Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is.

In your opinion, is the added security a must or just nice to have? Is the performance hit worth it? Is it worth the trouble? Do you recommend an alternative (ex: mod_security)?

I look forward to hearing everyone's thoughts!

share|improve this question
    
Asking about 'worth' is highly subjective as it is currently written. The requirements for a 'brochure site' would be completely different then the requirements for an online banking site. This question would also be a better fit over on security.stackexchange.com where you could possibly get some useful answer if you adjusted your question to be less subjective. –  Zoredache Aug 17 '11 at 18:12
    
I found some useful answers here: stackoverflow.com/questions/97816/do-you-disable-selinux –  Dan Aug 18 '11 at 15:55

1 Answer 1

up vote 1 down vote accepted

I honestly don't think it's worth the trouble. Yes, it provides an added level of security, but at significant cost. Security isn't an absolute; all you have to do is be better than other targets that are at a similar risk of being targetted (or that have a similar benefit to the attacker if they're compromised). Given the number of servers that can still be popped open using some simple password brute-forcing, trivial web application vulnerabilities, and massively out-of-date patch levels, if you're actually do all that stuff, then you're so invulnerable relative to millions of other systems that your risk of intrusion is already so low as to be not worth any additional faffing around.

This is, of course, assuming that your risk analysis centers around untargeted attacks. If you're likely to be a target of a particularly skilled or motivated attacker (either because you're a valuable target, like a bank, or people particularly want to take you down, like Sony) then you might want to look at SELinux, or some other niche security products.

share|improve this answer
    
Well said. Many thanks. –  Dan Aug 21 '11 at 3:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.