3

As far as I remember, most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).

Did the situation improve with Debian Squeeze or the upcoming Debian Buster ?

By comparison, Ubuntu and Fedora have a nice security features matrix, but I couldnt find a clear answer for Debian.

puzzle
  • 81
  • 6
  • Have you tried using [checksec](https://github.com/slimm609/checksec.sh)? And here is the [2014 status](https://outflux.net/blog/archives/2014/02/03/compiler-hardening-in-ubuntu-and-debian/). – forest Dec 02 '18 at 03:08

1 Answers1

2

you can check if a binary is compiled with

  1. PIE
  2. stack protection
  3. fortify source
  4. RO relocations
  5. Immediate binding

by using hardening-check. E.g. hardening-check $(which sshd) Package devscripts contains the hardening-check

On Debian testing i get the following output:

root@root:~# hardening-check $(which sshd)
/usr/sbin/sshd
Position Independent Executable: yes
Stack protected: yes
Fortify Source functions: yes (some protected funcions found)
Read-only relocations: yes
Immediate binding: yes

See the following answer on stackexchange

user3692267
  • 21
  • 3