11

My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)?

Ubuntu has a handy summary table showing the main security features of each Server edition release, but I haven't found something similar for Debian. Ubuntu mentions:

  • Stack Protector (gcc's -fstack-protector)
  • Heap Protector (GNU C Library heap protector)
  • Pointer Obfuscation (Some pointers stored in glibc are obfuscated)
  • Address Space Layout Randomisation (ASLR) (Stack ASLR; Libs/mmap ASLR; Exec ASLR; brk ASLR; VDSO ASLR)
  • Several daemons built as Position Independent Executables (PIE)
  • Some daemons (?) built with Fortify Source "-D_FORTIFY_SOURCE=2"

To which extent does Debian 6.0 use similar techniques (by default)?

2 Answers2

5

Unfortunately most (all?) of these defenses are not enabled on Debian. They have talked about it for years and there was some "hardened debian" project, but it has not lead to anything concrete so far from user's perspective. It is one of the rare distros which have not implemented these measures yet.

There is some more information at http://wiki.debian.org/Hardening:

After their meeting on the 14-16 January 2011, the debian security team announced in an email they intend to push the inclusion of hardening features for the wheezy release. A Birds of a Feather-session will be organized during the 2011 debconf to setup a process.

The referenced email is here: http://lists.debian.org/debian-devel-announce/2011/01/msg00006.html.

So maybe it is finally coming in "wheezy"...

This is the biggest single reason why I personally prefer running Ubuntu over Debian on my servers.

snap
  • 1,201
  • 9
  • 17
  • Debian makes it very easy to compile a new kernel based on their releases. You can always just enable the options you want on your kernel. – bahamat Aug 03 '11 at 19:40
  • 1
    These are (mostly) user-space features. Compiling a new kernel will not make a difference. – snap Aug 03 '11 at 19:41
0

If you need a package in Debian with special CFLAGS or config options, you can use apt-build. Gentoo or *BSD is a very good OS for this purposes.

I know this isn't a solution but is the better workaround now.

Rufo El Magufo
  • 321
  • 2
  • 12