Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)?

Ubuntu has a handy summary table showing the main security features of each Server edition release, but I haven't found something similar for Debian. Ubuntu mentions:

  • Stack Protector (gcc's -fstack-protector)
  • Heap Protector (GNU C Library heap protector)
  • Pointer Obfuscation (Some pointers stored in glibc are obfuscated)
  • Address Space Layout Randomisation (ASLR) (Stack ASLR; Libs/mmap ASLR; Exec ASLR; brk ASLR; VDSO ASLR)
  • Several daemons built as Position Independent Executables (PIE)
  • Some daemons (?) built with Fortify Source "-D_FORTIFY_SOURCE=2"

To which extent does Debian 6.0 use similar techniques (by default)?

share|improve this question
add comment

2 Answers 2

up vote 5 down vote accepted

Unfortunately most (all?) of these defenses are not enabled on Debian. They have talked about it for years and there was some "hardened debian" project, but it has not lead to anything concrete so far from user's perspective. It is one of the rare distros which have not implemented these measures yet.

There is some more information at http://wiki.debian.org/Hardening:

After their meeting on the 14-16 January 2011, the debian security team announced in an email they intend to push the inclusion of hardening features for the wheezy release. A Birds of a Feather-session will be organized during the 2011 debconf to setup a process.

The referenced email is here: http://lists.debian.org/debian-devel-announce/2011/01/msg00006.html.

So maybe it is finally coming in "wheezy"...

This is the biggest single reason why I personally prefer running Ubuntu over Debian on my servers.

share|improve this answer
    
Debian makes it very easy to compile a new kernel based on their releases. You can always just enable the options you want on your kernel. –  bahamat Aug 3 '11 at 19:40
1  
These are (mostly) user-space features. Compiling a new kernel will not make a difference. –  snap Aug 3 '11 at 19:41
add comment

If you need a package in Debian with special CFLAGS or config options, you can use apt-build. Gentoo or *BSD is a very good OS for this purposes.

I know this isn't a solution but is the better workaround now.

share|improve this answer
    
Why the downvote? I would like know :) –  Juan Francisco Cantero Hurtado Aug 4 '11 at 22:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.