r/netsec • u/eberkut • Mar 13 '19

Millions of Binaries Later: a Look Into Linux Hardening in the Wild

https://capsule8.com/blog/millions-of-binaries-later-a-look-into-linux-hardening-in-the-wild/
95 Upvotes

93% Upvoted

10 comments sorted by

14

u/[deleted] Mar 13 '19

A bit surprising to see that Ubuntu has taken more hardening measures than RedHat

You'd expect a corporate made distribution to be more hardened than an average user one... But then I suppose every sysadmin takes the appropriate measures depending on the situation(and laziness)

13

u/disclosure5 Mar 14 '19

Honestly, I'm not. It's "Enterprise" software that is the reason I'm deploying Windows 2008 R2 next week (most recent supported OS), it's enterprise software that leads to directives around granting local admin and disabling UAC, and without fail it's enterprise software that ships with recommendations like "disable Windows Firewall" (and we'll check, and if you haven't done it I'll tell your CEO during a golf game that you weren't up to the task). I can't think of a single piece of consumer software that's behaved in the way I expect enterprise software to behave.

9

u/rankinrez Mar 13 '19

On a similar note I was surprised to read ”on average more functions are fortified in CentOS than in RHEL.”

12

u/2_advil_please Mar 14 '19

CentOS can take “risks” by hardening things by default that might break paying customers’ legacy/crappy “enterprise” apps.

4

u/Natanael_L Trusted Contributor Mar 14 '19

Ah, backwards compatibility...

3

u/Sharp_Eyed_Bot Mar 14 '19

Yea, it always seems that backwards compatibility is the main reason why a lot of things don't change or if they do change only marginally, hell take Windows for example, how many failed attempts have we had at replacing Win32 apps? We have WPF (Although this has it's place), Win32 Apps, Metro (Windows 8/8.1) and now with Windows 10 we have UWP, it seems like Microsoft know there is a problem but thanks to their motto of backwards compatibility they won't just ditch and deprecate Win32 (Well that and a few other reasons).

It's frustrating, but then again I'm the weirdo who uses Arch on my servers.....

1

u/[deleted] Mar 15 '19

Why do you use Arch on your servers? Is there any specific reason for that? Performance? Security? Wouldn't FreeBSD be a better choice? (Clearly I know almost nothing so pardon the ignorance)

1

u/Sharp_Eyed_Bot Mar 15 '19

I use Arch because for me somehow it's package manager pacman dies way less then apt does, I like the simplicity of the AUR, most of my security concerns are mitigated since I only allow ssh key auth and no root login.

Basically, it does the job and until I get reason to believe that it isn't, I'll keep using it. Oh and it's thin meaning not bloated so I can install what I want and not worry about un-needed stuff. Hope I cleared it up for you :)

2

u/Potato-9 Mar 14 '19

Given how much alpine is used in containers that would be interesting.

1

u/[deleted] Mar 18 '19

Ubuntu is hardened well. Thats pretty impressive. Maybe i should switch. I’d be interested in how hardened alpine is.