Core OS Index

2.2. Hardening

Kernel in ports have upstream linux kernel and grsecurity patch, it should break building some packages, install follow tools;

        $ sudo prt-get depinst gradm paxtest paxctld checksec lynis

Information about grsecurity kernel configuration, pax and gradm.

Lynis gives a view of system overall configuration, without changing default profile it runs irrelevant tests. Create a lynis profile by coping default one and run lynis;

        $ sudo cp /etc/lynis/default.prf /etc/lynis/custom.prf
        $ sudo lynis configure settings color=yes
        $ sudo lynis show settings
        $ sudo lynis show profile

        $ lynis audit system > lynis_report
        $ mv /tmp/lynis.log .
        $ mv /tmp/lynis-report.dat .

Add unnecessary tests to profile to have less noise.

Core OS Index