Hallo SuSE Fan's,
ich habe ein DSL Gateway auf SuSE 9.0 Basis am laufen, ich möchte die SuSEFirewall2 jetzt
aber ein bisschen sicherer machen damit es keinen Streß gibt!
ZitatAlles anzeigen# PLEASE NOTE THE FOLLOWING:
#
# Just by configuring these settings and using the SuSEfirewall2 you are
# not secure per se! There is *not* such a thing you install and hence you
# are safed from all (security) hazards.
#
# To ensure your security, you need also:
#
# * Secure all services you are offering to untrusted networks (internet)
# You can do this by using software which has been designed with
# security in mind (like postfix, apop3d, ssh), setting these up without
# misconfiguration and praying, that they have got really no holes.
# SuSEcompartment can help in most circumstances to reduce the risk.
# * Do not run untrusted software. (philosophical question, can you trust
# SuSE or any other software distributor?)
# * Harden your server(s) with the harden_suse package/script
# * Recompile your kernel with the openwall-linux kernel patch
# (former secure-linux patch, from Solar Designer) www.openwall.com
# * Check the security of your server(s) regulary
# * If you are using this server as a firewall/bastion host to the internet
# for an internal network, try to run proxy services for everything and
# disable routing on this machine.
# * If you run DNS on the firewall: disable untrusted zone transfers and
# either don't allow access to it from the internet or run it split-brained.
#
# Good luck!
#
# Yours,
# SuSE Security Team
Frage: Hat jemand schon mit den harden SuSE Scripts Erfahrungen gemacht
bzw. sogar einen neuen Kernel mit den openwall-linux Kernel Patch am laufen, lohnt sich das wie groß ist der Aufwand dafür?