Pre-Install

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev | Chapter 7. Configuring and Building a Secure, Optimized Kernel | Next

# 7.1. Pre-Install

In our configuration and compilation we will build a monolithic kernel. Monolithic kernel means to only answer `Yes` or `No` to the questions, don't make anything modular and omit the steps:

- make_modules

- make_modules_install.

Also, we will patch our new kernel with the buffer overflow protection from kernel patches. Patches for the Linux kernel exist, like Solar Designer's non-executable stack patch, which disallows the execution of code on the stack, making a number of buffer overflow attacks harder - and defeating completely a number of current exploits used by "script kiddies" worldwide.

> : Remember to only answer `Yes` or `No` to the questions when configuring your new kernel if you're intending to build a monolithic kernel. If you intend to use firewall masquerading functions or a dial-up ppp connection, you cannot build a monolithic kernel, since these function require the build of some modules, by default. Build, instead, a modularized kernel.

A new kernel is very specific to your computer hardware, in the kernel configuration part; we are using the following hardware for our example. Of course you must change them to fit your system components.

1 Pentium II 400 MHz (i686) processor
1 Motherboard SCSI
1 Hard Disk SCSI
1 SCSI Controler Adaptec AIC 7xxx
1 CD-ROM ATAPI IDE
1 Floppy Disk
2 Ethernet Cards Intel EtherExpressPro 10/100
1 Mouse PS/2

These installation instructions assume

Commands are Unix-compatible.
The source path is `/usr/src.`
Installations were tested on Red Hat Linux 6.1 and 6.2.
All steps in the installation will happen in super-user account root.
Latest Kernel version number is 2.2.14
Latest Secure Linux Kernel Patches version number is 2_2_14-ow2

All these below mentioned Packages were available in the following sites as of this writing but we suggest you can get additional information regarding mirror sites by searching on their respective home pages.

- Kernel Homepage:http://www.kernelnotes.org/

  Be sure to download: linux-2_2_14_tar.gz

  Kernel FTP Site: 139.142.90.113

- Secure Linux Kernel Patches Homepage:http://www.openwall.com/linux/

  You must be sure to download: linux-2_2_14-ow2_tar.gz

  Secure Linux Kernel Patches FTP Site: 195.42.162.180

## 7.1.1. Make an emergency boot floppy

The first of the pre-install step is to make an emergency boot floppy. Linux has a small utility named mkbootdisk to simply do this. The first step is to find out what kernel version, you are currently using. Check out your `/etc/lilo.conf` file and see which image was booted from and from this image, we can find the kernel version we need to make our emergency boot floppy.

                     [root@deep] /#cat /etc/lilo.conf

In my example, I have the following in the `lilo.conf` file:

                     boot=/dev/sda
                     map=/boot/map
                     install=/boot/boot.b
                     prompt
                     timeout=50
                     image=/boot/vmlinuz-2.2.12-20
                     label=linux
                     root=/dev/sda6
                     initrd=/boot/initrd-2.2.12-20.img
                     read-only

  the kernel version
  the image we booted from

Now you'll need to find the image that you booted from. On a standard new first install, it will be the one-labeled linux. In the above example we show that the machine booted using the `/boot/vmlinuz-2.2.12-20` original kernel version of the system. Now we simply need to put a formatted 1.44 floppy in our system and execute the following command as root:

                     [root@deep] /#mkbootdisk --device /dev/fd0 2.2.12-20

`Insert a disk in /dev/fd0. Any information on the disk will be lost. Press <Enter> to continue or ^C to abort:`

Following these guidelines, you will now have a boot floppy with a known working kernel in case of problems with the upgrade. I recommend rebooting the system with the floppy to make sure that the floppy works correctly.

Prev | Home | Next
Configuring and Building a Secure, Optimized Kernel | Up | Uninstallation and Optimization