Gentoo: Hardening Your System with USE Flags

Binary distributions like RedHat or Debian include everything but the kitchen sink in their binaries. Why does your mail server need X11 support in its libraries? It doesn't. In Gentoo, we fix this at the source.

The Power of Minus

Your /etc/make.conf is your primary weapon. By globally disabling features, you reduce your attack surface significantly.

# /etc/make.conf
USE="-* ipv6 ssl pam berkdb readline ncurses crypt tcpd"

The -* is a "nuclear" option that disables all default flags. We then explicitly enable only what we need.

Package-Specific Hardening

For sensitive applications like Apache or OpenSSH, you can be even more surgical in /etc/portage/package.use.

net-misc/openssh -X -kerberos -skey
net-www/apache -doc -ldap -mysql

ProPolice and PIE

If you're really serious about security, you should be using the hardened profile. This enables the ProPolice stack protector and Position Independent Executables (PIE) in GCC.

# emerge --select profile default-linux/x86/2004.0/hardened
# emerge -e world

Yes, it will take three days to recompile your entire system on that Pentium 4. But when you're done, you'll have a system where buffer overflows are significantly harder to exploit. If it's not compiled specifically for your CPU with the exact features you need, it's just bloatware.