Kylin, the magic new chinese secure operating system that got some media buzz few months ago is actually just an improved BSD system, but the idea is the same: Take a more secure system than ‘windows server’ and add more security features to it.
I choose Gentoo for my secure box as i am anyways a gentoo user and the Gentoo Hardened team is developing quite steady. Afaik its also the only Linux distro that has a quite good documentation for NON-SELinux security features (coperate distros usually only support SELinux/AppArmor)
What is Gentoo Hardened?
It is a Gentoo profile that, if you choose it, it will add a few features to your compiler by default: CFLAGS=”-fPIE -fstack-protector-all” LDFLAGS=”-Wl,-z,now -Wl,-z,relro” you can add the useflags USE=”{$USE} hardened pic” to your /etc/make.conf as well, but that should be not necessary on a modern Gentoo system, but also will do no harm. As you can guess, this are only compiler flags, so we need to recompile the whole box, this will of course take ‘some’ time, here the way i did it:
I had already a system set up as non hardened, so i converted it by selecting the hardened profile and:
emerge --sync
emerge --oneshot binutils gcc virtual/libce
merge -e world # take 3 days holiday ^^
revdep-rebuild
Your system should be not only more secure now, but also more stable because the compiler flags catch a few bad programming habits, in my recompile i got only one smaller problem in a minor package that i posted to the Gentoo bug tracker.
Now the interesting part, lets add more features:
PaX
is the most important here, it is a way to protect the memory, it locks everything and then gives explicit access to the memory parts, it bring a tiny overhead but can protect the code from programming error and avoid most buffer overflow hacks.
After recompiling the system all your binary should be ‘PaX-ready’ (nice, need a sticker for my laptop ‘vista PaX-ready’). You now just need to add a few features in the kernel, this worked for me without any problems, its well documented here
GRsecurity
Manages gives you an improved chroot and it has also roles for all your services that are naked to the public and sets strict limits to them, has its own ACL that make SELinux pretty useless. The GRsecurity also starts with a few options to your kernel config, see here for more info. But as usually the trouble with rule based service profiles, you need the rules, this can be a quite time consuming work….
SELinux
Security-Enhanced Linux does not offer much more then GRsecurity (with its ACL) but if you run a cooperate environment that has to fulfill certain standards its can be useful because it apply the guidelines of the U.S. Department of Defense and under run a detailed check by the NSA, so not much more than fancy names here 
… I did not used it, even though there are a lot of rules already …
RSBAC
This one is a kind of similar concept to SELinux with some more features, the main ‘features’ is that it is government independent and it sees itself more universal.
One more info about PaX, one feature i really like is: ASLR (Address space layout randomization): If a hacker wants to take over your box, he need to inject his code in order get access, so he need a security hole AND a place to put his injected code … ASLR can not help preventing the security hole, but it mixes up the memory randomly, so the hacker has a big problem to find the typical injection hooks like the address of the libc
Disadvantages: if you do some really dangrous dynamic memory juggeling in your code, it might run into some problems.
Links:
http://www.gentoo.org/proj/en/hardened/hardenedfaq.xml
[EDIT]
Some update, if you proud owner of GCC 4.4.x powered by the new faster graphite subsystem, you might run into a few problems with Gentoo Hardened, better switch it off, and let GCC compile the loops in the old manner
