Sheryl Coppenger wrote: > Crispin Cowan wrote: > >> Wrap it in AppArmor http://en.opensuse.org/AppArmor for when you screw >> up ^W^W don't do all the above perfectly. >> > But that's only available if you're using Suse, right? No. AppArmor ships with SUSE Linux, but ports are available for Slackware, Ubuntu, and Pardus Linux. I have heard of several ports to Red Hat, but so far no one has chosen to release it. It is open source, and you can port it to any Linux you like, as long as it has a 2.6 kernel. > What about > hardened PHP, modsecurity, Those are good things too. > putting Apache in a chroot jail, That only jails all of Apache at once into a single large cell. AppArmor can confine each individual PHP page separately. And each PHP pages' confinement can overlap with others, allowing the components of the web site to work together. Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com Hack: adroit engineering solution to an unaticipated problem Hacker: one who is adroit at pounding round pegs into square holes
