diff --git a/security/secure-workstation.html b/security/secure-workstation.html index 28827b4..deb8377 100644 --- a/security/secure-workstation.html +++ b/security/secure-workstation.html @@ -16,6 +16,7 @@
-
-
-

Home

-
-

Introduction

For many companies the fear of a security breach can put great stress on those involved. With the recent Facebook breach due to employee laptops being compromised, a plan came to mind on how to create a fairly secure workstation. Having some experience working on Grsecurity backed EC2 images, I began the task of working on such a system.

Distribution

@@ -59,17 +55,23 @@

Kernel

While keeping the system up to date is important, it’s often hard to keep up with complete accuracy. Grsecurity comes in by providing protection against common attack vectors that most exploits utilize. Configuring Grsecurity in the kernel is incredibly easy, and can be achieved by simply using auto configuration and setting to Desktop accordingly:

-
-
-Grsecurity Setup -
-
+
+
[*] GRsecurity
+   Configuration Method ( Automatic ) --->
+   Usage Type (Desktop) --->
+   Virtualization Type (None) --->
+   Required Priorities (Performance ---->
+   Default Special Groups --->
+   Customize Configuration --->
+

Here performance was emphasized as the workstation is often utilized for compile work, and as such becomes an important factor. The file system settings are also important, in this case using ext4. It’s okay to go with another file system instead, but it’s recommend to enable extended attributes:

-
-
-Extended attributes enabled in ext4 -
-
+
+
<*> The Extended 4 (ext4) filesystem
+-*-     Ext4 extended attributes
+[*]          Ext4 POSIX Access Control Lists
+[*]          Ext4 Security Labels
+[ ]          EXT4 debugging support
+

This allows for adjusting PaX headers on binaries like Skype, which don’t deal well with binary tampering.

Notable Software

The List

@@ -210,8 +212,7 @@

Conclusion