Command Center

cd /usr/src

wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.gz

tar zxvf linux-2.6.27.10.tar.gz

ln -s linux-2.6.27.10 linux

wget http://grsecurity.net/grsecurity-2.1.12-2.6.27.10-200812271347.patch.gz

gzip -d grsecurity-2.1.12-2.6.27.10-200812271347.patch.gz

patch -p0 < grsecurity-2.1.12-2.6.27.10-200812271347.patch

cd /boot

ls

config-2.6.18-x

cp config-2.6.18-x /usr/src/linux/.config

cd /usr/src/linux

make menuconfig

arrow down to "Security options" and press enter
Press enter on "Grsecurity"
Now in the new window press spacebar on "Grsecurity"
arrow down to "Security Level (Custom)" and press enter
Then arrow to "Medium" and press the spacebar
Then use the "" until it asks you do you want to save and click yes

make bzImage; make modules; make modules_install; make install

cat /boot/grub/menu.1st

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00
#          initrd /initrd-version.img
#boot=/dev/sda
default=1
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.27.10-grsec)
       root (hd0,0)
       kernel /vmlinuz-2.6.27.10 ro root=/dev/VolGroup00/LogVol00
       initrd /initrd-2.6.27.10.img
title CentOS (2.6.18-92.el5)
       root (hd0,0)
       kernel /vmlinuz-2.6.18-92.el5 ro root=/dev/VolGroup00/LogVol00
       initrd /initrd-2.6.18-92.el5.img 

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00
#          initrd /initrd-version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.27.10-grsec)
       root (hd0,0)
       kernel /vmlinuz-2.6.27.10 ro root=/dev/VolGroup00/LogVol00
       initrd /initrd-2.6.27.10.img
title CentOS (2.6.18-92.el5)
       root (hd0,0)
       kernel /vmlinuz-2.6.18-92.el5 ro root=/dev/VolGroup00/LogVol00
       initrd /initrd-2.6.18-92.el5.img 

Linux kernel is the central component of Linux operating systems. It is responsible for managing the system's resources, the communication between hardware and software and security. Kernel play a critical role in supporting security at higher levels. Unfortunately, stock kernel is not secured out of box. There are some important Linux kernel patches to secure your box. They differ significantly in how they are administered and how they integrate into the system. They also allow for easy control of access between processes and objects, processes and other processes, and objects and other objects. The following pros and cons list is based upon my personal experience.

SELinux

Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies for Linux kernel. It is included with CentOS / RHEL / Fedora Linux, Debian / Ubuntu, Suse, Slackware and many other distributions.

SELinux features

1. Clean separation of policy from enforcement
2. Well-defined policy interfaces
3. Support for applications querying the policy and enforcing access control
4. Independent of specific policies and policy languages
5. Independent of specific security label formats and contents
6. Individual labels and controls for kernel objects and services
7. Caching of access decisions for efficiency
8. Support for policy changes
9. Separate measures for protecting system integrity (domain-type) and data confidentiality (multilevel security)
10. Very flexible policy
11. Controls over process initialization and inheritance and program execution
12. Controls over file systems, directories, files, and open file descriptors
13. Controls over sockets, messages, and network interfaces
14. Controls over use of "capabilities"

Pros and Cons

• Admin skill set (learning curve) - High
• Complex and powerful access control mechanism - Yes
• Detailed configuration required - Yes
• GUI tools to write / modify rules set - Yes
• CLI tools to write / modify rules set - Yes (see list of commands here)
• Ease of use - No (often described as horrible to use)
• Binary package - Available for most Linux distributions
• System performance impact: None
• Security Framework: Mandatory access controls using Flask
• Auditing and logging supported - Yes
• Typical user base - Enterprise users
• Documentation - Well documented

=> Official project website : nsa.gov

AppArmor

AppArmor (Application Armor) is another security software for Linux which maintained and released by Novell under GPL. AppArmor was created as an alternative to SELinux. AppArmor works with file paths. According to official Novell FAQ:

AppArmor is the most effective and easy-to-use Linux application security system available on the market today. AppArmor is a security framework that proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good program behavior and preventing even unknown software flaws from being exploited. AppArmor security profiles completely define what system resources individual programs can access, and with what privileges. A number of default policies are included with AppArmor, and using a combination of advanced static analysis and learning-based tools, AppArmor policies for even very complex applications can be deployed successfully in a matter of hours.

AppArmor is default in OpenSUSE and Suse Enterprise Linux. It was first successfully packaged for Ubuntu Linux.

Features

1. Full integration.
2. Easy deployment.
3. AppArmor includes a full suite of console and YaST-based tools to help you develop, deploy and maintain application security policies.
4. Protects the operating system, custom and third-party applications from both external and internal threats by enforcing appropriate application behavior.
5. Reporting and alerting. Built-in features allow you to schedule detailed event reports and configure alerts based on user-defined events.
6. Sub-process confinement. AppArmor allows you to define security policies for individual Perl and PHP scripts for tighter Web-server security.

Pros and Cons

• Admin skill set (learning curve) - Medium
• Complex and powerful access control mechanism - Yes.
• Detailed configuration required - Yes.
• GUI tools to write / modify rules set - Yes (yast2 and wizards).
• CLI tools to write / modify rules set - Yes.
• Ease of use - Yes (often described as less complex and easier for the average user to learn than SELinux).
• Binary package - Available for Ubuntu / Suse / Opensuse and distros.
• System performance impact - None.
• Security Framework - Mandatory access controls.
• Auditing and logging supported - Yes.
• Typical user base - Enterprise users.
• Documentation - Documented (mostly available from Opensuse and Suse enterprise Linux).

=> Official project website : novell.com

grsecurity

grsecurity is a set of patches for the Linux kernel with an emphasis on enhancing security. It utilizes a multi-layered detection, prevention, and containment model. It is licensed under the GPL.

Features

1. An intelligent and robust Role-Based Access Control (RBAC) system that can generate least privilege policies for your entire system with no configuration
2. Change root (chroot) hardening
3. /tmp race prevention
4. Extensive auditing
5. Prevention of arbitrary code execution, regardless of the technique used (stack smashing, heap corruption, etc)
6. Prevention of arbitrary code execution in the kernel
7. Randomization of the stack, library, and heap bases
8. Kernel stack base randomization
9. Protection against exploitable null-pointer dereference bugs in the kernel
10. Reduction of the risk of sensitive information being leaked by arbitrary-read kernel bugs
11. A restriction that allows a user to only view his/her processes
12. Security alerts and audits that contain the IP address of the person causing the alert

Pros and Cons

• Admin skill set (learning curve) - Low.
• Complex and powerful access control mechanism - No (it is simpler to administer than other two implementations. Also, policies are simpler to create, since there are no roles or complicated domain/file transitions).
• Detailed configuration required - No (works in learning mode).
• GUI tools to write / modify rules set - No.
• CLI tools to write / modify rules set - Yes (gradm tool).
• Ease of use - Yes.
• Binary package - Available for Ubuntu / RHEL / CentOS / Debian distros.
• System performance impact - None.
• Security Framework - Mandatory access controls (precisely, it is a RBAC implementation) using access control lists.
• Auditing and logging supported - Yes.
• Typical user base - Webserver and hosting companies.
• Documentation - unfortunately, is not well documented.

=> Official project website : grsecurity.net

Conclusion:

All three offers very good protection and I can select them based upon the following simple criteria:

• New user / ease of use : Grsecurity
• Easy to understand policy and tools : AppArmor
• Most powerful access control mechanism : SELinux

My personal choice is grsecurity as it is easier to use and offers many other security features. I've used SELinux as it is default choice under RHEL. AppArmor was only tested in lab under OpenSuse. I suggest you download and install all 3 patches (also available via binary deb and rpm files) and compare them as per your setup to gain a deeper understanding of their differences.

Resources:

• AppArmor and SELinux Comparison
• SELinux and grsecurity: A Case Study Comparing Linux Security Kernel Enhancements
• SELinux and grsecurity: A Side-by-Side Comparison of Mandatory Access Control and Access Control List Implementations
• Hardening Linux - identifies many of the risks of running Linux hosts and applications and provides practical examples and methods to minimize those risks.
• SELinux by Example: Using Security Enhanced Linux - a very good book about security enhanced Linux with tons of examples.
• SELinux: NSA's Open Source Security Enhanced Linux - another good book explaining security enhanced Linux along with tons of examples for new and seasoned admins.
• Linux Firewalls: Attack Detection and Response with iptables, psad, and fwsnort.
• Tutorial - A step-by-step guide to building a new SELinux policy module.
• Tutorial - AppArmor for Geeks
• Tutorial - AppArmor for Ubuntu Linux servers
• http://www.cyberciti.biz/tips/selinux-vs-apparmor-vs-grsecurity.html
  

How to configure grsec on a Cpanel box

First lets start by moving into the correct directory

cd /usr/src

Now let's download the kernel from kernel.org

wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.27.10.tar.gz

Let's open the tar file now

tar zxvf linux-2.6.27.10.tar.gz

We need to also create a symlink

ln -s linux-2.6.27.10 linux

Let's grab the grsec patch

wget http://grsecurity.net/grsecurity-2.1.12-2.6.27.10-200812271347.patch.gz

Let's open the grsec patch

gzip -d grsecurity-2.1.12-2.6.27.10-200812271347.patch.gz

Let's apply the patch now

patch -p0 < grsecurity-2.1.12-2.6.27.10-200812271347.patch

We will need to move a current config into the new config directory

cd /boot

Let's look at the contents

ls

Now the current config should look something like this

config-2.6.18-x

Let's move it to the new kernel location and rename it to .conf (Don't forget to change the "x" to the correct name)

cp config-2.6.18-x /usr/src/linux/.config

Now we need to move back to our new kernel directory

cd /usr/src/linux

Let's go ahead and start configuring it

make menuconfig

Note: If you get an error saying "Please upgrade your binutils to 2.18 or newer" please go to this link

Now for cpanel to continue working without errors lets use these settings

arrow down to "Security options" and press enter
Press enter on "Grsecurity"
Now in the new window press spacebar on "Grsecurity"
arrow down to "Security Level (Custom)" and press enter
Then arrow to "Medium" and press the spacebar
Then use the "" until it asks you do you want to save and click yes

Once the kernel is saved we need to start compiling it

make bzImage; make modules; make modules_install; make install

Note: If you get an error saying "Please upgrade your binutils to 2.18 or newer" please go to this link

Now it should be added to /boot/grub/menu.lst you can check by doing the following

cat /boot/grub/menu.1st

It should look something like this

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00
#          initrd /initrd-version.img
#boot=/dev/sda
default=1
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.27.10-grsec)
      root (hd0,0)
      kernel /vmlinuz-2.6.27.10 ro root=/dev/VolGroup00/LogVol00
      initrd /initrd-2.6.27.10.img
title CentOS (2.6.18-92.el5)
      root (hd0,0)
      kernel /vmlinuz-2.6.18-92.el5 ro root=/dev/VolGroup00/LogVol00
      initrd /initrd-2.6.18-92.el5.img

Please note that the locations of the kernel and initrd might not be the same as ours. This is just giving you and idea of how the kernel will be added above the current one.

Now you will want to change it to look like this one. ( We change the default=1 to default=0 which is the new kernel)

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00
#          initrd /initrd-version.img
#boot=/dev/sda
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.27.10-grsec)
      root (hd0,0)
      kernel /vmlinuz-2.6.27.10 ro root=/dev/VolGroup00/LogVol00
      initrd /initrd-2.6.27.10.img
title CentOS (2.6.18-92.el5)
      root (hd0,0)
      kernel /vmlinuz-2.6.18-92.el5 ro root=/dev/VolGroup00/LogVol00
      initrd /initrd-2.6.18-92.el5.img

Now reboot the machine and it should come up with the new kernel!

REFERENCES
http://www.dufault.info/blog/installing-a-grsec-patched-kernel-on-a-centos-5-or-rhel-5-server/