Sitwon/Byzantium — Issue #3: Security audit of Porteus Linux.
Author: virtadpt
Created: 2011-10-14 12:15:05+00:00
State: open

Before Byzantium Linux goes beta, we need at least one person to stomp through the file system and do due dilligence insofar as the security posture of the default install is concerned. Where possible, things need to run with the least privilege they can get away with. The contents of /sbin and /usr/sbin should probably be set o-rwx. Everything with a set[gu]id bit that the unprivileged user doesn't normally run should be set mode 0750. In short, somebody has to go through the usual list of best practices lists and apply them to a running instance.

It would probably be a good idea to write a shell or Perl script to do the hardening for us, if only to speed up the process and make it less likely that something will be forgotten. We'll have to integrate this into the package build process as well because it's more than just the base OS that should be audited.