Red Hat Enterprise Linux 5 Administration Unleashed

APPENDIX CPreventing SecurityBreaches withExecShieldIN THIS APPENDIX. How ExecShield Works. Determining Status ofExecShield. Disabling ExecShieldExecShield is designed to prevent security breaches causedby software programs written to crawl through the Internetlooking for systems with common vulnerabilities such asworms and viruses. It is enabled in the kernel and works ina way that is nonintrusive to the user. Its goal is not todefend against the expert hacker who has broken into yourlocal network or an employee inside the company whoalready has access to parts of the network. Its goal is toprevent against intruders using scripts that look for vulnerabilitiesin the way a program running with root privilegesis written.You will still need to develop a security plan for keepingyour systems secure while allowing authorized users toaccess them. However, ExecShield should help you avoidcommon exploits known to affect other operating systems.ExecShield is enabled by default in Red Hat EnterpriseLinux. This appendix gives a brief explanation of howExecShield accomplishes this goal and how to disable it inRed Hat Enterprise Linux should it interfere with otherprograms.How ExecShield WorksOne of the ExecShield memory-management techniques isusing random memory locations each time a program isstarted. Using random memory locations prevents wormsor viruses from knowing which parts of memory to overwritewith executables that breach the security of thesystem. For example, if the same memory location is usedby a program every time the program is run, a hacker can