3 ms·

grsecurity[1] for linux. You don't even have to use RBAC if you don't want to (you can still use AppArmor/SELinux/etc) but RBAC comes with a built-in learning

grsecurity[1] for linux. You don't even have to use RBAC if you don't want to (you can still use AppArmor/SELinux/etc) but RBAC comes with a built-in learning mode which is good and will likely do a better job than you could and generating a profile. Sure you'll probably have to hand tune it a bit but for production servers I see no reason why RBAC couldn't be used with it's training/learning mode. [1] https://grsecurity.net/ https://grsecurity.net/

mixedCase 10y ago
Plugging Alpine Linux, a distro that while known for its small size, which led to widespread adoption as a Docker base image, includes grsecurity by default in its kernel and is very security focused.
- iyn 10y ago
  It's hard to believe that Alpine is "very security focused", when both the .iso and checksums are served over http/have no https forced.
  - aidenn0 10y ago
    The ISOs are GPG signed.
    - iyn 10y ago
      True, but public key is also send with http by default and signature doesn't even have proper https. It is possible to securely verify the integrity etc (e.g by using keyservers), but Alpine doesn't help with this at all.