Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is.

In your opinion, is the added security a must or just nice to have? Is the performance hit worth it? Is it worth the trouble? Do you recommend an alternative (ex: mod_security)?

I look forward to hearing everyone's thoughts!

share|improve this question
Asking about 'worth' is highly subjective as it is currently written. The requirements for a 'brochure site' would be completely different then the requirements for an online banking site. This question would also be a better fit over on where you could possibly get some useful answer if you adjusted your question to be less subjective. – Zoredache Aug 17 '11 at 18:12
I found some useful answers here: – Dan Aug 18 '11 at 15:55
up vote 1 down vote accepted

I honestly don't think it's worth the trouble. Yes, it provides an added level of security, but at significant cost. Security isn't an absolute; all you have to do is be better than other targets that are at a similar risk of being targetted (or that have a similar benefit to the attacker if they're compromised). Given the number of servers that can still be popped open using some simple password brute-forcing, trivial web application vulnerabilities, and massively out-of-date patch levels, if you're actually do all that stuff, then you're so invulnerable relative to millions of other systems that your risk of intrusion is already so low as to be not worth any additional faffing around.

This is, of course, assuming that your risk analysis centers around untargeted attacks. If you're likely to be a target of a particularly skilled or motivated attacker (either because you're a valuable target, like a bank, or people particularly want to take you down, like Sony) then you might want to look at SELinux, or some other niche security products.

share|improve this answer
Well said. Many thanks. – Dan Aug 21 '11 at 3:57
I disagree with the line "be better than other targets that are at a similar risk of being targetted" because for a lot of attacks there isn't a human picking targets. It's an automated botnet scanning ip addresses, and then trying exploits when it hits a web server or other service. If none of the library of exploits crack that service, it moves on. Your odds of being attacked don't depend on your relative level of security, only on having an ip address reachable by an attacker. You need to not be vulnerable to their library of automated attacks. – Mnebuerquo Apr 26 at 19:54
Yes, that's my point: keep yourself patched against the library of exploits for (usually really old) publically-known vulnerabilities, and then "your risk of intrusion is [...] so low as to be not worth any additional faffing around [ie running SELinux]". – womble Apr 27 at 23:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.