Grsecurity: Enhance your Linux server security. [Part 1]
As a member of the cybersecurity community as well as working as a security engineer, I need to deal with many attempted attacks on my servers. Specially, when a server comes with a vulnerable application, I need to fix them one by one. Most of the time, it is difficult to provide a good security solution when the kernel is vulnerable. So, I have no other way to update it with vanilla kernel and sometimes for a few applications, is depends on specific kernel version. Then, the only way that is left for me is patching.
Another scenario came to me, that if a non root user can login to system via SSH and their kernel could be vulnerable to privilege escalation exploits such as buffer overflows. So, I needed to implement Role Based Access Control (RBAC). Then GRSecurity came to rescue.
GRSecurity has a collection of security features for the Linux kernel, including address space protection, enhanced auditing and process control. It also has a component named PaX, which is not actually developed by GRSecurity developers but, provides address space layout randomization (ASLR), which randomizes important memory addresses to reduce the probability of attacks that rely on easily predicted memory addresses.
Long story short : Today, I am writing this article with a quick and dirty approach on GRSecurity patching. I think it will be helpful for beginners.
Well, here is my box information:
OS: Debian 8.6 (jessie) 64bit
CPU: 8 core
$ sudo apt-get update $ sudo apt-get upgrade
$ sudo apt-get install libncurses5-dev build-essential kernel-package git-core gcc-4.9 gcc-4.9-plugin-dev make
$ mkdir grsec $ cd grsec/ $ wget https://grsecurity.net/spender-gpg-key.asc $ gpg --import spender-gpg-key.asc $ gpg --recv-key 6092693E
$ wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.1.tar.xz $ wget https://www.kernel.org/pub/linux/kernel/v3.x/linux-3.18.1.tar.sign $ unxz linux-3.18.1.tar.xz $ gpg --verify linux-3.18.1.tar.sign
if failed, do this step again.
$ wget http://deb.digdeo.fr/grsecurity-archives/kernel-3.18/grsecurity-3.0-3.18.1-201501042021.patch $ wget http://deb.digdeo.fr/grsecurity-archives/kernel-3.18/grsecurity-3.0-3.18.1-201501042021.patch.sig $ gpg --verify grsecurity-3.0-3.18.1-201501042021.patch.sig
$ tar -xf linux-3.18.1.tar $ cd linux-3.18.1/ $ patch -p1 < ../grsecurity-3.0-3.18.1-201501042021.patch
$ cp /boot/config-$(uname -r) .config $ make menuconfig
Navigate to Security options
Navigate to Grsecurity
Press Y to include it
Set Configuration Method to Automatic
Set Usage Type to Server (default)
Set Virtualization Type to None (default)
Set Required Priorities to Security
Select Yes to save
$ make-kpkg clean $ export CONCURRENCY_LEVEL="$(grep -c '^processor' /proc/cpuinfo)" (if this command return 4 then --jobs=4 , if return 1 or 2 then --jobs=1 or --jobs=2) $ sudo make-kpkg --jobs=8 --initrd kernel_image
[it took 2 to 4.5 hour]
$ cd ..
$ sudo dpkg -i *.deb $ sudo update-grub
if you are getting this warning like:
Warning: Setting GRUB_TIMEOUT to a non-zero value when GRUB_HIDDEN_TIMEOUT is set is no longer supported.
$ sudo nano /etc/default/grub
$ sudo update-grub $ sudo reboot
I will continue my writing on grsecurity to advanced implementations.