Master's Student: A Quick and Dirty Guide To Kernel Hardening with GrSecurity

    Date20 Dec 2007
    CategoryFeatures
    25128
    Posted ByBrittany Day
    Our resident Master's student Gian Spicuzza chimes in this month with a great feature HowTo on Kernel Hardening! There are a number of ways to lock down a system, and RBAC (role based access control) is one of them. Read on to learn more about what makes RBAC so useful, and to read one of the best overviews on Low/Medium/High Security...

    The combination of the Linux kernel and GNU packages has always been regarded as a secure operating system, but can it be more secure? Kernel hardening is the answer to tightening up the Linux backbone. GrSecurity, a kernel patch for Linux, is one of the more popular approaches...

    One of the most significant feature is the addition of a role-based access control system (RBAC) that monitors what each user can execute based on their role and denies execution if they overstep their pre-defined rules.

    A Quick and Dirty Guide To Kernel Hardening with GrSecurity
    By: Gian G. Spicuzza ; www.8ciphers.com

    The combination of the Linux kernel and GNU packages has always been regarded as a secure operating system, but can it be more secure? Kernel hardening is the answer to tightening up the Linux backbone. GrSecurity, a kernel patch for Linux, is one of the more popular approaches. After applying this patch and compiling a fresh kernel, your system will have a plethora of new security features.

    The most significant feature is the addition of a role-based access control system (RBAC) that monitors what each user can execute based on their role and denies execution if they overstep their pre-defined rules. Other useful features include ip-based rules, extensive chroot restrictions, address space modification restrictions (PaX), auditing/logging features and /proc and dmesg anti-leak features. A full feature list can be found at the Grsecurity homepage.

    Installing Grsecurity:

    First we need to download the Linux kernel and Grsec patch.
    $ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.19.2.tar.gz $ wget http://grsecurity.net/grsecurity-2.1.10-2.6.19.2-200701222307.patch.gz
    For your convenience, the PGP keys are located at:

    http://GRSecurity.net/spender-gpg-key.asc
    http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.19.2.tar.gz.sign

    Move the kernel and patch into the /usr/src directory.

    $ su -c
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"8","type":"x","order":"1","pct":61.54,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":23.08,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"2","type":"x","order":"3","pct":15.38,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.