[SOLVED] Profile for hardened with systemd

Message

olger901 · Post by **olger901** » Mon Apr 04, 2016 5:32 pm

Hello all,

I recently wanted to install Gentoo on my new server, but I noticed there was no profile in the portage for a hardened system with systemd. Which profile should I use if I want to use a hardened profile with systemd? Should I use the hardened profile or the regular systemd profile? If so, which settings should I be using if I use the systemd profile as base to make it hardened or what settings should I be using if I use the hardened profile to make use of systemd (just the systemd USE flag and a few minor modifications)? Is the hardened profile even supported with systemd?

Tatsh · Post by **Tatsh** » Mon Apr 04, 2016 6:48 pm

I use the hardened/linux/amd64/no-multilib profile with systemd. Currently on kernel 4.3.3 soon to upgrade to 4.4.2.

The only thing is getting the USE flags and kernel correct. My USE flags are a bit custom and I want to have a useful server for many things (video encoding, etc) but avoid installing GUI stuff at all costs.

Code: Select all

USE="-berkdb -debug -cdda -cdr -encode -firefox -fortran -gtk -gnome -handbook -ios -ipod -ldap -mng -nas -oss -pulseaudio -sdl -startup-notification -vhosts -xml -xscreensaver -webkit -qt -X bash-completion cjk crypt gif gpm idn jemalloc jpeg nls png ssl svg syslog systemd tiff vim-syntax -libav ffmpeg"

# And if you use Dracut
DRACUT_MODULES="crypt crypt-gpg crypt-loop dmraid gensplash lvm ssh-client systemd"

I do not recommend trying to use your own non-systemd initramfs. Use Dracut to create a correct systemd one. Don't forget to update your initramfs when you update systemd.

The systemd ebuild will complain if you are missing kernel options, so just watch out for that (meanwhile on gentoo-sources it's one option to pick).

Follow the guide otherwise: https://wiki.gentoo.org/wiki/Systemd#Installation

olger901 · Post by **olger901** » Mon Apr 04, 2016 8:27 pm

I've read that genkernel-next should work too (for building a systemd compatible initrd). So I think I'll make use of that in combination with EFIStub for booting and mdraid (Linux software RAID) for my RAID-1 set-up. Thank you for your help so far, I'll give it a go