[solved] Status of securityhandbook and hardening gentoo

[Elleni]

I am a not sure, what the status of security related projects are. Looking at the security handbook, there is a warning, that it hast not been modified since 2010. Then on the project: Hardened there are mentioned three contributors who all had a role in SELinux project and are all marked as not active. I also got aware long ago that the hardened sources where dropped because grsecurity developers had decided to limit access to their patches.

So my question is for a small private server serving web, mail, cloud and vpn services is it worth trying to implement some sort of hardening, and if so - which projects are well supported, maintained and suitable?

[Elleni]

I would really appreciate some thoughts about my questions.

I am thinking of installing and configuring fail2ban for the services of my server, but other than that, I am wondering if its worth the effort to try to harden the system even further or if sane setup of services and firewall rules might be sufficient?

[Ant P.]

The best cure is usually prevention. Minimise potential attack surface, don't run unnecessary non-TLS services (and consider not having ssh on a low port) - that should cut down a lot of log noise. Make sure the userid your web services runs as doesn't have write permissions to their own code. Run separate things as separate subdomains and fastcgi processes (especially PHP) if possible. If practical, you might want to add a basic Content-Security-Policy header on your webserver so it can only make internal requests; in the attempt something does inject bad stuff onto a page, it won't be able to phone home via the browser.

If you can make any services accessible only behind the VPN, that's good too - I have my IMAP set up that way.

[Goverp]

I know nothing about hardening, but note that kernel 5.x (~amd64, not AFAIK the current stable series) contain a growing number of grsecurity-inspired security settings.
That said, I found little about grsecurity in a quick glance at the security handbook.
_________________
Greybeard

[forrestfunk81]

I run hardened profiles on all my 24/7 installations. And like Goverp said, since the removal of hardened-sources many similar features have been merged to the main kernel line. I also prefer having separate LXC containers on separate partitions for each service but that's less security related than preventing one service going crazy and tear down the whole system.
_________________
# cd /pub/
# more beer

[Elleni]

Thanks a lot guys. Part of your suggestions I head already implemented, like no http only ssl access on sites, ssh on non standard high port and separate subdomains and cgiprocesses for separate services. Additionally I added csp header in apache configuration. I probably will try to switch to hardened no-multilib profile.

Switching from

[Goverp]

You might like the Kernel Self Protection Project's checklist
_________________
Greybeard

[Elleni]

Very nice. I'll have a look thank you.

Btw. I re-enabled gdbm and berkdb useflags in make.conf after finding out, that postfix was not able to query some of its configured databases anymore. (And I am wondering, if it was a good idea to put those two flags in make.conf or if it would have been sufficient to only add them for postfix or reconfigure postfix to not need them - which I don't know exactly how to do)

Without them I could not retrieve emails anymore and I had the following errors in mail.err without:

[Elleni]

Going through the kernel selfprotection settings and adapting where needed, there was one thing that was not clear to me.

[Hu]

[Elleni]

I have those in my kernel config

[freke]

[Elleni]

Great, thats what I have now too. Thanks for confirmation

[gengreen]

You may apply as well the following patch to the kernel :

https://github.com/anthraxx/linux-hardened

And better than hardened, hardened musl :

https://wiki.gentoo.org/wiki/Project:Hardened_musl

I

[Terry_Davis]

Any thoughts on the quality of different distro's hardened kernel's? Let's take Arch & Gentoo, for example... It takes a lot of work for a user to determine how many of which patches they might want got into their hardened kernel. So it is definitely a huge time saver to be on a distro with the most thought & care put into its hardened kernel fork (or "branch"?).

[Elleni]

gengreen thanks for your links. I'll have a look as soon as I find some time.

Terry_Davis, I only know gentoo as its the only distro I am using and the one I started with many years ago, it tought me everything I know about linux and I feel comfortable using it. I personally enjoy the opportunity to learn, as for me linux is a hobby and unfortunatelly I am not in a position to use it professionally yet. Which other distro would you consider a good choice as an alternative? Lately noticing how big players manipulate distributions to restrict freedom of choice and push init systems to de facto standards to pursue their own interests of user lockin to make money, my trust in them has decreased even more, and I feel very comfortable in this incredibly helpful and knowledgeable community, which is also willing to share its know-how, and I especially feel very comfortable to have all these guys here, not willing to swallow this systemd thing but continue to support openrc, not many other distros out there did resist, and I hope Poettering and his followers will not succeed to force gentoo to its knees in the future, heck - having guys like dantrell here, who put so much energy in providing gnome without systemd even though upstream decided to make systemd mandatory just feels good, not to forget all the others around being so patient with all these users asking for help, and help them by teaching them, not just giving solutions but opportunities to learn.

You're probably right that relying on a distribution or branch to take care of security and make these decisions for you might be a time saver, but on the other hand, for me one of the biggest advantages of gentoo is that you don't have to let others decide, you decide for yourself how your system should be. Not to mention that from my point of view it is pointless to worry about security of your system as long as you use systemd, especially watching the attitude of their main developer.

If I could use Linux professionally in production, I would probably still choose redhat, but only because my boss would probably want to have the theoretical/imaginary possibility to blame someone if something goes south, or he would believe that this would increase the chance of getting (so called professional, rather meaning payed) help.

[Terry_Davis]

[Vulgar]

Void Linux uses runit, no systemd. https://voidlinux.org/