On Monday 09 October 2006 17:20, Tim Churches wrote: > etc. Even if hackers get root access, they still can't defeat an SElinux > cage. Downside is that it is a complete pig to set up, and very few > people seem to know much about it, even if you offer to pay for their > expertise.
I found that it is a lot easier to just chroot a web application into a safe sandbox than setting up and configurin fully fledged SElinux - especially if you have a good firewall in front of that box that makes sure nothing but http via port 80 gets through regardless of configuration mistakes on that box Another possibility that I have not explored yet is virtualization - running web services in virtual machines, eg XEN > > Another reason to love RoR - if you use it's "Mongrel" web server, it > > appears rather straightforward and transparent to secure the > > infrastructure that does the web serving bit: for people with only modest > > traffic load (<100 hits/minute) it does the trick without overly hard > > performance penalty > > One does need to be very careful with Apache (or other fully-fledged Web > servers - IIS is even worse) - a minor and seemingly inconspicuous > change to the config file can expose a lot on your system. For example, That's why I like the Mongrel / RoR combo. It's the simplicity of the setup that makes it "securer" by default - not a zillion options to take care of. apache is a powerful workhorse for a server under heavy load with a plethora of web applications - but for the setting of a general practice with only a handful of online services to provide to a very limited number of users and rather modest load expectations, just a few "Mongrels" accessed via a load balancing proxy is very easy to set up without major security pitfalls and almost an overkill already (a single Mongrel process might already do the trick) Horst _______________________________________________ Gpcg_talk mailing list [email protected] http://ozdocit.org/cgi-bin/mailman/listinfo/gpcg_talk
