20

I am planning to go back to Linux as a Desktop machine. I would like to make it more secure. And try a few hardening techniques, especially since I plan to get my own server.

  • What would be a good, sane hardening strategy? Which tools should I use - Apparmor, SELinux, SMACK, chroot?
  • Should I use just one tool, e.g. Apparmor, or a combination of the above?
  • Which advantages/disadvantages do these tools have? Are there any others?
  • Which do have a sane configuration to security (improvement) ratio?
  • Which one would I rather use in a Desktop environment? Which one in a server environment.

So many questions.

Improve this question
2
  • 8
    A word of warning: experiment all you want, but don't turn on security systems on production systems if you don't understand them thoroughly. A lot of real-world exploits are against misconfigurations rather than core system flaws. With security, more features definitely doesn't imply better.
    – Gilles 'SO- stop being evil'
    Commented Oct 23, 2010 at 21:14
  • 2
    There is no single security tool that can magically turn your computer into an unbreakable machine (this is impossible anyway). You must work hard, experiment, and combine the settings of many different tools to achieve that. This is true both for desktops and for server machines. Also, try to follow Gilles' advice. A hard part of applying security practices on multiuser machines is that legitimate users must not be affected in any way.
    – sakisk
    Commented Aug 6, 2011 at 17:09

2 Answers 2

Reset to default
9

AppArmour is usually thought to be simpler than SELinux. SELinux is quite complex and may be used even in military applications while AppArmour tends to be simpler. SELinux operates on i-node level (i.e. restrictions are applied in the same way as ACL or UNIX permissions - on the other hand ) while AppArmour apply at path level (i.e. you specify the access based on path so when path changes it may not apply). AppArmour can also protect subproccesses (like mod_php only) but I am somehow skeptical about the real use of it. AppArmour seems to find its way into mainline kernel (it is in -mm IIRC).

I don't know much about SMACK but it looks like simplified SELinux from description. There is also RSBAC if you would like to look at it.

chroot has a limited scope of use and I don't think it would be much of use in a desktop environment (it can be used to separate daemons from access of whole system - like DNS daemon).

For sure, it is worth to apply 'generic' hardening such as PaX, -fstack-protector etc. Chroot you can use when your distro supports so does AppArmour/SELinux. I guess SELinux is better suited for high security areas (it has much better control over system) and AppArmour is better for simple hardening.

In general, I wouldn't bother to harden generic desktop very much, except switching off unused services, update regularly, etc. unless you work in highly-secured area. If you want to secure anyway, I would use what your distro is supporting. Many of them to be effective needs the application support (for e.x. compiling tools to support attributes, written rules) so I would advise to use what your distro is supporting.

Improve this answer
0
3

Use GRSecurity + PAX. Everything else is just marketing bullsh*t and/or mostly based on the PAX Team's work. The main developer honcho of PAX, pipacs just won a lifetime achievement award at Black Hat 2011/PWNIE:

His technical work has had an outsize impact on security: His ideas are fundamental to security improvements in all major operating systems in recent years, and his ideas have indirectly shaped most modern memory-corruption attack techniques. No attacker can be taken seriously nowadays that does not deal with defensive inventions pioneered by our winner.

So get grsecurity+pax if you really want a secure box. GRsec gives you RBAC control over your machine, lots of filesystem (chroot) based protections, PaX closes most of the possible attack vectors hackers use. You can also test your box with paxtest, to see what kind of protections and vulnerabilites your box has.

There could be performance impacts. Read the help :).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .