This page on server hardening has a large section on adding a SWAP partition.
Why is adding a SWAP partition good for server hardening?
1
-
3IMO, that page sucks. It doesn't explain how anything helps.– Neil SmithlineFeb 18, 2016 at 18:51
Add a comment
|
2 Answers
It improves the availability of the system, which is also an important part of information security.
E.g. if there's a DoS attack on a memory intensive service, the box is less likely/takes longer to crash.
-
2FTR: This is increasing Availability at the potential risk of Confidentiality. e.g.: If the system shuts down before the swap partition gets wiped, there could be remnants of data in that partition that were never meant to be stored in the clear on a long-term storage device.– IsziFeb 18, 2016 at 19:40
-
I agree with billc that the intention is to improve availability, however when most systems start swapping, performance drops so dramatically that you are facilitating a DOS for your users.
It is a good idea to be able to hibernate a system for fast recovery after a power outage (if you don't have enough UPS) which does require swap.
I'm struggling to imagine how the confidentiality issue described by Iszi would come about in practice.
-
Couldn't swap actually be used to leak sensitive memory as it's persisted to disk while RAM doesn't persist?– ZtyxApr 19, 2016 at 6:28
-
How does someone get access to the data in swap without access to the rest of the storage?– symcbeanApr 19, 2016 at 6:55
-
They don't. But sensitive information might be leaked more easily on intrusion.– ZtyxApr 19, 2016 at 7:01
-
@symcbean Having swap does not necessarily lead to losing performance due to disk access. The OS will most likely swap other less used pages to disk leaving more memory for the application under attack.– billc.cnApr 19, 2016 at 8:55
-
@billc: in theory yes, in practice no. Multi-tenancy systems with large idle applications are very rare beasts these days.– symcbeanApr 19, 2016 at 9:06