Ideas for improving exozyme security #175

New issue

Closed

opened 2022-08-05 20:28:40 +00:00 by a · 0 comments

a commented

2022-08-05 20:28:40 +00:00

Owner

This is a huge list of ideas that @ersei and I came up with in #general:exozy.me for improving the server's security.

AppArmor
Give services CAP_NET_ADMIN and have them listen below port 1024 to prevent port hijacking like in #172
Uninstall cronie so boot-time cron jobs can't hijack ports
Isolate services using systemd sandboxing
Chroot/container isolation?
Per-user limits on number of processes, CPU, memory usage, similar to #38
Configure systemd-oomd to not kill important processes
Getting rid of the passwords still hashed with salted SHA1
#181

If you have any other ideas feel free to reply!

This is a huge list of ideas that @ersei and I came up with in #general:exozy.me for improving the server's security. - [ ] AppArmor - [ ] Give services CAP_NET_ADMIN and have them listen below port 1024 to prevent port hijacking like in #172 - [x] Uninstall cronie so boot-time cron jobs can't hijack ports - [ ] Isolate services using systemd sandboxing - [ ] Chroot/container isolation? - [ ] Per-user limits on number of processes, CPU, memory usage, similar to #38 - [ ] Configure systemd-oomd to not kill important processes - [ ] Getting rid of the passwords still hashed with salted SHA1 - [x] #181 If you have any other ideas feel free to reply!