non-root security
 

Hello!

I am currently hardening the security of my system. Linux has a strong barrier between the core system and userland and is fairly straightforward to configure. Hence, my core system is fairly stable.

However, what options are there for users' security?
It seems to me a simple internet java/activeX script can easily download itself into the ~ directory and then modify the ~/bash_profile init file to run malicious code. A small program bug could also create a exploit like this.

Only the user will be affected, but it may compromise private information or corrupt a user's files.

Thank you,
Murdock

ActiveX doesn't work in Linux. As far as java scripts, the web browsers are support to provide some protection but if you don't believe it is enough you can always disable java/javascript support in your preferences (at least you can on Firefox and Konqueror).

Another thing some people do is mount /home with the no exe flag so that you can't run things from users home directories. Last thing I can think of if your really afraid is removing your write privileges from your .bashrc, .bash_profile or any other script that automatically runs at login....

You should probably also look into using SELinux and a PAX/Grsecurity enabled kernel.

for your web-based script worries, look at the noscript extension:

http://www.noscript.net/

of course this assumes you use firefox to surf the web... :)

the mounting /home noexe tip is great, i'm actually planning to do this for my parents in the near future... probably when linux 2.4.33 is released...

Win32sux,

Thanks for the Firefox tip. Most of Microsoft's security problems come up when surfing the web, so while Linux is more secure, it also is somewhat affected by the same problem. But this will entirely eliminate the issue.

Thanks!
Murdock