Securing Linux, Part 2: Planning the installation (IBM developerWorks) [LWN.net]

IBM developerWorks helps build a secure Linux system. "The first step -- before inserting your distribution's CDs and launching the installer -- is to develop a security plan: determine what services the system will provide, which hardware will be used, what software is necessary, and how the installation will be organized. By making the effort to develop such a plan before the actual installation, lots of possible security issues can be identified and eliminated at a very early stage. This is beneficial as it helps to minimize the risk of a system intrusion or outage. Furthermore, it provides a sound basis for quickly reacting in case of attack or publication of software vulnerabilities and patches."

(Log in to post comments)

Securing Linux, Part 2: Planning the installation (IBM developerWorks)

Posted Nov 17, 2004 4:32 UTC (Wed) by walters (subscriber, #7396) [Link]

Any time I'm installing a system on which I worry about security at all, step number one is: Install SELinux.

It's rather baffling that they don't even mention it at all.

Securing Linux, Part 2: Planning the installation (IBM developerWorks)

Posted Nov 17, 2004 9:43 UTC (Wed) by flewellyn (subscriber, #5047) [Link]

This is PRE-installation planning, though.

SELinux is a great security framework, but if you don't have a plan of how to use it, then...well,
how much good is that going to do?

I'm sure they'll get to it in part 3.

Securing Linux, Part 2: Planning the installation (IBM developerWorks)

Posted Nov 17, 2004 14:48 UTC (Wed) by walters (subscriber, #7396) [Link]

I'm not sure if you're agreeing or disagreeing with me.

I agree that you need some sort of plan before installing SELinux. There are a number of things they could have mentioned in this article that are important to consider pre-installation. For example:

Which policy to use? targeted or strict?
Do all the daemons you're going to run have policy written for them? Are there alternative daemons that do have policy?
Will your users understand file labeling?
Are the default policy's user_r and staff_r roles sufficient for the user categories you've identified, or do new roles need to be defined?

Securing Linux, Part 2: Planning the installation (IBM developerWorks)

Posted Nov 17, 2004 18:02 UTC (Wed) by flewellyn (subscriber, #5047) [Link]

I'm not disagreeing with the importance of SELinux, just pointing out that their failing to mention
it in this article doesn't necessarily constitute an oversight. They may be holding off until the
next article.

That's all.

Securing Linux, Part 2: Planning the installation (IBM developerWorks)

Posted Nov 17, 2004 10:13 UTC (Wed) by melevittfl (guest, #5409) [Link]

OK, sort of OT, but security related...

I'm thinking of using one of my home systems as a personal web calendar server for myself/family/friends. So, I've got Fedora Core 2 running on the server and a NAT router/firewall.

The issue is this, all the stuff I read about runnig apache securely says to install apache in a chroot'd environment. However, that's not how it's packaged for Fedora.

So, it seems I've got a choice between installing a fresh copy of apache in a chroot'd environment, but loosing the ability to quickly apply updates vs. leaving apache as installed by default and having the ability to quickly update if a security hole is found.

Anyone have any insight into how to resolve this conflict?

Securing Linux, Part 2: Planning the installation (IBM developerWorks)

Posted Nov 17, 2004 14:12 UTC (Wed) by utidjian (subscriber, #444) [Link]

Install Fedora Core 3 where Apache (httpd) runs in an SELinux environment. You would want to read this:
http://fedora.redhat.com/docs/selinux-faq-fc3/

-DU-...etc...