3 ms·

Anyone interested in solid advise / best parctices should read the NSA RHEL hardening guide [1]. It is great and provides nice details. They also have a tips pa

Anyone interested in solid advise / best parctices should read the NSA RHEL hardening guide [1]. It is great and provides nice details. They also have a tips pamphlet for quick reading but limited details [2]. [1] http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf [2] http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.pdf http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731....

glazskunrukitis 14y ago
This is really solid, thanks for sharing.
runjake 14y ago
You may have missed it, but the article mentions and links to the NSA guide.
meaty 14y ago
A big note to add: if you want a secure system, forget Ubuntu entirely and go with CentOS or RHEL with SELinux enabled and locked down correctly. It's as damn near bullet proof as you can get.
- jiggy2011 14y ago
  Perhaps, though I am more familiar with Ubuntu/Debian as I have used it extensively on the desktop. This means I am more confident in the implications of my actions and also have more consistent dev/deploy platforms.
  - tesmar2 14y ago
    It is worth switching, in my opinion, because of all the man-hours put into securing RHEL. The systems aren't THAT different and if you are pretty linux saavy already, I'd guess that you could have an understanding of the differences learned in ~6 weeks.
- fulafel 14y ago
  selinux can be a help but still very far from bulletproof. it's a type of bandaid. It was created by NSA so naturally they promote it.
  - pilom 14y ago
    SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by default now is indeed a band-aid. However, when developers and system admins understand how to create correct and secure SElinux policies, it does indeed approach bulletproof. With SELinux root can build systems which are so secure that root himself cannot hack them.
    - zurn 14y ago
      > With SELinux root can build systems which are so secure that root himself cannot hack them. Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :) See eg. http://grsecurity.net/~spender/exploits/exploit2.txt http://grsecurity.net/~spender/exploits/exploit2.txt
      - meaty 14y ago
        The exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly... So it technically would extinguish itself there and then. It works on the principle of least privilege so you start with nothing and add what the process needs.
        icelancer 14y ago
        No True SELinuxman, I see

glazskunrukitis 14y ago

This is really solid, thanks for sharing.

runjake 14y ago

You may have missed it, but the article mentions and links to the NSA guide.

meaty 14y ago

A big note to add: if you want a secure system, forget Ubuntu entirely and go with CentOS or RHEL with SELinux enabled and locked down correctly. It's as damn near bullet proof as you can get.

jiggy2011 14y ago
Perhaps, though I am more familiar with Ubuntu/Debian as I have used it extensively on the desktop. This means I am more confident in the implications of my actions and also have more consistent dev/deploy platforms.
- tesmar2 14y ago
  It is worth switching, in my opinion, because of all the man-hours put into securing RHEL. The systems aren't THAT different and if you are pretty linux saavy already, I'd guess that you could have an understanding of the differences learned in ~6 weeks.
fulafel 14y ago
selinux can be a help but still very far from bulletproof. it's a type of bandaid. It was created by NSA so naturally they promote it.
- pilom 14y ago
  SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by default now is indeed a band-aid. However, when developers and system admins understand how to create correct and secure SElinux policies, it does indeed approach bulletproof. With SELinux root can build systems which are so secure that root himself cannot hack them.
  - zurn 14y ago
    > With SELinux root can build systems which are so secure that root himself cannot hack them. Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :) See eg. http://grsecurity.net/~spender/exploits/exploit2.txt http://grsecurity.net/~spender/exploits/exploit2.txt
    - meaty 14y ago
      The exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly... So it technically would extinguish itself there and then. It works on the principle of least privilege so you start with nothing and add what the process needs.
      - icelancer 14y ago
        No True SELinuxman, I see