In this video, I'll tell you why you need SELinux.
So the reason is that Linux security is built on Unix security.
And Unix security is pretty old.
It consists of different solutions that were never developed with current IT security needs
in mind.
As a reason for that, Unix development started in 1970.
And situations were completely different in those days.
Most of Unix security focuses on part of the operating system.
Even if parts of Unix security are pretty solid, like file security, read, write and
execute sounds simple, but it's doing its work.
But there was a need for something more.
And that something more is SELinux.
It provides a complete and mandatory security solution.
The principle in SELinux is that if it isn't specifically allowed, it will be denied.
And as a result, unknown services will always need additional configuration to enable them
in an environment where SELinux is enabled.
Known services, on the other hand, work well with the standard SELinux configuration.
Remember the demo of the HTTP server, for instance.
I didn't do anything on SELinux because it just works as I used the standard components.
Now let me tell you a little story from my own experience that illustrates why SELinux
is required.
This is what I like to call the I want to get hacked experiment.
It was a couple of years ago.
I had bought a server, installed the server in a rack in a data center with direct fast
internet access.
I wasn't doing very much on that server, so I felt like, hey, let's do an experiment
and let's see how security really works.
So I used a couple of good old principles in IT that were pretty common in the 1990s.
If it ain't broke, don't fix it.
So why would I use any updates?
If you don't run any services that you don't need, you don't need a firewall.
That's how I started my server, and I installed an Apache web server, and everything was doing
quite well.
Now, the server has been up and running for a couple of years, but my business professionalized,
and I wanted a real website.
So I started hosting my own website on my server, and I started hiring people.
The fact is that everyone came with their own web content management system, and I didn't
like guy number one, I didn't like guy number two, and I didn't like guy number three.
So in the end, I had three different web content management systems, and then on a good day,
I was hacked.
So how did I find out?
Well, my data center provider was telling me that I had run out of data for that month.
I think I had 100 gigs.
It was the third of the month, and I was already out of it.
Oh, my goodness.
So what happened?
Well, after analyzing, I found that in one of the web content management systems, there
was a zero-day exploit.
A zero-day exploit is a security problem that is not widely known, and for which there are
no solutions yet.
And this security problem allowed the intruder to get into the web server, and open a shell
as a web server user, and write a script in the VAR TMP directory, and the script was
being serviced by the web server, and made that my web server was part of a worldwide
distributed denial-of-service attack.
That was so cool, because I learned so much from it.
What I learned is that you need SELinux, because the essence of the problem is that a web server
that is servicing a script from VAR TMP, that is not really common behavior, and SELinux
blocks everything that is uncommon behavior.
And from that perspective, SELinux is a rock-solid solution that makes that you are a lot less
vulnerable, even for zero-day exploits.
And in this lesson, you'll learn all about it.