On 07/04/17 23:16, Walter Dnes wrote: > On Tue, Jul 04, 2017 at 01:37:38PM -0400, james wrote > >> W. Dnes is the king of minimalist here, so when he gives advise >> realize it has decades of experimentation to get to where he is on >> minimization. > > Not exactly "decades". I first started linux in late 1999 or early > 2000. The minimalist approach was a side-effect of me being cheap. > Even though I have a newer machine as my "hot backup" waiting in the > wings, I want to run my older machine into the ground first. 10 years > ago I was running a 450 mhz pentium3 with 256 megabytes of ram. Today > I'm running a 2008 Dell with Core2 Duo and 3 gigs of ram today. I have > a newer i6 with 8 gigs of ram as the hot backup. Running an older > limited machine forces you to optimize. The Gentoo USE flags give me > the control to do the utmost minimization. > > I run the plain default/linux profile, and ICEWM as my WM and no > "desktop environment" (as per my sig). The less attack surface, the > better. Do not run the Flash plugin or the Java plugin. If you > absolutely have to do so, use it inside a VM (e.g. QEMU). I have an > aggressive handcrafted iptables firewall. In addition, my little LAN > sits behind a NAT-ing router, and I disable UPNP. That covers my > approach to security. > > I run mostly stable, except where an app I want/need is only unstable. > Gentoo currently defaults to gcc-5.4.0. I've enabled 6.3.0. I have to > enable ICEWM 1.3.12-r1. The regular stable version built under gcc > 6.3.0 segfaults 1 or 2 seconds after starting. > > I used to run with USE="-* blah blah blah". I no longer do that, but > I aggressively disable USE flags, until something breaks, then I back > off. My current USE line (it's actually one long line)... > > USE="X apng bindist ffmpeg jpeg opengl png szip truetype x264 x265 xorg > threads webp -acl -berkdb -caps -cracklib -crypt -filecaps -gallium > -gdbm -graphite -gstreamer -iconv -introspection -ipc -iptables -ipv6 > -libav -llvm -manpager -nls -openmp -pam -pch -sendmail -tcpd -udev > -udisks -unicode -xinerama" > > Some of the above is over-ridden in package.use. >
Well, now that's a good summary (starting point) for a minimized gentoo system. The gentoo-devs have been discussing changes to the profiles, but I'm not certain where that has ended up. I just use the 'default' and go from there, or the simplest 'hardened' profile that is cpu relevant. I'm not sure of the most straight forward way to compare flag setting (the difference) between any two profiles for a new installer to examine; perhaps somebody else has a straight forward method to compare current profiles, within a given architecture? Surely at look at the contents of @system set is a good starting point for a new gentooer to see what he gets no matter which profile he selects? Then there is the 'experimental' profiles that the devs keep moving around; who knows what's up with those mavericks.... Hopefully the AliceF [1] GSoC work will result in some structure to to follow for a minimized and hardened kernel going forward. Even in the gentoo-sources kernel there is much that can be stripped out, reducing bloat at the least and probably reducing attack venues too. During this process, I keep several bootable kernels available so reverting is easy. Perhaps there is a gentoo wiki page that at least outlines the manual processes (a structured approach) as users go down the pathway of stripping out what their workstation does not need in a kernel? Perhaps someone has a slick, home-spun, tool that readily identifies what can be additionally stripped from the current kernel offerings on the pathway to minimized_nirvana ? Then there's NFTables; not sure anything useful is published on NFTables, nor how effective it is for a workstation firewall... [3] Thanks Watler for sharing. Increasing the population of (OpenRC et. al.) minimalists is always welcome as our numbers are growing every day; not that one is bound to OpenRC to be a gentoo_minimalist. hth, James [1] https://blogs.gentoo.org/alicef/ https://archives.gentoo.org/gentoo-soc/threads/2017-06/ [3] https://wiki.gentoo.org/wiki/Nftables
