Linux – Why do we need SELinux

linuxSecurityselinux

I could not get much idea where the SELinux has been used and what it saves from attacker.
I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the Linux system which provides the SSH shell, Apache front end, role based web application, MySQL DB, memcached, almost all the systems are password protected, then why do we need SELinux?

Best Answer

You may view SELinux as a system-call firewall: A policy for each application specifies what's reasonable for the application to do: The name server may listen on port 53, work with some zone files in a particular directory, send out syslog, ..., but it makes no sense for it to try to work with files in /home, for example. SELinux' enforcement of such a policy means that it will be much harder for a weakness in the name server to spread to other parts of the system.

I find that SELinux provides real security value. But while it has certainly become easier to work with over the years, it is - unfortunately - still a rather complex system. The good thing is that you may easily turn it off for some services, without having to turn it off for the whole system. Too many (junior?) sysadmins turn of SELinux across the board, as soon as they run into the slightest problem with one service - instead of selectively turning it off for the service causing trouble.

Related Solutions

Ssh port forwarding / security risk

I think this is a pretty secure setup, I use it myself. You will need to add '-L' to your command:

ssh -N -L 8888:targethost:80

As long as you don't use the '-g' option, only your client machine can access the port forward.

What I would recommend also is to make sshd on the bastion host listen on a non-standard port. If you are listening on a standard port, the attack traffic sometimes can eat up considerable amounts of CPU.

Also choose a good passphrase for your ssh key, and enter it only on trusted machines. Preferably Linux, it is less trivial to install keyloggers on Linux.

Linux (Ubuntu) environment variables, shells and security

Using a configuration file, and adding the variables through the application's startup script is really the correct way to handle this. If you need to provide certain environment variables to non-shell scripts or binaries (like perl, python, or java), you can call them with a shell wrapper, provide the needed variables, and then exec the real script.

If your applications are started by some sort of script, it must be started by calling a shell (the shebang at the top of the file), even if the user has no login shell. You could therefor modify the environment variables through the shell's rc files just as you would for regular users. I believe you would still need to insert the BASH_ENV variable to get the rc files to trigger, since you're calling the script non-interactively.

I'm going to highly recommend that you use the former method, and create some sort of configuration for the applications. It will be much easier to manage in the long run.

Best Answer

Related Solutions

Ssh port forwarding / security risk

Linux (Ubuntu) environment variables, shells and security

Related Topic