On Tuesday 28 December 2004 10:03, Malte Gell wrote:

Hi there, I'm just playing a bit with IBM's SSP ( http://www.research.ibm.com/trl/projects/security/ssp/ ) and GCC 3.4.1. Since OpenBSD, Gentoo and others already ship with it, i wonder what do the SuSE security people think about SSP? Will SuSE support it in the future and if not, why? Is SSP really such an improvement as some say it is?

Will SUSE start to support it? I don't know. There are performance penalties involved with installing canary bytes before function calls and then checking them afterwards. I don't know what those penalties might be, but any performance sensitive application would certainly feel it. I wouldn't want such a thing on any Linux box I work with unless I have the option of turning it off when it gets in the way. Is SSP an improvement? Er, over what? Not having it there at all? Yes, but it's not a catch all system that will make all the buffer overflow vulnerabilities go away. That's the problem with these sorts of things: they tend to give a false sense of security. The SSP webpage says "Applications written in C will be protected by the method..." which just isn't true. It's not protected. Another hurdle is put in the path of an attacker, but these hurdles can be overcome: http://www.phrack.org/phrack/56/p56-0x05 Cluttering up code with these sorts of band-aid patches isn't the answer. The answer is to get the code right, or if that can't be guaranteed, to write the code in a language that isn't vulnerable to buffer overflows - i.e. something with security designed in, rather than bolted on.

Hi all. I have an idea for an open source CASE tool, that should help in the development of structured, and thus easier to maintain code. This method should help in the development of more secure code. This is just an idea, that I do not have time to implement. For more info, please see the homepage of http://www.karsites.net/ 'SPDTool - an idea for a structured open source development CASE tool.' Find out more at the above link! On Tue, 28 Dec 2004, Derek Fountain wrote:

To: suse-security@suse.com From: Derek Fountain Subject: Re: [suse-security] Will SuSE support stack smashing protection one day?

Cluttering up code with these sorts of band-aid patches isn't the answer. The answer is to get the code right, or if that can't be guaranteed, to write the code in a language that isn't vulnerable to buffer overflows - i.e. something with security designed in, rather than bolted on.

Hi Allen, Allen wrote:

It does, they can brag how secure it is over other OSs in a default state. Which is shit anyway, an OS should come with a more useable state than secure, and it should be up to the admin to secure it as needed. Which is why I don't like Open BSD. They have code audits, big deal so does SUSE, they ship it with everything turned off..... Big deal, you can do that with any Linux / BSD. It's shitty.

it's not shitty, it's clever. For most people it's an easier job to open up some potential holes in order to get something running than to close all of those potential holes in order to get secure. That's the same way every good firewall should work - drop by default and open up what you need. With your arguments - you can also make windows secure, somehow ;-). Besides that the OpenBSD-Team writes good (secure and functional) open source software that's quite often used under Linux, too. I'd not use OpenBSD on the desktop (besides old hardware), but I recommend to consider it for servers. Greetings, Ralf

On Tuesday 28 December 2004 08:47, Allen wrote:

On Tuesday 28 December 2004 01:11, Malte Gell wrote:

...

Isn't this wishful thinking or unfeasable to a certain degree? I just thought if OpenBSD ships with SSP it must have noticeable advantages, otherwise they hadn't included it.

It does, they can brag how secure it is over other OSs in a default state. Which is shit anyway, an OS should come with a more useable state than secure, and it should be up to the admin to secure it as needed. Which is why I don't like Open BSD. They have code audits, big deal so does SUSE, they ship it with everything turned off..... Big deal, you can do that with any Linux / BSD. It's shitty.

What has turning on/off un/needed services to do with protection against buffer overflows? SSP offers protection against vulnerabilites that may not have been discovered yet and IMHO this is anything but shitty. It would be interesting to see how much attacks had been prevented if SSP were used more widely. Malte

On Tue, Dec 28, 2004 at 03:03:47AM +0100, Malte Gell wrote:

Hi there,

Hello.

I'm just playing a bit with IBM's SSP ( http://www.research.ibm.com/trl/projects/security/ssp/ ) and GCC 3.4.1. Since OpenBSD, Gentoo and others already ship with it, i wonder what do the SuSE security people think about SSP? Will SuSE support it in the future and if not, why? Is SSP really such an improvement as some say it is?

We evaluated various solutions. The problem is that some are very intrusive and most can be bypassed. We are aware of the fact that we *need* such a protection and are working hardly to get it done. -- Bye, Thomas -- Thomas Biege , SUSE LINUX AG, Security Support & Auditing -- Teachers should prepare the student for the student's future, not for the teacher's past. -- Richard W. Hamming

On Wednesday 29 December 2004 13:00, Thomas Biege wrote: Hi,

We evaluated various solutions. The problem is that some are very intrusive and most can be bypassed.

We are aware of the fact that we *need* such a protection and are working hardly to get it done.

thanx, interesting answer ;-) I guess it suggests SSP isn't the best solution in your view, I've just read some positive things about it and this initially led to my question. Malte

On Wed, Dec 29, 2004 at 05:43:49PM +0100, Malte Gell wrote:

On Wednesday 29 December 2004 13:00, Thomas Biege wrote: Hi,

...

We evaluated various solutions. The problem is that some are very intrusive and most can be bypassed.

We are aware of the fact that we *need* such a protection and are working hardly to get it done.

thanx, interesting answer ;-) I guess it suggests SSP isn't the best solution in your view, I've just read some positive things about it and this initially led to my question.

We didn't checked SSP AFAIK. -- Bye, Thomas -- Thomas Biege , SUSE LINUX AG, Security Support & Auditing -- Teachers should prepare the student for the student's future, not for the teacher's past. -- Richard W. Hamming

On Wed, Dec 29, 2004 at 08:59:56PM +0100, Thomas Biege wrote:

On Wed, Dec 29, 2004 at 05:43:49PM +0100, Malte Gell wrote:

...

On Wednesday 29 December 2004 13:00, Thomas Biege wrote: Hi,

...

We evaluated various solutions. The problem is that some are very intrusive and most can be bypassed.

We are aware of the fact that we *need* such a protection and are working hardly to get it done.

thanx, interesting answer ;-) I guess it suggests SSP isn't the best solution in your view, I've just read some positive things about it and this initially led to my question.

We didn't checked SSP AFAIK.

SSP is also called IBM Stackprotector after reading google again. We had a look at it, but the inclusion criteria for us is that is also included in upstream gcc. According to rumors IBM is working on that, but I doubt we will see that before gcc 4.1. Ciao, Marcus

-----Original Message----- From: Allen [mailto:gorebofh@comcast.net] Sent: 28 December 2004 07:47 To: suse-security@suse.com Subject: Re: [suse-security] Will SuSE support stack smashing protection one day?

On Tuesday 28 December 2004 01:11, Malte Gell wrote:

...

Isn't this wishful thinking or unfeasable to a certain degree? I just thought if OpenBSD ships with SSP it must have noticeable advantages, otherwise they hadn't included it.

It does, they can brag how secure it is over other OSs in a default state. Which is shit anyway, an OS should come with a more useable state than secure, and it should be up to the admin to secure it as needed.

What, like with Windows? XP's great, the default user has admin privs, and doesn't even need a password to log on! Really easy for the user. Crap design, but easy. Tom. -- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight@ahds.ac.uk

...

...

...

Isn't this wishful thinking or unfeasable to a certain degree? I just thought if OpenBSD ships with SSP it must have noticeable advantages, otherwise they hadn't included it.

It does, they can brag how secure it is over other OSs in a default state. Which is shit anyway, an OS should come with a more useable state than secure, and it should be up to the admin to secure it as needed.

What, like with Windows?

XP's great, the default user has admin privs, and doesn't even need a password to log on! Really easy for the user. Crap design, but easy.

You're on a SUSE list standing up for OpenBSD. If you like it so much tell them on their list.

Well, that discussion for sure is not off-topic, but isn't it a bit silly? Johannes

Allen wrote:

...

You're on a SUSE list standing up for OpenBSD.

So what? There's absolutely nothing wrong with that.

Very true! Infact it's possibly a bad idea to "stick all of your eggs in one basket" and have a 100% homogenous OS environment. For example, even though we're migrating all of our servers to SuSE SLES, it might be a good idea to have our Firewall running [open|net]BSD. Why?? Whats wrong with a SLES firewall?? Well if there *did* ever happened to be an exploit that affected the Linux TCP/IP stack, then people might (possibly) be able run rampant across your network! However if you had a different OS for your firewall, then that would add an extra layer of network security. Possibly. Who knows!

...

If you like it so much tell them on their list.

Hell, maybe *BSD is more secure by default. SLES 9's default sshd_config isn't ideal, that's for sure! (I think it had "PasswordAuthentication no" but then it also had "UsePAM yes" as well... which OVERRIDES the first setting!!! End result... it still allows PasswordAuthentication unless you reconfigure PAM or set it to "UsePAM no"!). SuSE is great. *BSD's are all great. None of them are perfect, so there's no harm in comparing them. Cheers Mike

Interesting article. But if you go to the mi2g website and dig around, it says that lots of the problems with Linux were from home users misconfiguring their set-up or not updating vulnerable packages, etc. Shame they didn't break it down by "distribution" of Linux!! :)

-----Original Message----- From: george [mailto:gasjr4wd@mac.com] Sent: Thursday, 6 January 2005 2:17 p.m. To: suse-security@suse.com Subject: Re: [suse-security] Will SuSE support stack smashing protectionone day?

On 1/5/05 7:57 PM, "Mike Tierney" wrote:

...

...

Allen wrote:

...

You're on a SUSE list standing up for OpenBSD.

So what? There's absolutely nothing wrong with that.

Very true! Infact it's possibly a bad idea to "stick all of your eggs in one basket" and have a 100% homogenous OS environment. For example, even though we're migrating all of our servers to SuSE SLES, it might be a good idea to have our Firewall running [open|net]BSD.

http://www.computerworld.com/securitytopics/security/story/0,10801,97157,0 0. html

-- Thanks, George

"They that would give up essential liberty for temporary safety deserve neither liberty nor safety." Benjamin Franklin

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

On Wed, Jan 05, 2005 at 10:59:26PM -0500, george wrote:

On 1/5/05 10:23 PM, "Mike Tierney" wrote:

...

Interesting article.

But if you go to the mi2g website and dig around, it says that lots of the problems with Linux were from home users misconfiguring their set-up or not updating vulnerable packages, etc.

Yes, that is very true.

...

Shame they didn't break it down by "distribution" of Linux!! :)

That would have been nice. Some flavors install (almost) as bad as M$ - everything open. (isn't it mandrake or something?) Then you have some that install with everything closed.

But to be honest, I also have OSX servers. It is a nice GUI, and is good at what it does. You just have to get used to the fact that you can't change the eye candy.

We have had three other servers going for years with out anyone getting in or even close, each with out a firewall at all. Those three are ASIP

How would you know? I mean if someone doesn't put a firewall up, believe me there are people who can get in without being noticed at all. Hell I know hot to forge logs, and it would seem like everything is fine.

Long live OS9! :)

Dear me...

--

Thanks, George

"...Linux, MS-DOS, and Windows XP" (also known as the Good, the Bad, and the Ugly)

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

On Thu, Jan 06, 2005 at 01:57:24PM +1300, Mike Tierney wrote:

...

Allen wrote:

...

You're on a SUSE list standing up for OpenBSD.

So what? There's absolutely nothing wrong with that.

Very true! Infact it's possibly a bad idea to "stick all of your eggs in one basket" and have a 100% homogenous OS environment. For example, even though we're migrating all of our servers to SuSE SLES, it might be a good idea to have our Firewall running [open|net]BSD.

Why?? Whats wrong with a SLES firewall?? Well if there *did* ever happened to be an exploit that affected the Linux TCP/IP stack, then people might (possibly) be able run rampant across your network! However if you had a different OS for your firewall, then that would add an extra layer of network security. Possibly. Who knows!

...

...

If you like it so much tell them on their list.

Hell, maybe *BSD is more secure by default. SLES 9's default sshd_config isn't ideal, that's for sure! (I think it had "PasswordAuthentication no" but then it also had "UsePAM yes" as well... which OVERRIDES the first setting!!! End result... it still allows PasswordAuthentication unless you reconfigure PAM or set it to "UsePAM no"!).

Um, NO, BSD is NOT more secure than SUSE. SUSE lets you install, then update all patches BEFORE it's even been booted for the first time. That alone gives it a HUGE advantage over BSD. Open BSD might have everything turned off but the only people who gain anything from that are VERY lazy admins. Home users who don't know how to edit configs wouldn't use it to begin with. SUSE has a good firewall front end for IPtables, it updates before booting and X is even not listening by default and you can shut down other services before it boots as well. Put this in the hands of someone who isn't a complete moron and you have a very secure box. SSH by default.... Ummm, I needed to log in before it let me in, what are you talking about?

SuSE is great. *BSD's are all great. None of them are perfect, so there's no harm in comparing them.

I wrote docs for Free BSD, I knwo it's great, but not more secure than SUSE. Let it be known any OS can be made secure. Including DOS. think about it, one user, one task, well, be the one user doing the one task and it can no longer handle anymore applications. You would of course need a custom app to take the risk of more threads being created so someone COULD hack into it, but it can be done.

Cheers Mike

-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

Allen wrote:

On Thu, Jan 06, 2005 at 01:57:24PM +1300, Mike Tierney wrote:

...

...

Allen wrote:

...

You're on a SUSE list standing up for OpenBSD.

So what? There's absolutely nothing wrong with that.

Very true! Infact it's possibly a bad idea to "stick all of your eggs in one basket" and have a 100% homogenous OS environment. For example, even though we're migrating all of our servers to SuSE SLES, it might be a good idea to have our Firewall running [open|net]BSD.

Why?? Whats wrong with a SLES firewall?? Well if there *did* ever happened to be an exploit that affected the Linux TCP/IP stack, then people might (possibly) be able run rampant across your network! However if you had a different OS for your firewall, then that would add an extra layer of network security. Possibly. Who knows!

...

...

If you like it so much tell them on their list.

Hell, maybe *BSD is more secure by default. SLES 9's default sshd_config isn't ideal, that's for sure! (I think it had "PasswordAuthentication no" but then it also had "UsePAM yes" as well... which OVERRIDES the first setting!!! End result... it still allows PasswordAuthentication unless you reconfigure PAM or set it to "UsePAM no"!).

Um, NO, BSD is NOT more secure than SUSE. SUSE lets you install, then update all patches BEFORE it's even been booted for the first time. That alone gives it a HUGE advantage over BSD.

That's not exactly what happens. The kernel HAS booted at that stage. Its just a special envrionment set up directly from the initrd (or something like that, I've never looked how that syslinux thing works exactly). You could run stuff in that stage. In fact, you have terminals available if you want them. You can download using wget and install or simply run programs on the ramdisk. The only thing that hasn't happend yet is the normal boot process with init and all the init-scripts which form the normal envrionment. Of course the point is somewhat moot and I also like the way it is done. It's very flexible.

SUSE has a good firewall front end for IPtables, it updates before booting and X is even not listening by default and you can shut down other services before it boots as well.

Put this in the hands of someone who isn't a complete moron and you have a very secure box. SSH by default.... Ummm, I needed to log in before it let me in, what are you talking about?

I don't have a SLES9 but I believe he means to say that PasswordAuthentication was still possible even with it set to off on sshd.

...

SuSE is great. *BSD's are all great. None of them are perfect, so there's no harm in comparing them.

I wrote docs for Free BSD, I knwo it's great, but not more secure than SUSE. Let it be known any OS can be made secure. Including DOS. think about it, one user, one task, well, be the one user doing the one task and it can no longer handle anymore applications. You would of course need a custom app to take the risk of more threads being created so someone COULD hack into it, but it can be done.

There are two very great articles on this topic: Why Linux will never be as secure as OpenBSD: http://www.seifried.org/security/os/20011107-linux-openbsd.html Then follow up with Why OpenBSD will never be as secure as Linux: http://www.seifried.org/security/os/20011107-openbsd-linux.html Note that both articles are quite old and are outdated. The essence is still there though. 3 Years ago I tried out LIDS. It can make your linux box absolutely unusable for anyone without the the access key. You can really give everyone the root pw once it's setup. They can't do any damage. But it's a huge PITA to setup. Ultimately though, if you're really really really paranioid, it's the thing to do. As I said that was 3 years or longer back and I don't know where it is today. But you can really seal off a Linux box in a way BSD just can't. Wheter you want or need that is an entirely other matter though. And I believe I've heard that the BSD folks are working on something similar. -- C U - -- ---- ----- -----/\/ René Gallati \/\---- ----- --- -- -

Hello, Am Donnerstag, 6. Januar 2005 22:37 schrieb george:

On 1/6/05 4:06 PM, "Allen" wrote:

...

SUSE lets you install, then update all patches BEFORE it's even been booted for the first time.

Cool- didn't know this.

Is this document anyplace? (sorry if it's obvious- I never saw it or knew to look for it)

Just install a new SuSE release - you will see it, I promise ;-) Before the very first reboot, YaST asks if the internet connection should be tested and the available updates should be installed. It is also mentioned in the admin handbook in the install chapter (but only in few words, since it is really clear what to do ;-) Regards, Christian Boltz -- "Error Message: Your Password Must Be at Least 18770 Characters and Cannot Repeat Any of Your Previous 30689 Passwords (Q276304)" http://support.microsoft.com/default.aspx?scid=kb;EN-US;q276304