This blog article concerns linux encrypting security with public/private key (gpg, RSA, ...) mechanism and X509 certificates hierarchical security.
Levels of linux security
UEFI Secure boot
Encrypted filesystem
Full Disk Encryption on Linux with LUKS
https://www.linux.com/training-tutorials/how-encrypt-linux-file-system-dm-crypt/
Signing containers, kernel images, packages,repositories
https://www.qcecuring.com/blog/code-signing-linux-guide
filesystem mounting options: fstab
security options: readonly nonexecutable nosuid nosgid
ro=recursive,noexec=recursive,nosuid
mount -o remount=noexec=recursive,nosuid /mnt/{mountpoint}
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; See fstab(5).
#
# <file system> <mount point> <type> <options> <dump> <pass>
# / was on /dev/sda4 during installation
UUID=07ceda95-80a7-486c-930b-e9facdf1c073 / ext4 errors=remount-ro 0 1
# /boot was on /dev/sda2 during installation
UUID=58570ac7-0698-4755-81b7-cc6d59e09f60 /boot ext4 defaults 0 2
# /boot/efi was on /dev/sda1 during installation
UUID=8B4E-B934 /boot/efi vfat umask=0077 0 1
/dev/mapper/sda3_crypt /home ext4 discard,commit=30,noexec=recursive,nosuid,errors=remount-ro 0 2
snapcraft.io
using verifiable and updateable readonly snapshots,
instead of installing packages / binaries under /usr
mounting snapshots loopback squashfs (ro,nodev,relatime,errors=continue,threads=single)
Signed executables under linux (unix)
https://stackoverflow.com/questions/1732927/signed-executables-under-linux
Since Solaris 10 & 11 OS perspective all binaries were signed:
https://sourceforge.net/projects/signelf/
Linux kernel sign-file.c
https://github.com/torvalds/linux/scripts/sign-file.c
Signed interpreter scripts under linux
TODO ;(
Verify signed executables at kernel level
TODO ;(
Verify / Validate instruction at hardware level
fetch, add, load, move, jump
TODO ;(
Keine Kommentare:
Kommentar veröffentlichen