tag:blogger.com,1999:blog-47365135112465562302024-09-29T03:16:58.095+01:00SecurityTargets BlogPenetration Testing and Security Solutions.Unknownnoreply@blogger.comBlogger2125tag:blogger.com,1999:blog-4736513511246556230.post-19966385856720473062010-10-14T03:29:00.000+01:002010-10-14T03:29:05.520+01:00Hardening CentOS kernel with grsecurityHardening the server's kernel is one of the most important things we need to consider when speaking about OS hardening. This is mini-howto install and configure grsecurity on CentOS server.<br />
<br />
<a href="http://grsecurity.net/">grsecurity</a> is powerful and easy to use Linux kernel security enhancement. It gives you a lot of security features:<br />
<ul><li>An intelligent and robust Role-Based Access Control (RBAC) system that can generate least privilege policies for your entire system with no configuration</li>
<li>Change root (chroot) hardening</li>
<li>/tmp race prevention</li>
<li>Extensive auditing</li>
<li>Prevention of arbitrary code execution, regardless of the technique used (stack smashing, heap corruption, etc)</li>
<li>Prevention of arbitrary code execution in the kernel</li>
<li>Randomization of the stack, library, and heap bases</li>
<li>Kernel stack base randomization</li>
<li>Protection against exploitable null-pointer dereference bugs in the kernel</li>
<li>Reduction of the risk of sensitive information being leaked by arbitrary-read kernel bugs</li>
<li>A restriction that allows a user to only view his/her processes</li>
<li>Security alerts and audits that contain the IP address of the person causing the alert</li>
</ul>Take a look at <span class="bodytitle"><a href="http://grsecurity.net/features.php">grsecurity features</a> for more details.<br />
</span><br />
<br />
<h2>Downloading linux kernel and grsecurity patch</h2>At the first we need to download grsecurity patch and the right version of Linux kernel source code. In <a href="http://grsecurity.net/download_stable.php">this page</a> you can find the latest stable version of grsecurity patch (At the time of writing this post, it's for linux 2.6.32 stable tree).<br />
<br />
Before we start make sure to install all the necessary packages that you'll need to build the kernel:<br />
<br />
<span style="font-family: "Courier New",Courier,monospace; font-size: x-small;"># yum groupinstall "Development Tools"<br />
# yum install ncurses-devel</span><br />
<br />
<span style="font-family: "Courier New",Courier,monospace; font-size: x-small;"># cd /usr/src/kernels<br />
# wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.32.23.tar.bz2<br />
# wget http://grsecurity.net/stable/grsecurity-2.2.0-2.6.32.23-201009271837.patch</span><br />
<br />
<br />
<h2>Patching the kernel</h2>After downloading linux kernel source code and grsecurity patch we are going to unpack and patch the kernel.<br />
<br />
<span style="font-family: "Courier New",Courier,monospace; font-size: x-small;"># tar xjf linux-2.6.32.23.tar.bz2<br />
# patch -p0 < grsecurity-2.2.0-2.6.32.23-201009271837.patch<br />
# mv linux-2.6.32.23 linux-2.6.32.23-grsec</span><br />
<br />
<br />
<h2>grsecurity configuration</h2>Now we need to configure the new kernel. The easiest way is to use your current kernel configuration file and then modify it.<br />
<br />
<span style="font-family: "Courier New",Courier,monospace; font-size: x-small;"># cd linux-2.6.32.23-grsec<br />
# cp /boot/config-`uname -r` .config<br />
# make menuconfig</span><br />
<br />
You can find grsecurity options under <b>Security options</b> ยป <b>Grsecurity</b> menu. Select the security level and any other options you want. I suggest you checkout <a href="http://grsecurity.net/confighelp.php">this page</a> to find more details about grsecurity options.<br />
<br />
<br />
<h2>Building and installing grsecurity kernel</h2>All you need to do now is compiling the kernel and install it on your system.<br />
<br />
<span style="font-family: "Courier New",Courier,monospace; font-size: x-small;"># make bzImage && make modules<br />
# make modules_install && make install</span><br />
<br />
<b>Note:</b> If you get message like this "<i style="color: #444444;">2.6 PaX kernels no longer build correctly with old versions of binutils. Please upgrade your binutils to 2.18 or newer.</i>" then you have to upgrade binutils by installing it manually from the source.<br />
<br />
<span style="font-family: "Courier New",Courier,monospace; font-size: x-small;"># cd /usr/src<br />
# wget http://ftp.gnu.org/gnu/binutils/binutils-2.20.1.tar.bz2<br />
# tar xjf binutils-2.20.1.tar.bz2<br />
# cd binutils-2.20.1<br />
# ./configure && make && make install</span> <br />
<br />
After that go back to the kernel directory and compile it. When it finish reboot your server into <b>linux-2.6.32.23-grsec</b>.<br />
<br />
<br />
Cheers!Unknownnoreply@blogger.com6tag:blogger.com,1999:blog-4736513511246556230.post-53612975051344352542010-09-15T03:23:00.001+01:002010-09-18T00:25:37.263+01:00Here we go!This is the official blog of SecurityTargets. A startup security specialized company we intend to lunch soon.<br />
<br />
<br />
Here we'll share ideas about what we do and how we do it!Unknownnoreply@blogger.com8