Military-grade security for Gentoo Desktop

mbar · Veteran Joined: 19 Jan 2005 Posts: 1991 Location: Poland

Let's talk some science-fiction here

If you were to secure your laptop/desktop computer to the highest possible level (or whatever military-grade may mean) how would you do that? I'm asking because I think I have mastered these:
http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS
http://en.gentoo-wiki.com/wiki/Root_on_LVM_or_EVMS_over_dm-crypt/LUKS
and I have some (unpleasant) experience with hardened, and I'm bored and would like to learn more.

Let's assume we want to protect our computers from Lisbeth Salander

What next? grsecurity? Would a checklist help here?

Letharion · Veteran Joined: 13 Jun 2005 Posts: 1344 Location: Sweden

Given that the US NSA is heavily involved in SELinux (or so I think http://www.nsa.gov/research/selinux/), I'd say that's as close to "military grade" as you are likely to get.

mbar · Veteran Joined: 19 Jan 2005 Posts: 1991 Location: Poland

I wondered if mentioning Lisbeth would attract someone from Sweden... and it happened

Letharion · Veteran Joined: 13 Jun 2005 Posts: 1344 Location: Sweden

I had no idea who she was, I didn't even click the link until now

I've heard of the books and movies of course, but never read or saw them.

mbar · Veteran Joined: 19 Jan 2005 Posts: 1991 Location: Poland

/me starts reading http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml

gerard27 · Posted: Thu Nov 04, 2010 1:03 pm Post subject:

mbar,
Are you seriously considering to make your lappy impenetrable?
I have been using Linux long time (no server).
Went from distro to distro always with the same root passwd.
Never any problem.
Gerard.
_________________
To install Gentoo I use sysrescuecd.Based on Gentoo,has firefox to browse Gentoo docs and mc to browse (and edit) files.
The same disk can be used for 32 and 64 bit installs.
You can follow the Handbook verbatim.
http://www.sysresccd.org/Download

Letharion · Veteran Joined: 13 Jun 2005 Posts: 1344 Location: Sweden

I quote the OP:

tomk · Posted: Thu Nov 04, 2010 1:18 pm Post subject:

Moved from Gentoo Chat to Networking & Security as it fits better here.
_________________
Search | Read | Answer | Report | Strip

mbar · Veteran Joined: 19 Jan 2005 Posts: 1991 Location: Poland

mr.sande · Posted: Thu Nov 04, 2010 11:52 pm Post subject:

I am kind of on the same "quest", trying to learn more about linux security. Figured a good way to learn is to live with it.

Up until now I have
-switched to hardened profile
-enabled pax and grsecurity
-rebuilt system
-started auditing with lsat, lynis, rkhunter and other such tools

Since Im new to hardened gentoo this is a learning journey for me. So I was wondering what your plans for hardening is mbar?

1clue · Advocate Joined: 05 Feb 2006 Posts: 2569

First, let me preface this with "I'm not an expert."

That said, just about every encryption book, paper, web site or primer I've ever read claims that "military grade encryption" is a snake oil warning.

The US Military doesn't publish any information about what sort of encryption they use, therefore proving what grade of encryption they provide vs the grade you're looking at is impossible, and while some reputable groups use the term you really need to do your homework.

Other warnings include "trust us, we know what we're doing" and other attempts to obscure what's going on. Good encryption has little to do with method and everything to do with the key. Another would be the permission to export it from the USA.

It has been some years since I looked into it, but I would strongly recommend that you do a bunch of reading on sites or in books which don't use the term.

Good luck and have fun.

mbar · Veteran Joined: 19 Jan 2005 Posts: 1991 Location: Poland