Cybersecurity

Hey Folks,

What are the ways we can provide security to kernels.

How can I make my Kernel Unique and not allow anyone to replace my Unique kernel with a standard one.

How can i implement measures to avoid any user to replace or modify GRUB and Kernel...?

Need help on this
Thank you

Your best option, would be to compile your own kernel.

Failing the know how to that, i would pay someone to do it for you.

yup recompile the kernel, and if you can/know how/or learn , disable ALL what is not necessary ... for example -- really just an example--- if you wont use iptables, disable ip filtering ... same with hardware drivers etc ... no RAID card, disable raid drivers ...

replace a kernel and/or grub cannot be done by a non root user .

If you mean phisically ... like when stiking the drive on another machine ...
you can have kenel/boot loader on a ReadOnly media :

usb card/stick , dvd/ cdrom / even a floppy ... (that you make readOnly )

plus you can install tripwire so you get alerted whenever some tryes to

and for a mega paranoids : do not even enable module loading because actually root-kits are modules or some rootkits are if i remember ,
so IF you can , because some drivers cant be inside the kernel , compile all the necessary drivers statically in the kernel .

as a bonus, you kernel will be faster

but dont forget , if u need some option / or driver, you will have to compile a whole new kernel that will include your new things .

so its long to prepare , but fast and secure to use (relatively)

another funny one, if u need your .config, print it and put it in a safe,
and disable it in the kernel too, otherwise it will be readable thru /proc/something i think ,
and if you are courageous, change the version number manually
so ; there will be no information about your kernel version, and how it was compiled.
From there ... there is therotically now way to break into your kernel .

I try not to compile all the drivers into the kernel depending on the amount of drivers it could end up making the kernel slower.

Not to mention if you have any proprietary drivers that have to be loaded as modules.

One thing you can look at is LIDS (Google it).

However i haven't used it since back with the 2.2.* kernel and don't know how much the project has progressed.

In point form:

* Recompile kernel with everything you will need.
* separate boot partition on read-only media.
* encrypt and mount root read only.

Nice, thanks for the great information guys.

Thanks for your great information.

you should check out security related kernel tunable parameters. also focus on protecting the system. a monolithic kernel won't help much if someone roots your server.