![]() ![]() I did quite a bit of research into it for my undergrad work, but it was when SELinux was still in a great deal of flux. Well, that is my current understanding of the beast. ![]() If regular permissions (discretionary) don't allow access (like no read bit set), then no need to go further. Permissions still are "fall-through", with discretionary being on the top most layer at all times. In fact, you can even stack SELinux on LIDS on SELInux if you so desired (man, think of the administration overhead though.lol). SE-Linux can be used, as well as others (LIDS for instance). The LSM was basically a framework, and a series of kernel hooks, that allowed you to stack an arbitrary permission engine on top of it. ![]() They called it the LSM (linux security module). Well, they presented this all at some big conference, and the kernel devs decided they wanted it in 2.6. If they were accepted by everything, then the kernel would reply to the request. Permissions went from top to bottom (discretionary to mandatory), and if they reached an impasse, they were denied. This was a stack on top of linux's existing discretionary access controls. Then the NSA began patching the linux kernel with the type enforcement stuff, implementing mandatory access controls in Linux. They decided to play nice with it, and basically promise (contractual most likely) the NSA to hold the patent on their behest, and allow anyone to use it (just patent it so that nobody else could, and then keep them from using it.at least this is my understanding). It is basically a permissions engine that ties into kernel space. ![]() Trustix (again, not sure about the name.might be recalling wrongly) got the patent on something called "Type Enforcement". Then they and they ported it to Flask (might be the other way, can't recall.i get fluke and flask mixed up). Fluke was a specification system.Not sure if it was ever fully implemented. It was a joint effort with Trustix (I think that is the one) working on the Fluke system. It started out as a project internal to NSA, kinda. Well, as for it being NSA, here are some additional points. oh, and this thing is not meant as a desktop system, that is because local sockets are denied for users in certain groups which prevents for example X11 from working. Unfortunately this is a bit like m$ is doing it: security through obscurity. and just because u can't scan here it's nearly impossible to find out where to do *real* damage using the hostserver.Īdditionally logs can be audited from the outside, never visible from the inside of the vserver. I must say that both run on the same ip an share the "port-space". * and some genereic exploit detection thingsĥ) no icmp & input traffic via iptables on host serverĦ) syslog & ssh (non-standard port above 16000) runs on the host server which boots and surveils the vserverħ) the vserver runs everything else (+ ssh on 22 ) but syslog w/ root disabled completelyĩ) pwd protected bios and boot from 1st HDD only here's what i did:ġ) set up my production box (using arch of course)Ģ) set up another GNU/Linux on a seperate partition, still leaving space for a copy of the 1st (backup)Ĥ) applied KBrown's patches to 2.4.27 which includes grsec & vserver support I don't feel safe running selinux (NSA *uck*) nor letting certain users su passwordless. once local security is compromised, a root password is meaningless if a live-cd (etc) is in hands, or as a wise user added - a baseball bat.Īnyway, to achieve this behavior one should do the followings :Ī. this will require anyone who wants to login to be familiar with the user name prior.ģ. root password will be disabled - thus anyone who will try login using root user will get denied. user password strength is same as root's password, and one must 1st login inorder to use su/sudoĢ. from local security point of view, disabling root and allowing su/sudo with no password achieves same level of security since :ġ. Disable root and gain su/sudo with no passwordĪfter my previous post about local security ( ) and the informative replies, i searched a bit further into the subject and learned it might be more secure, since root will be disabled thus will prevent hackers from ever gaining root control on your pc - via the net. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |