Re: Suggestions for linux security patches

[Chris Wright <chris@wirex.com>]

* Jason Czerak (Jason-Czerak@Jasnik.net) wrote:
> So to advoid applying 20 or so differnet patches, and evaluate each of
> them (taking up what little time I have in a day...), I wish to get the
> lists opinions on the matter.

have you looked at linux security modules?  the patches are at
http://lsm.immunix.org.  it pushes security policy into modules so you can
try different modules to see which policy you prefer.

> Local security/control isn't much of an issue and most likly won't be
> for a while. Remote security and protection from server deamons that
> have buffer problems are high priority to get the best protection for. 

note, non-executable stack does not prevent buffer overflow attacks.
the exploit just needs to change.  check out tools like libsafe and
StackGuard as well for buffer overflow protection.

thanks,
-chris