<?xml version="1.0" encoding="utf-8"?><!DOCTYPE article  PUBLIC '-//OASIS//DTD DocBook XML V4.4//EN'  'http://www.docbook.org/xml/4.4/docbookx.dtd'><article><articleinfo><title>ShellServerSecurityRestrictions</title><revhistory><revision><revnumber>4</revnumber><date>2012-12-09 05:59:35</date><authorinitials>ClintonEbadi</authorinitials><revremark>this is not true for !mire</revremark></revision><revision><revnumber>3</revnumber><date>2008-07-07 04:28:17</date><authorinitials>localhost</authorinitials><revremark>converted to 1.6 markup</revremark></revision><revision><revnumber>2</revnumber><date>2008-01-06 00:20:59</date><authorinitials>netblock-68-183-198-50.dslextreme.com</authorinitials></revision><revision><revnumber>1</revnumber><date>2008-01-06 00:18:59</date><authorinitials>netblock-68-183-198-50.dslextreme.com</authorinitials></revision></revhistory></articleinfo><para>We use grsec on our shell servers, and have enabled the following features.  There is a remote possibility that they may interfere with your applications; so we have documented which features we enable in order to avoid any surprises. </para><screen><![CDATA[CONFIG_GRKERNSEC_IO=y
   - disables ioperm/iopl calls which could modify running kernel
]]><![CDATA[
CONFIG_GRKERNSEC_BRUTE=y
   - prevents rapid respawning of apache and ssh daemons (when someone's
     bruteforcing)
]]><![CDATA[
CONFIG_GRKERNSEC_EXECLOG=y
   - logs all execs
]]><![CDATA[
CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
   - logs execs in chroots
]]><![CDATA[
CONFIG_GRKERNSEC_AUDIT_MOUNT=y
   - logs *un)mounts
]]><![CDATA[
CONFIG_GRKERNSEC_SIGNAL=y
   - logs signals like sigsegv
]]><![CDATA[
CONFIG_GRKERNSEC_FORKFAIL=y
   - logs failed forks
]]><![CDATA[
CONFIG_GRKERNSEC_TIME=y
   - logs time changes
]]><![CDATA[
CONFIG_GRKERNSEC_PROC_IPADDR=y
   - saves each process owner's IP address in /proc/PID/ipaddr
]]><![CDATA[
CONFIG_GRKERNSEC_SHM=y
   - shared memory protections
]]><![CDATA[
CONFIG_GRKERNSEC_TPE=y
   - ability to restrict certain users to only running trusted executables
CONFIG_GRKERNSEC_RANDNET=y
   - larger entropy pool
]]><![CDATA[
CONFIG_GRKERNSEC_SOCKET=y
CONFIG_GRKERNSEC_SOCKET_ALL=y
CONFIG_GRKERNSEC_SOCKET_CLIENT=y
CONFIG_GRKERNSEC_SOCKET_SERVER=y
   - fine-grainer control who gets access to sockets
]]><![CDATA[
CONFIG_GRKERNSEC_SYSCTL=y
   - allow runtime tuning of all options through sysctl]]></screen><!--rule (<hr>) is not applicable to DocBook--><para> <ulink url="https://wiki.hcoop.net/ShellServerSecurityRestrictions/CategoryOutdated#">CategoryOutdated</ulink> </para></article>