Re: [suse-security] Old question: what is SUSE going to do with harden_suse / Bastille
Hi,
Am Samstag, 25. Oktober 2003 02:04 schrieb Bo Jacobsen:
The standard SuSE installation is much to open.
I agree upon that. But instead of hardening the system _after_ it has already been set up, I'd prefer a clean install that's not "too open". Maybe SuSE can introduce an install option such as "secure system" or something similar.
If only that fsck'ing portmapper wouldn't be run by default. That is the same ...stuff like MS Windows with RPC bound to anything looking like an interface -- remember W32/Blaster? Each time I set up a SuSE, I get angry about that idiocy.
Best wishes, Lutz
I agree 100%. They need an install option named firewall, or some thing like that, that leaves out ANY stuff that should not run on a firewall. I actually find it a little strange that they have not implemented that a long time ago, since security has been a hot topic for a long time now. One of the advantages of being able to run a separate script like hardensuse, is that if something will not run, it can be difficult to figure out if it's a problem with the tightened security, or if it's something else. I have had some problems in the past, where something would not run after executing hardenSuSE, but I knew it had something to do with the things the script did, so I just had to run hardensuse step-by-step to find out what system changes caused the problem. Another advantage was that I could run hardensuse on systems that was used as normal file, print and email servers. I just had to NOT select the security options that I new would disrupt the programs running on the server, or I could just make changes afterwoods, to the specific programs. However implemented, it would be a lot better then the situation we have today where there is s no official, and simple, way to upgrade the security of a SuSE host. The normal SuSE installation even have world-read permission on all files in /root !!!. I find that more then a little open. Actually, SuSE's lack of priority on basic system secutity tools, has forced me to start looking at other systems like FreeBSD etc. Bo
On Saturday 25 October 2003 16:19, Bo Jacobsen wrote:
I agree 100%. They need an install option named firewall, or some thing like that, that leaves out ANY stuff that should not run on a firewall. I actually find it a little strange that they have not implemented that a long time ago, since security has been a hot topic for a long time now.
Why not quite simply try out OpenBSD if you want to use a machine as a firewall? Security patches for OpenBSD are source only, so in your case you would need a second computer for making binaries for your firewall. I'm quite sure that quite a few readers on this mailinglist runs heterogenous networks.
The normal SuSE installation even have world-read permission on all files in /root !!!. I find that more then a little open.
The directory /root is readable only by root, unless you changed it's permissions.
Actually, SuSE's lack of priority on basic system secutity tools, has forced me to start looking at other systems like FreeBSD etc.
Bo
I'm not quite sure what you mean by "lack of priority on basic system secutity tools" in SuSE. SuSE does a quite a decent job in this respect. And if you need a more recent version of, say, nmap, the "make" is still available. /Sigfred
On Saturday 25 October 2003 16:19, Bo Jacobsen wrote:
I agree 100%. They need an install option named firewall, or some thing like that, that leaves out ANY stuff that should not run on a firewall. I actually find it a little strange that they have not implemented that a long time ago, since security has been a hot topic for a long time now.
Why not quite simply try out OpenBSD if you want to use a machine as a firewall? Security patches for OpenBSD are source only, so in your case you would need a second computer for making binaries for your firewall. I'm quite sure that quite a few readers on this mailinglist runs heterogenous networks.
Funny you should mention that, I have actually ordered OpenBSD 3.4, 4 days ago.
The normal SuSE installation even have world-read permission on all files in /root !!!. I find that more then a little open.
The directory /root is readable only by root, unless you changed it's permissions.
You are right, it's not so for /root (thank god), just the subdirs.
Actually, SuSE's lack of priority on basic system secutity tools, has forced me to start looking at other systems like FreeBSD etc.
Bo
I'm not quite sure what you mean by "lack of priority on basic system secutity tools" in SuSE. SuSE does a quite a decent job in this respect. And if you need a more recent version of, say, nmap, the "make" is still available.
/Sigfred
I'm not dissatisfied with SuSE as such, but SuSE are more and more focused on usability (which may I add, they are very good at) then security. I have used SuSE since ver. 5.0 (or was it 4.2, I don't remember) for all kinds of things, but you are right, I have to start using different OS's for different purposes. Bo
* Bo Jacobsen wrote on Sat, Oct 25, 2003 at 16:19 +0200:
an interface -- remember W32/Blaster? Each time I set up a SuSE, I get angry about that idiocy.
I don't think that I tell you anything new or surprising when telling major Linux-Distries become more and more similar to the WinWorld in many points, including too fast feature implementation and increasing security problems. SuSE is not an exception, but it's a company and sell what most people desire; that is a XP look-a-like (KDE) with auto-install. Today you'll find on SuSE's online store price information for licensing by 5 or 10 users or by 2 or 4 CPUs. But the customers seem to want that this way so SuSE delivers.
I agree 100%. They need an install option named firewall, or some thing like that, that leaves out ANY stuff that should not run on a firewall. I actually find it a little strange that they have not implemented that a long time ago, since security has been a hot topic for a long time now.
They do have: http://www.suse.de/en/business/products/suse_business/firewall/index.html You can also get a Training, maybe you can even get a SCSE (SuSE Certified Security Engeneer) or something. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
participants (3)
-
Bo Jacobsen -
Sigfred Håversen -
Steffen Dettmer