3

This question is probably a matter of personal opinion but I wanted to gather your thoughts on how important having SELinux enabled on a web server is.

In your opinion, is the added security a must or just nice to have? Is the performance hit worth it? Is it worth the trouble? Do you recommend an alternative (ex: mod_security)?

I look forward to hearing everyone's thoughts!

2
  • Asking about 'worth' is highly subjective as it is currently written. The requirements for a 'brochure site' would be completely different then the requirements for an online banking site. This question would also be a better fit over on security.stackexchange.com where you could possibly get some useful answer if you adjusted your question to be less subjective.
    – Zoredache
    Aug 17, 2011 at 18:12
  • I found some useful answers here: stackoverflow.com/questions/97816/do-you-disable-selinux
    – Dan
    Aug 18, 2011 at 15:55

1 Answer 1

1

I honestly don't think it's worth the trouble. Yes, it provides an added level of security, but at significant cost. Security isn't an absolute; all you have to do is be better than other targets that are at a similar risk of being targetted (or that have a similar benefit to the attacker if they're compromised). Given the number of servers that can still be popped open using some simple password brute-forcing, trivial web application vulnerabilities, and massively out-of-date patch levels, if you're actually do all that stuff, then you're so invulnerable relative to millions of other systems that your risk of intrusion is already so low as to be not worth any additional faffing around.

This is, of course, assuming that your risk analysis centers around untargeted attacks. If you're likely to be a target of a particularly skilled or motivated attacker (either because you're a valuable target, like a bank, or people particularly want to take you down, like Sony) then you might want to look at SELinux, or some other niche security products.

2
  • I disagree with the line "be better than other targets that are at a similar risk of being targetted" because for a lot of attacks there isn't a human picking targets. It's an automated botnet scanning ip addresses, and then trying exploits when it hits a web server or other service. If none of the library of exploits crack that service, it moves on. Your odds of being attacked don't depend on your relative level of security, only on having an ip address reachable by an attacker. You need to not be vulnerable to their library of automated attacks.
    – Mnebuerquo
    Apr 26, 2016 at 19:54
  • Yes, that's my point: keep yourself patched against the library of exploits for (usually really old) publically-known vulnerabilities, and then "your risk of intrusion is [...] so low as to be not worth any additional faffing around [ie running SELinux]".
    – womble
    Apr 27, 2016 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .