HOWTO: Installing Grsecurity patched kernel in debian/ubuntu
Source: http://evolution-security.com
This is based on the same walkthrough I posted for grsecurity on red hat based kernels except this is for debian based kernels. The current stable debian kernel is vulnerable to about all of the new local exploits and if you are running the 2.4 kernel you are vulnerable to even more. Debian even had one of their servers hacked with the local root exploits, they only released a patched kernel for the testing branch to my knowledge.
The PDF version can be found HERE.
Ok so here goes.
If you have not done any compiling or built any kernels you must get the packages needed.
sudo apt-get install build-essential bin86 kernel-package
sudo apt-get install libqt3-headers libqt3-mt-dev (needed for make xconfig)
First get what is needed and patch the kernel.
cd /usr/src
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.17.7.tar.bz2
wget http://grsecurity.org/grsecurity-2.1.9-2.6.17.7-200607261817.patch.gz
tar -xjvf linux-2.6.17.7.tar.bz2
gunzip < grsecurity-2.1.9-2.6.17.7-200607261817.patch.gz | patch -p0
mv linux-2.6.17.7 linux-2.6.17.7-grsec
ln -s linux-2.6.17.7-grsec linux
cd linux
copy your current config over
do uname -r to see what kernel your running and copy it, example:
cp /boot/config-2.6.15-26-686L .config
*Configure the kernel:
sudo make xconfig
if you are doing this on a server use makeconfig
make sure you select the basic stuff that is needed, iptables, your processor type, and then go in Security Options and to grsecurity, select which level of security you want and any other options you may want.
*In a terminal make sure you are in /usr/src/linux with full root access.
We will build a ".deb" file that can be installed in our Ubuntu system, using make-kpkg.
*In a terminal type:
make-kpkg clean
make-kpkg -initrd --revision=ck2 kernel_image
If there wasn't errors this will build the kernel and a ".deb" file will be created at /usr/src.
*To install it:
sudo dpkg -i kernel-image-2.6.17*.deb
Now reboot and if you did everything correctly it should boot back up and you will be using the new grsecurity kernel.
- felosi's blog
- Login or register to post comments
- Printer-friendly version
- 53270 reads
- PDF version
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
digiKam 7.7.0 is releasedAfter three months of active maintenance and another bug triage, the digiKam team is proud to present version 7.7.0 of its open source digital photo manager. See below the list of most important features coming with this release. |
Dilution and Misuse of the "Linux" Brand
|
Samsung, Red Hat to Work on Linux Drivers for Future TechThe metaverse is expected to uproot system design as we know it, and Samsung is one of many hardware vendors re-imagining data center infrastructure in preparation for a parallel 3D world. Samsung is working on new memory technologies that provide faster bandwidth inside hardware for data to travel between CPUs, storage and other computing resources. The company also announced it was partnering with Red Hat to ensure these technologies have Linux compatibility. |
today's howtos
|
hmm, sorry about the bbcode
hmm, sorry about the bbcode errors, you should still know what to copy
re: bbcode
I fixed it best I could using html.
----
You talk the talk, but do you waddle the waddle?
Note
for who ever does this walkthrough, I copied the deb package making off my ck tutorial and left that in one place
make-kpkg -initrd --revision=ck2 kernel_image
when you do that you can make it whatever you want, even that would work just remember that kernel is grsecurity.
Also on the installing on server, use make menuconfig to make your config
I was too worried about the bbcode and made a few typos, couldnt find a way to edit.