Hacker News Reader

Comment by WestCoastJustin | Hacker News Reader

Anyone interested in solid advise / best parctices should read the NSA RHEL hardening guide [1]. It is great and provides nice details. They also have a tips pamphlet for quick reading but limited details [2].

[1] http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

[2] http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731....

View on HN

You may have missed it, but the article mentions and links to the NSA guide.

A big note to add: if you want a secure system, forget Ubuntu entirely and go with CentOS or RHEL with SELinux enabled and locked down correctly.

It's as damn near bullet proof as you can get.

Perhaps, though I am more familiar with Ubuntu/Debian as I have used it extensively on the desktop. This means I am more confident in the implications of my actions and also have more consistent dev/deploy platforms.

It is worth switching, in my opinion, because of all the man-hours put into securing RHEL. The systems aren't THAT different and if you are pretty linux saavy already, I'd guess that you could have an understanding of the differences learned in ~6 weeks.

selinux can be a help but still very far from bulletproof. it's a type of bandaid. It was created by NSA so naturally they promote it.

SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by default now is indeed a band-aid. However, when developers and system admins understand how to create correct and secure SElinux policies, it does indeed approach bulletproof.

With SELinux root can build systems which are so secure that root himself cannot hack them.

> With SELinux root can build systems which are so secure that root himself cannot hack them.

Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :)

See eg. http://grsecurity.net/~spender/exploits/exploit2.txt

The exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly...

So it technically would extinguish itself there and then.

It works on the principle of least privilege so you start with nothing and add what the process needs.

No True SELinuxman, I see

This is really solid, thanks for sharing.

Reply on news.ycombinator.com