: in most setups, either your services are running properly, or something really bad is happening that preventing your services from running.

Controlling who can log in is not done through runlevels (unless you want different sets of users to be allowed at different times, and again, this would be a weird requirement, and it probably wouldn't be done through runlevels anyway). If you want to be the only user who can log in, don't create accounts for other people.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.