Hot answers tagged

58

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /etc/modprobe.d/10-usbstorage-blacklist.conf If your users have physical access to the machine, and knows the encryption keys, the game is up no matter what ...


42

These security systems provide tools to isolate applications from each other... and in turn isolate an attacker from the rest of the system when an application is compromised. SELinux rule sets are incredibly complex but with this complexity you have more control over how processes are isolated. Generating these policies can be automated. A strike ...


24

Expecting backdoors is a bit strong... There are several strong arguments against the plausibility of such backdoors: Linux is used by a lot of people, including US corporations. A big part of the mandate of modern security agencies is to protect the interests of their country. In particular, the NSA shall, as much as possible, protect US corporations ...


24

the insanitybit link is to my website. I'd just like to justify my opinion on here :) If you look at SELinux and Apparmor, they are both strong and weak in the same ways. SELinux is "stronger" in that it can get even more finely grained access to files, but what does that gain an attacker over being in an apparmor profile? You're already significantly ...


21

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a client-server architecture basis with information being stored in a database (such as MySQL or PostgreSQL) on a remote server in a secure location. Then, provide ...


20

In addition to blocking USB (see other answers above): Disable networking, because... ... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine. ... otherwise logged in users will be able to transfer file via net from your machine to some other machine via scp, ftp, samba, http.


13

OK, I'm totally not a security expert and maybe this is completely off the mark (let me know in the comments!), but... If you can secure the box physically (otherwise all bets are off), then maybe you can let the user log on only with user A. All the sensitive files however would belong to user B and inaccessible to user A. EXCEPT for one program "PDF ...


12

Disclaimer: I'm far from expert on SELinux or AppArmor, so you'll need to check everything I say for yourself. I think there's a way to make SELinux and IPTables work together. SELinux can label packets with a tag that indicates the SELinux context/origin/provenance that applies to the packet. You can then write IPTables rules that inspect this tag to ...


10

VNC Your files could be stored on a computer in a secure location. Setup a VNC server on it and disable file transfer capability. Per this question on ServerFault it can be done in TightVNC. Ensure no other ports are open on the computer that stores your files. Provide a VNC client station and lock it down by: disabling I/O ports in the OS and on the ...


7

The upside -- yes, you can do this with SELinux. The downside -- you have to know SELinux. :) You can execute these processes in different SELinux domains. E.g. let's call two processes "privapp" and "unprivapp" -- privapp is able to access /var/lib/app/log and unprivapp cannot access /var/lib/app/log, despite running as the same user. So, you create two ...


7

However I don't see the use of SELinux being promoted as much as I expected. Why is this the case...? SELinux is a security mechanism which, unless properly configured and tuned, is going to be either ineffective or inappropriately block functionality. Think of it like a sharp kitchen knife; indispensable in the hands of a skilled chef, but either ...


6

AppArmor is more secure through its simplicity which makes it easier to review and validate policies. Mistakes are less likely to make, easier to spot, and a backdoor attempt is harder to disguise.


6

You need to adjust your sshd logging level to DEBUG in order to see scp client connections. Look at the /etc/ssh/sshd_config for the "LogLevel" directive. LogLevel DEBUG Or the scp -o LogLevel for testing.


6

Should you use SELinux or an antivirus? Yes. SELinux and an antivirus perform complementary tasks, so using both is better than using one or the other. An antivirus is a tool to find known threats. It can look at a file and say "this is a virus", but it can't look at it and say "this is not a virus" -- the file might contain a previously unknown threat. ...


5

If you're looking for signed binaries you may find elfsign and elfverify to be of interest to you. This doesn't provide a tie in for the linker. It's a manually process that writes the signature into the ELF header. Additionally, I would suggest checking out the kernel's IMA appraisal extension. See also, 2013 Signing ELF binaries 2012 IMA appraisal ...


4

Create different sandboxes Linux currently supports six kernel namespace types: IPC namespace Network namespace Mount namespace PID namespace user namespace UTS namespace run different programs in them, including the ones requiring admin privileges (in this case SandboxIE gives them simulated admin). fakeroot can give programs simulated root access, ...


4

SELinux is largely about confining processes to specified resources and not allowing them to access other resources. SELinux knows what Apache is, what files it should be able to access, what ports it should be able to bind to, etc. If someone exploits a vulnerability in your website and trys to read or write to files that aren't part of the webroot, ...


4

I did. You need a plan, and you need to master the tools. You need to be able to compromise where you can and where you have to compromise. You need to work to make it reality. Access control is part of the bigger picture. There is trust involved inevitably. Knowledge about your environment and threats. Trade-offs. Common sense, a healthy dose of paranoia. ...


4

As Enigma says: The first option [httpd_can_network_relay] is used in an reverse proxy scenario in which your httpd is relaying requests to some backend httpd in behalf of the client. As for httpd_can_network_connect, it allows httpd to make network connections, including scripts and modules. Basically the output from audit2why is formatted in a ...


4

Applications should not have access to data of other applications or to user's private data unless user allows them. Isn't this an obvious need? No, this is not obvious. Traditionally software installed on the system was considered trusted, i.e. it was not expected that users just go to the internet and download some possible harmful application. It was ...


3

There are two solutions: Use a tool like SELinux. It's designed specifically for this particular task, but it takes some real understanding to use effectively. You'll need more than just a few pointers, you need to go read and understand the documentation. Use a virtual machine. The "root" program runs in its own VM on your server and can't see anything ...


3

Grsecurity could be an alternative to selinux and apparmor on a linux machine. A comparison of the three tools is given over here.


3

If the root partition is encrypted, then the only way to run its /bin/bash is to decrypt that file. In fact, if the partition is encrypted, the only way to even know whether there is a file called /bin/bash is to decrypt directories on the partition. With a LUKS encrypted device, you can't even know whether there's a filesystem there. So no, it is not ...


3

In general, you cannot say that appArmor is better than SELinux. This is because a lot depends on what it is you are securing and what you are securing against and on the individual skills and preferences of the person/people responsible for maintaining the system. SELinux has greater fine grained control. In some situations, this would make it more ...


3

SELinux is surely a more complete and ambitious security tool than AppArmor. SELinux is a wide universe, it permeates everything, it potentially labels every object in the system and conceptually elevates the system to a more sophisticated security infrastructure, it allows you to implement all main security paradigms in access control theory; even military ...


3

Do sestatus and see what it says for "Mode from config file". If it says "permissive" there, then something else sets enforcing -- either during the boot-up process, or via the kernel command line (look for enforcing=1 in /etc/grub.conf).


3

cgroups and namespaces are about isolation whereas SELinux is a mandatory access control system: fine-grained access over which system calls are allowed, how information is allowed to flow between processes (domains). The android permissions that applications have to subscribe to can be easily enforced through SELinux, as can process isolation and even many ...


3

Found it. The problem is that setroubleshootd does not run permanently in CentOS 7. It is started only when an AVC denial message reaches auditd. This is confusing, since you normally expect a daemon to constantly run in the background. See: SELinux User's and Administrator's Guide: Which Log File is Used


3

SELinux provides a more granular permissions system based on the concept of Mandatory Access Control (MAC) and Role-Based Access Control (RBAC). It's much more flexible and capable than the typical Discretionary Access Controls (POSIX Permissions) and Linux Capabilities, but it really requires a lot of effort to configure and manage correctly. Since you ...


Only top voted, non community-wiki answers of a minimum length are eligible