|
|
Sponsored Content
Top Forums
UNIX for Advanced & Expert Users
"Signed Linux" - Only executing signed programs
Post 302498987 by disaster on Wednesday 23rd of February 2011 03:20:16 AM
02-23-2011
"Signed Linux" - Only executing signed programs
Hey folks,
not sure whether this or the security board is the right forum. If I failed, please move
So here's the problem:
I need to build a Linux environment in which only "signed" processes are allowed to run. When I say signed I don't mean a VeriSign signature like you know it from Windows, but I mean signed by myself. I.e. I choose the software allowed to run, sign it, and then want to deny any other processes to run.
If it is somehow possible I'd like to extend this even to scripts and the kernel (i.e. no unsigned modules can be loaded).
Does anyone have a good idea how to solve this problem?
The bad thing is: I'm pretty fine with coding stuff myself in C, but have absolutely 0 experience or knowledge in kernel (module)-programming.
Any tipps, links, literature, finished programs will be appreciated, thanks
A short idea I had and almost forgot: How difficult is it to change the routine of linux which starts a process in such a way that it will call for every process start a little programm of myself which will then check the program to be executed and - in case of a missing signature - will cancel it?
not sure whether this or the security board is the right forum. If I failed, please move
So here's the problem:
I need to build a Linux environment in which only "signed" processes are allowed to run. When I say signed I don't mean a VeriSign signature like you know it from Windows, but I mean signed by myself. I.e. I choose the software allowed to run, sign it, and then want to deny any other processes to run.
If it is somehow possible I'd like to extend this even to scripts and the kernel (i.e. no unsigned modules can be loaded).
Does anyone have a good idea how to solve this problem?
The bad thing is: I'm pretty fine with coding stuff myself in C, but have absolutely 0 experience or knowledge in kernel (module)-programming.
Any tipps, links, literature, finished programs will be appreciated, thanks
A short idea I had and almost forgot: How difficult is it to change the routine of linux which starts a process in such a way that it will call for every process start a little programm of myself which will then check the program to be executed and - in case of a missing signature - will cancel it?
|
|
We Also Found This Discussion For You
1. Shell Programming and Scripting
Hi All,
i am trying to ssh to a remote machine and execute certain command to remote machine through script.
i am able to ssh but after its getting hung at the promt and after pressing ctrl +d i am gettin the out put as
expect: spawn id exp5 not open
while executing
"expect "$" {... (3 Replies)
Discussion started by: Siddharth shivh
3 Replies
LEARN ABOUT LINUX
imqkeytool
imqkeytool(1M) System Administration Commands imqkeytool(1M) NAME
imqkeytool - generate a self-signed certificate for secure communication SYNOPSIS
/usr/bin/imqkeytool [-broker] [-servlet keystore_location] /usr/bin/imqkeytool -h DESCRIPTION
The imqkeytool utility generates a self-signed certificate for secure communication. The certificate can be used by a broker instance to establish a secure connection with a client, or by a Message Queue-supplied HTTPS servlet to establish a secure connection with a broker instance. An HTTPS servlet is an SSL-enabled varient of the HyperText Transfer Protocol that establishes a secure connection with a broker instance. Without an option, imqkeytool generates a self-signed certificate for a broker instance. imqkeytool uses command line options to specify whether the certificate is used by a broker instance or by a servlet. OPTIONS
The following options are supported: -broker Generate a self-signed certificate for the broker and places it in the Message Queue keystore. All broker instances running on a system must use the same certificate. -h Display usage help. Do not execute anything else on the command line. -servlet keystore_location Generate a self-signed certificate for an HTTPS servlet and places it in keystore_location. keystore_location refers to the location of the keystore. You should move this keystore to a location where it is accessible and read- able by the Message Queue HTTPS servlet to establish a secure connection with a broker. ENVIRONMENT VARIABLES
The following environment variables affect the execution of this command: IMQ_JAVAHOME Specify the Java 2 compatible runtime. When this environment variable is not set it defaults to /usr/j2se. EXIT STATUS
The following exit values are returned: 0 Successful completion. >0 An error occurred. FILES
/etc/imq/keystore Contains Message Queue keystore in which imqkeytool stores a self-signed certificate for brokers. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWiqu | +-----------------------------+-----------------------------+ SEE ALSO
imqadmin(1M), imqbrokerd(1M), imqcmd(1M), imqdbmgr(1M), imqobjmgr(1M), imqusermgr(1M), attributes(5) Sun Java System Message Queue Administrator's Guide SunOS 5.10 11 Mar 2004 imqkeytool(1M)