I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to combine it or just one of them?

I mean, the patches are known to secure local things like processes etc. from turning into zombies or stuff like that. But I don´t think, that those patches secures also my Internet Connection, does they?


If you are concerned about system integrity, then or (or the various similar security packages) are very powerful. Unfortunately, mastering their policies is far from trivial. (Any decent distro that includes SELinux will have predefined policies for all kinds of things, though.) Grsecurity policies are easier to create but still require some effort. Grsecurity has the big advantage over SELinux that it comes with several system hardening measures, like , which provides quite rigorous memory protection. On the downside, Grsecurity is not officially part of Linux and never will be (for, um, political reasons) and thus only few distros provide integration of Grsecurity.

My personal view: The whole concept of AV is entirely rotten because they are - in essence - nothing more than giant black lists that need to be updated frequently. Because of this they grow ever larger and don't protect you from 0-day-exploits. Personally I believe in encapsulation and containment, which is what SELinux, Grsecurity, etc. achieve.

IDS/IPS is useful to some degree, as long as you can keep it simple (like using iptables, fail2ban, or aide). "High-end" IDS/IPS work like AV and thus my view applies for them as well.

  • A few days later I got another view at this thing: Security enhancements likes selinux protects your file system including processes. But AV blocks viruses from getting into the file system. So, kernel security blocks viruses form executing, but not from compromising a system. Firewalls are also needed here. But Maybe AV not. They would work all together, sure, but uneccessary. Thanks a lot!
    – alpham8
    Mar 9 '15 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.