As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).

Did the situation improve with Debian Squeeze or the upcoming Debian Buster ?

By comparison, Ubuntu and Fedora have a nice security features matrix, but I couldnt find a clear answer for Debian.


1 Answer 1


you can check if a binary is compiled with

  1. PIE
  2. stack protection
  3. fortify source
  4. RO relocations
  5. Immediate binding

by using hardening-check. E.g. hardening-check $(which sshd) Package devscripts contains the hardening-check

On Debian testing i get the following output:

root@root:~# hardening-check $(which sshd)
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected funcions found)
Read-only relocations: yes
Immediate binding: yes

See the following answer on stackexchange

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .