5 ms·
Amazed that "Install grsecurity" isn't one of the key things listed here. Sure, you have to compile your own kernel, but the enhanced memory protections and man
by muppetman 13y ago
Amazed that "Install grsecurity" isn't one of the key things listed here. Sure, you have to compile your own kernel, but the enhanced memory protections and many other hardening features make it an excellent addition to your security arsenal.
http://grsecurity.net http://grsecurity.net
- txutxu 13y agoThe article absolutely forgets about parametrize the kernel space.
- zobzu 13y agoinstall pax would be more accurate. anyhow the article tells nothing special. fail2ban doesnt do anything to secure you, also
- FooBarWidget 13y agoIt's not just "you have to compile your own kernel". It's "you have to compile your kernel EVERY TIME there's a kernel update". If you forget one update and you leave an exploit on your system, you're screwed. Having said that, I'm surprised Debian and Ubuntu don't have better support for grsecurity. If they'd provide up-to-date packages I'd switch over.
- nly 13y agoMy dedicated server provider ships grsec enabled kernels by default. Admittedly, they tend to be a bit stale.
- krenoten 13y agoI'm not really "Amazed" as that is going a particular bunkerization route that resists a certain class of attackers that you would not be capable of holding off anyway as someone who this article is useful to in the first place. Properly configuring RBAC is probably slightly above much of the target audience.