Non-modular kernel for security

[bendy]

Hi,

I will be putting together a gentoo firewall / proxy box soon, and so have been browsing the gentoo security guidance notes.

One of the suggestions is to build a kernel with no loadable module support. Assuming that I choose the correct options for hardware support etc. in a monolithic kernel, is there anything else that won't work?

I would not expect the likes of alsa or pcmcia to work, but that's okay on this box. X might be occasionally useful - will it work without loading modules? Are there any other essential server apps or services that might be affected?

Cheers,

bendy.

[NeddySeagoon]

bendy,

Gentoo is somewhat less than ideal for a firewall. A firewall should only contain the minimum apps to allow it to do its job. The less software there is, the smaller the opportunity for security problems.

After your firewall is running you should strip out anything that might be useful to an attacker, like the compiler tool chain, X etc. Of course this makes updates a bit difficult.

If this firewall is a learning experiance, go ahead and learn. If its protecting your network, check out Smoothwall.

I'm not sure what a monolithic kernel does for security?

Regards,

NeddySeagoon
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.