Choosing the right distro, Locked down from within. Post: 302579695

Sponsored Content

Special Forums Cybersecurity Choosing the right distro, Locked down from within. Post 302579695 by Corona688 on Tuesday 6th of December 2011 11:02:49 AM

12-06-2011

Registered User

Locking down is more an administrator thing than a distribution one. No amount of locking will do any good when they can drop in a CDROM and hit F12 on boot, after all -- that's something you have to think of and prevent. And no distribution will come with a kernel built to match your machine and exclude any device drivers for hardware they don't absolutely need.

Use the old grub-0.97 bootloader for loading. It's much simpler to configure than the new one when you have a static disk layout, and can be locked down pretty thoroughly.

Use a distribution like Gentoo or Slackware where you you get what you install and ONLY what you install, no more, no less.

Build your own kernel. Exclude any and all device drivers for things they shouldn't be using. If you give them a PS/2 keyboard and mouse, you don't even need to enable USB!

Make /tmp/ its own partition, with the 'noexec' flag given in /etc/fstab so nobody will ever be able to run executables in it. Come to think of it, do that for /home/ too.

Make their home directory and profile files read-only and owned by root. That way they can't alter, delete, or replace any config files, and won't be able to download into it. ~/.firefox/ or what have you will have to be writable, though. Make their login shell a restricted shell, /bin/rbash. If they ever get into a shell login somehow they won't be able to do anything useful with it.

Don't give them Java if you can avoid it. You can make an ersatz anything in Java.

Alter /etc/inittab to not spawn terminal logins on VT1-VT6. This will prevent them from doing ctrl-alt-f1 and getting into a raw text console.

Don't install a big WM like Gnome or KDE which will come with thousands of apps and built-in security holes for user convenience. Install something small and predictable like Fluxbox. You get easily-configurable menus and no bundled programs.

And lastly, secure the machine itself. Put in a BIOS password, prevent booting from external media, disable the PXE boot ROM, stick a good padlock in the little loop that prevents people from opening the machine, etc, etc.

Corona688

View Public Profile for Corona688

Visit Corona688's homepage!

Find all posts by Corona688

9 More Discussions You Might Find Interesting

1. Programming

Choosing Java or C++

Listen, if you know a bit of programming in C and need to program unix-type operating systems the next transitive stage is for sure C++. However, have in mind that Java is like learning C but 99% object-oriented(o.o.) and with no pointers or memory-management tricks. It would be good for you to see...

2. UNIX for Dummies Questions & Answers

Choosing a version

I know that the rules say no school questions but I am in advanced topics and am going to go to college for programming and I want to find a easy first OS to start me out, please help, thanks

3. UNIX for Dummies Questions & Answers

I need help choosing a linux.

There are soo many flavors of linux and i just cant choose/find the right linux for me... I am hopeing for a linux that is a Workhorse Can fit of a seires (or 1) disk(s) Lots of features (admin/mod features) A learning mode or a detailed tutorial Can work side by side with windows...

4. Linux

Choosing the best distro.

Hi all Help me find the best distro for the following configurations: Intel pentium IV 1.6 Ghz 128 MB RAM :( 40 GB Hardisk with one very big partition more than 35 gb n another 2 gb partition. windows xp is already installed but has enough free space (26gb). Which linux will be...

5. Slackware

Help for choosing Slackware

Dear Friends, If I use Slackware for learning whether it will make any confusion in administering/using Redhat and SuSE since I have checked slackware is more like BSD. Thank you.

6. Shell Programming and Scripting

choosing executable depending on distro

Hi, I have an application in 2 different directories, one is for OpenSuSE and the other for CentOS. I wrote a script which chooses the right executable for the distribution. But it does not work. ------------------- #!/bin/bash if then ( DN="/home/apps/applicationXY/Version3.1" )...

7. Shell Programming and Scripting

Dynamically choosing the interpreter

Hi, Is it possible to choose the inerpreter conditionally. For example, if whereis bash returns /usr/bin/bash then i need to choose #!/usr/bin/bash else i need to use #!/usr/bin/sh. Is it possible to achieve in a shell script? Thanks

8. Linux

Choosing a UNIX

i have a project in numerical calculus in c language what unix i get better for this?

9. Linux

Help choosing distro

Hi, I just ordered an Skylake NUC and will run Linux on it. My distro of choice has been Ubuntu but I am fed up with the release cycle and would like more of a rolling release. I would say I am an intermediate level Linux user. It's going to be a HTPC, I want to have the latest kernels...

LEARN ABOUT DEBIAN

installgrub

installgrub(1M) 														   installgrub(1M)

NAME

       installgrub - install GRUB in a disk partition or a floppy

SYNOPSIS

       /sbin/installgrub [-fm] stage1 stage2 raw-device

       The installgrub command is an -only program. GRUB stands for GRand Unified Bootloader.

       installgrub  installs  GRUB  stage  1  and  stage  2  files on the boot area of a disk partition. If you specify the -m option, installgrub
       installs the stage 1 file on the master boot sector of the disk.

       The installgrub command accepts the following options:

       -f

	   Suppresses interaction when overwriting the master boot sector.

       -m

	   Installs GRUB stage1 on the master boot sector interactively.

       The installgrub command accepts the following operands:

       stage1

	   The name of the GRUB stage 1 file.

       stage2

	   The name of the GRUB stage 2 file.

       raw-device

	   The name of the device onto which GRUB code is to be installed. It must be a character device that is readable and writable.  For  disk
	   devices,  specify  the  slice  where  the  GRUB  menu  file	is  located.  (For Solaris it is the root slice.) For a floppy disk, it is
	   /dev/rdiskette.

       Example 1: Installing GRUB on a Hard Disk Slice

       The following command installs GRUB on a system where the root slice is c0d0s0:

       example# /sbin/installgrub /boot/grub/stage1 
		/boot/grub/stage2 /dev/rdsk/c0d0s0

       Example 2: Installing GRUB on a Floppy

       The following command installs GRUB on a formatted floppy:

       example# mount -F pcfs /dev/diskette /mnt
       # mkdir -p /mnt/boot/grub
       # cp /boot/grub/* /mnt/boot/grub
       # umount /mnt
       # cd /boot/grub
       # /sbin/installgrub stage1 stage2 /dev/rdiskette

       /boot/grub

	   Directory where GRUB files reside.

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWcsu			   |
       +-----------------------------+-----------------------------+
       |Interface Stability	     |Evolving			   |
       +-----------------------------+-----------------------------+

       boot(1M), fdisk(1M), fmthard(1M), kernel(1M), attributes(5)

       Installing GRUB on the master boot sector (-m option) overrides any boot manager currently installed on the machine. The system will always
       boot the GRUB in the Solaris partition regardless of which fdisk partition is active.

								    24 May 2005 						   installgrub(1M)