Re: Securing Fedora Core 4

> AragonX a ?crit :
>
> > <quote who="Cocobu">
> >
> >
> > > A good idea is patching the kernel with grsecurity
> > > (http://www.grsecurity.net/)
> > >
> > > Just my 2 cent.
> > >   
> >
> > That's the 2nd time I've heard that package suggested.  I checked out the
> > web site and it looks very powerful.  How easy is it to configure and
> > understand?
> >
> > My major problem with SELinux was that it was so complex, I couldn't see
> > everything it was doing easily.  That made it a not so good security tool
> > for me because I just had to trust that it was doing the right job and
> > doing it well...

On Fri, Sep 23, 2005 at 02:58:39PM -1000, Cocobu wrote:
> There is a quickstart paper on installing and configuring grsecurity 
> (http://www.grsecurity.net/quickstart.pdf)

GrSecurity has the very powerful advantage of working well without
ACLs/MAC.  There is a MAC subsystem, to be sure, but what I like most is
the randomization of all and sundry and the hardened chroot() jails.

MAC is complex, difficult to set up, very nonportable and not very
UNIX-like. Chroot() works just fine.

Additionally, the grsecurity patch contains the important kernel
security patches when/if required, and tracks the new kernel pretty well
(though it's a little behind right now).

                Joachim