I wonder how SUSE Firewall works. Back in Windows, with ZoneAlarm, when I first install it, it asks me for permission and preconfigures my default browser and mail client to access the net. After that, every new application that tries to access the net or every incoming connection from the net, it asks me for permission. But SUSE Firewall never asks me anything. How do I know which applications it forbids and which it allows? How does it know which applications to forbid and which to allow? I would much prefer a ZoneAlarm-like firewall that tells me what it is doing. Please share your knowledge with me. Thank you. -- Tux #395953 resides at http://samvit.org playing with KDE 3.51 on SUSE Linux 10.0 $ date [] CCE +2006-03-10 W10-5 UTC+0530
Shriramana Sharma wrote:
How do I know which applications it forbids and which it allows?
You study it's configuration - I believe it's available from within YaST.
How does it know which applications to forbid and which to allow?
It comes with a default configuration which it is up to you change as and when needed. /Per Jessen, Zürich
On Friday 10 March 2006 11:25 am, Shriramana Sharma wrote:
I wonder how SUSE Firewall works.
Back in Windows, with ZoneAlarm, when I first install it, it asks me for permission and preconfigures my default browser and mail client to access the net. After that, every new application that tries to access the net or every incoming connection from the net, it asks me for permission.
But SUSE Firewall never asks me anything.
How do I know which applications it forbids and which it allows? How does it know which applications to forbid and which to allow?
I would much prefer a ZoneAlarm-like firewall that tells me what it is doing.
Please note that Linux had a firewall long before there was ever a Zone Alarm. Firewalls generally look at ports and ip addresses. I came across the following in LinuxQuestions.org. Constructing "ZoneAlarm for Linux"? In any case, there is a much different philosophy here. <http://www.linuxquestions.org/linux/blog/unSpawn/2006-02-02/Constructing_ZoneAlarm_for_Linux> -- Jerry Feldman <gaf@blu.org> Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9
Am Freitag, 10. März 2006 17:25 schrieb Shriramana Sharma:
I wonder how SUSE Firewall works.
Back in Windows, with ZoneAlarm, when I first install it, it asks me for permission and preconfigures my default browser and mail client to access the net. After that, every new application that tries to access the net or every incoming connection from the net, it asks me for permission.
But SUSE Firewall never asks me anything.
How do I know which applications it forbids and which it allows? How does it know which applications to forbid and which to allow?
I would much prefer a ZoneAlarm-like firewall that tells me what it is doing.
Please share your knowledge with me. Thank you.
I once had a look at this page: http://tuxguardian.sourceforge.net/ it reminds me very much in the functionality of ZoneAlarm. But I've never tried it, have no idea if it runs with the SUSE 10.0 standard kernel... Maybe somebody on the list has some experiences and will tell us - or if you try it, give feedback here, please. As much as I understand it (and I don't understand very much :-) ) the SUSE-firewall doesn't care abaout which application is using a specific port, so in my opinion it could easily be possible for a maleficent program to get an internet connection. But I may be completely wrong, of course However, your question leads to an interesting topic and I would appreciate posts of people who know more about how to secure a PC... Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On Friday 10 March 2006 18:05, Daniel Bauer wrote:
As much as I understand it (and I don't understand very much :-) ) the SUSE-firewall doesn't care abaout which application is using a specific port, so in my opinion it could easily be possible for a maleficent program to get an internet connection.
maleficient? Please tell me you got that from babelfish :) Yes it's easy for a program to get internet access in linux, SuSEfirewall2 won't block outgoing connections by default. If you worry about these things, you might want to look at AppArmor, which is included by default in 10.0 and can block much more than just network access zonealarm isn't exactly the solution. It's not too difficult to defeat, so the only thing you get from it is a false sense of security. If you're worried about outgoing connections, the only real solution is to only run software you trust. -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On 3/12/06, Anders Johansson <andjoh@rydsbo.net> wrote:
maleficient? Please tell me you got that from babelfish :)
http://www.thefreedictionary.com/dict.asp?Word=maleficient ;-)
On Sunday 12 March 2006 21:43, Peter Van Lone wrote:
On 3/12/06, Anders Johansson <andjoh@rydsbo.net> wrote:
maleficient? Please tell me you got that from babelfish :)
I know what it means, but it's not exactly in common usage now is it :) -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
Monday, 13 March 2006 02:21 samaye, Anders Johansson alekhiit:
I know what it means, but it's not exactly in common usage now is it :)
I thought it would be clear. It's the antonym to beneficient. Like bona fide vs male fide... -- Tux #395953 resides at http://samvit.org playing with KDE 3.51 on SUSE Linux 10.0 $ date [] CCE +2006-03-17 W11-5 UTC+0530
On Sun, 2006-03-12 at 21:36 +0100, Anders Johansson wrote:
On Friday 10 March 2006 18:05, Daniel Bauer wrote:
As much as I understand it (and I don't understand very much :-) ) the SUSE-firewall doesn't care abaout which application is using a specific port, so in my opinion it could easily be possible for a maleficent program to get an internet connection.
maleficient? Please tell me you got that from babelfish :)
Yes it's easy for a program to get internet access in linux, SuSEfirewall2 won't block outgoing connections by default. If you worry about these things, you might want to look at AppArmor, which is included by default in 10.0 and can block much more than just network access
zonealarm isn't exactly the solution. It's not too difficult to defeat, so the only thing you get from it is a false sense of security. If you're worried about outgoing connections, the only real solution is to only run software you trust.
http://www.theinquirer.net/?article=29157 It seems an appropriate segue given your assessment of the product.
On Sunday 12 March 2006 01:01 pm, Mike McMullin wrote:
zonealarm isn't exactly the solution. It's not too difficult to defeat, so the only thing you get from it is a false sense of security. If you're worried about outgoing connections, the only real solution is to only run software you trust.
http://www.theinquirer.net/?article=29157
It seems an appropriate segue given your assessment of the product.
I know I'm going to get plonked by the off topic police, but that is one interesting article. And to think that Cisco included (at least in my version) Zone Alarm in their router VPN client software. -- kai - www.perfectreign.com www.livebeans.com - the new NetBeans community 43...for those who require slightly more than the answer to life, the universe and everything.
Am Sonntag, 12. März 2006 21:36 schrieb Anders Johansson:
On Friday 10 March 2006 18:05, Daniel Bauer wrote:
As much as I understand it (and I don't understand very much :-) ) the SUSE-firewall doesn't care abaout which application is using a specific port, so in my opinion it could easily be possible for a maleficent program to get an internet connection.
maleficient? Please tell me you got that from babelfish :)
no, from leo.org... ;-) b.t.w. what would be the correct word for what I intended to say?
Yes it's easy for a program to get internet access in linux, SuSEfirewall2 won't block outgoing connections by default. If you worry about these things, you might want to look at AppArmor, which is included by default in 10.0 and can block much more than just network access
zonealarm isn't exactly the solution. It's not too difficult to defeat, so the only thing you get from it is a false sense of security. If you're worried about outgoing connections, the only real solution is to only run software you trust.
Of course, and I guess it's not so easy to install a working program on Linux that was sent to me per e-mail for example, as it is on Win, especially if I receive e-mail as a unser (not as root) and don't open every attachement or html-e-mail. But as a quite stupid user that I am - at least in regard to computer tech :-) - I'd apprecieate if I could somehow close my PC not only from outside-in but also from inside-out and let only pass those programs to which I explicitely give permission. That was, was ZoneAlarm promised to do - and, of course, I am not really surprised to read, that it actually does other things, too. This seems to be quite common in the M$-space and is _one_ of the great advantages of open source software. However I am still interested in learning what other (more skilled) users do to protect their PC's.... ...and forgive me to choose inappropriate words from the list given by leo.org when trying to translate to something near English :-) Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On 3/13/06, Daniel Bauer <linux@daniel-bauer.com> wrote:
That was, was ZoneAlarm promised to do - and, of course, I am not really surprised to read, that it actually does other things, too. This seems to be quite common in the M$-space and is _one_ of the great advantages of open source software.
However I am still interested in learning what other (more skilled) users do to protect their PC's....
Run a firewall like SuSEFirewall. THe default setup should protect you 10 times better than what you are protected on your Windows box. You have to take into account that Linux is NOT Windows and it does not work in the same way, therefore you cannot take the same approach towards it than what you are used to on Windows. The fact that Linux gives you similar functionality to what Windows does, does not mean that it works the same way. I have been running linux systems excusively since 2001 and I only set up my FIrewall. Have never had any problems. I can see the bastards atacking my machines, but they don't come through. I do monitor my logs on a regular basis. I enable logdigest on my servers that are connected to the net and I configure it to mail me every hour, so I can see relatively quickly if something goes wrong. If you are really woried about your own machine turning on you and 'phoning home' or something, then I would suggest that you look at AppArmour to make sure only authorised applications can run on the machine. But I only see this as valuable when you have other users also using your system. Then, you can also run tools like chkrootkit to make sure somebody did not install a rootkit on your machine. The Windows phenomena has managed to create a false understanding of how computers work. Take the whole virus thing for instance. Most people think that virus protection is part of every computer, but the truth is that viruses are mainly a Microsoft thing. Other operating systems has been designed in such a way that it is very difficult for a virus to live on it. Now the problem is that anti-virus companies are trying to cash in on Linux also, by trying to convince people that they need anti-virus software for Linux also. What they are doing is that they are actually creating a false sense of security under Linux newbies, because they are taking the focus off the real points of attack against Linux and UNIX systems. Becasue the design is different from Windows, you should look rather at physical attacks from outside than looking at viruses and spyware doing stuff from inside. If you have a Linux system that has been compromised with spyware or a virus, then you have muxh bigger problems, because for that to happen, your system are open to the whole wide world and anybody can come it. Rather focus on a good firewall, blocking connection attempts from outside, good passwords, check your log files and look for rootkits. THat would be my advice. PS: Sorry for the long post, but I tend to get carried away on these subjects, because I feel people are getting a false sense of security because they treat linux like Windows and do not focus on the correct areas... -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On Monday 13 March 2006 7:03 am, Andre Truter wrote:
Run a firewall like SuSEFirewall. THe default setup should protect you 10 times better than what you are protected on your Windows box.
You have to take into account that Linux is NOT Windows and it does not work in the same way, This is a true statement. I think that the OP wanted something that would make his transition comfortable.
While Linux is inherently safer, it still has some vulnerabilities. In Windows, one of the ways a virus can attack is by replacing a common application. Additionally, spyware also can easily be installed on Windows. The Zone Alarm strategy is to block outgoing traffic unless specifically approved by the user. The Linux strategy is much more integrated into the kernel since Linux has had firewall code for 10 years. But, it does not hurt to add a Zone Alarm type of firewall to Linux if that is what one wants. -- Jerry Feldman <gaf@blu.org> Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9
On 3/13/06, Jerry Feldman <gaf@blu.org> wrote:
On Monday 13 March 2006 7:03 am, Andre Truter wrote:
Run a firewall like SuSEFirewall. THe default setup should protect you 10 times better than what you are protected on your Windows box.
You have to take into account that Linux is NOT Windows and it does not work in the same way, This is a true statement. I think that the OP wanted something that would make his transition comfortable.
While Linux is inherently safer, it still has some vulnerabilities. In Windows, one of the ways a virus can attack is by replacing a common application. Additionally, spyware also can easily be installed on Windows. The Zone Alarm strategy is to block outgoing traffic unless specifically approved by the user. The Linux strategy is much more integrated into the kernel since Linux has had firewall code for 10 years. But, it does not hurt to add a Zone Alarm type of firewall to Linux if that is what one wants.
I tend to disagree. I can write the OP a nice little tool that will do what ZoneAlarm does, monitor outgoing traffic and ask the user when an app wants to connect the outside, but that will only give him a false sense of security, because he is applying Windows tactics to Linux, so he is looking for the problems in the wrong place. This is my whole point with my rant. Windows teach us to look out for spyware and viruses, so we apply that to Linux also. We look for the same type of vulnerabilities, while the system is designed different and has different vulnerabilities. It is like guarding the door to the stable, while the castle's main gates are wide open. I think it is better for the OP to rather try and understand what the vulnerabilities in Linux is and to use the appropriate tools for Linux. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
tend to disagree. I can write the OP a nice little tool that will do what ZoneAlarm does, monitor outgoing traffic and ask the user when an app wants to connect the outside, but that will only give him a false sense of security, because he is applying Windows tactics to Linux, so he is looking for the problems in the wrong place.
This is my whole point with my rant. Windows teach us to look out for spyware and viruses, so we apply that to Linux also. We look for the same type of vulnerabilities, while the system is designed different and has different vulnerabilities.
It is like guarding the door to the stable, while the castle's main gates are wide open.
I think it is better for the OP to rather try and understand what the vulnerabilities in Linux is and to use the appropriate tools for Linux. I don't really disagree with you. One security guy I know uses the slogan "Iron doors and paper windows". However, we also want him to be able to
On Monday 13 March 2006 9:09 am, Andre Truter wrote: transition comfortably. -- Jerry Feldman <gaf@blu.org> Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9
I tend to disagree. I can write the OP a nice little tool that will do what ZoneAlarm does, monitor outgoing traffic and ask the user when an app wants to connect the outside, but that will only give him a false sense of security, because he is applying Windows tactics to Linux, so he is looking for the problems in the wrong place.
A firewall tool that will pop-up when disallowed traffic is detected and ask if you want to permit it would be EXTREMELY handy, for lots of reasons other than spyware/whatnot. It would make running a workstation with good firewall settings much more convenient - java applets, various apps, etc... may want to make perfectly legitimate network connections that a user or the administrator did not forsee.
Thanks Andre, for informative explanation. Am Montag, 13. März 2006 13:03 schrieb Andre Truter:
On 3/13/06, Daniel Bauer <linux@daniel-bauer.com> wrote:
That was, was ZoneAlarm promised to do - and, of course, I am not really surprised to read, that it actually does other things, too. This seems to be quite common in the M$-space and is _one_ of the great advantages of open source software.
However I am still interested in learning what other (more skilled) users do to protect their PC's....
Run a firewall like SuSEFirewall. THe default setup should protect you 10 times better than what you are protected on your Windows box.
I do, also tried services from some webpages (can't remember which one) that tried to find insecure "wholes", but they couldn't even find out, what system I am using... :-)
You have to take into account that Linux is NOT Windows and it does not work in the same way,
this is what we all are very happy about!
therefore you cannot take the same approach towards it than what you are used to on Windows. The fact that Linux gives you similar functionality to what Windows does, does not mean that it works the same way.
I have been running linux systems excusively since 2001 and I only set up my FIrewall. Have never had any problems. I can see the bastards atacking my machines, but they don't come through. I do monitor my logs on a regular basis.
I enable logdigest on my servers that are connected to the net and I configure it to mail me every hour, so I can see relatively quickly if something goes wrong.
I'll have to find out what "logdigest" is, sounds interesting
If you are really woried about your own machine turning on you and 'phoning home' or something, then I would suggest that you look at AppArmour to make sure only authorised applications can run on the machine. But I only see this as valuable when you have other users also using your system.
I think so too - and probably setting up AppArmour is a bit too complicated with the knowledge I have so far...
Then, you can also run tools like chkrootkit to make sure somebody did not install a rootkit on your machine.
I've installed chkrootkit, just out of curiosity, but I'm gonna search google about it first, because Yast says, I'd better run this from a security system than from the running system... However, on Win I "installed" a rootkit once just by inserting an *legally bought* Sony-Music-CD (last time in my life, I bought a music CD!) - and I have no idea if something like that could happen with Linux, too, because big companies absolutely do not respect my privacy and have a lot of criminal energy and resources, for sure...
The Windows phenomena has managed to create a false understanding of how computers work. Take the whole virus thing for instance. Most people think that virus protection is part of every computer, but the truth is that viruses are mainly a Microsoft thing. Other operating systems has been designed in such a way that it is very difficult for a virus to live on it. Now the problem is that anti-virus companies are trying to cash in
I have never run a anti-virus program on Windows, because I thought this is only money-making. As I did not use Outlook, but Eudora, turned html-view and automatic downloading off and only opened attachements I knew what they are. I never had any problems.
on Linux also, by trying to convince people that they need anti-virus software for Linux also. What they are doing is that they are actually creating a false sense of security under Linux newbies, because they are taking the focus off the real points of attack against Linux and UNIX systems. Becasue the design is different from Windows, you should look rather at physical attacks from outside than looking at viruses and spyware doing stuff from inside. If you have a Linux system that has been compromised with spyware or a virus, then you have muxh bigger problems, because for that to happen, your system are open to the whole wide world and anybody can come it.
Rather focus on a good firewall, blocking connection attempts from outside, good passwords, check your log files and look for rootkits.
THat would be my advice.
PS: Sorry for the long post, but I tend to get carried away on these subjects, because I feel people are getting a false sense of security because they treat linux like Windows and do not focus on the correct areas...
Glad to receive "long explanations", because I often just don't understand pure "programmer slang", and I guess I'm not the only one. So thanks again. Daniel
-- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za
~ A dinosaur is a salamander designed to Mil Spec ~
-- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On 13/03/06, Daniel Bauer <linux@daniel-bauer.com> wrote:
However, on Win I "installed" a rootkit once just by inserting an *legally bought* Sony-Music-CD (last time in my life, I bought a music CD!) - and I have no idea if something like that could happen with Linux, too, because big companies absolutely do not respect my privacy and have a lot of criminal energy and resources, for sure...
Yes, this was the subject of a rather embarassing press hounding for Sony.
I have never run a anti-virus program on Windows, because I thought this is only money-making. As I did not use Outlook, but Eudora, turned html-view and automatic downloading off and only opened attachements I knew what they are.
Ah, not good. You will sooner rather than later get a virus on a Windows tin this way. There are just too many vulnerabilities inherent in the Microsoft operating system. You do not need to be running e-mail or a browser to get infected - with Windows. One of the latest was transmitted via MS Media Player (I don't know the full details). If you have to use MS Windows then try the free A/V software from www.grisoft.com (AVG anti virus). -- ============================================== I am only human, please forgive me if I make a mistake it is not deliberate. ============================================== Xmas may be over but, PLEASE DON'T drink and drive you'll make it to the next one that way. Kevan Farmer Linux user #373362 Cheslyn Hay Staffordshire WS6 7HR
On 3/13/06, Daniel Bauer <linux@daniel-bauer.com> wrote:
However, on Win I "installed" a rootkit once just by inserting an *legally bought* Sony-Music-CD (last time in my life, I bought a music CD!) - and I have no idea if something like that could happen with Linux, too, because big companies absolutely do not respect my privacy and have a lot of criminal energy and resources, for sure...
Now this is where Windows and Linux differs. In order for something like this to happen on Linux, you need to insert the CD, then log in as root user on your machine, then mount the CD and then run the rootkit installer from the CD. So, you basically need to install the rootkit yourself. Someone can install a rootkit on your machine over the network, by exploiting a known vulnerability of a specific piece of software on your machine, but they need to be able to connect to a port on your machine from outside (That is where the firewall comes in) So, let's say for example that the telnetd program has a vulnerability. Now the vulnerability will only exist in a specific version or range of versions of the telnetd program and it is normally patched soon after the vulnerability has been discovered. But let's say that you do not update your machine regularly and you are running an old version of telnetd that still has the vulnerability. Telnetd listens on port 23 on your machine. So, Mr CR Acker is scanning for machines with port 23 open and discovers yours. He then runs a script that will contact your machine and access port 23 and then send a certain command to that port. The command (or stream of data) is designed to exploit the vulnerability in your version of telnetd. It works and your telnetd cracks up and allows Mr Acker to access your machine as root user via the telnet port. So he uploads his rootkit and installs it. I am not a security expert, but as far as I know, this is basically how a UNIX/Linux system can be compromised. The experts can correct me and or expand a bit on it. So, you can see that to get malicious software onto a Linux box requires that a number of things needs to be in place: 1) You need to have the correct version of the vulnerable software installed. 2) The vulnerable software needs to be running and listening on an Internet port 3) Your firewall have to allow access to that port from outside. Taking into account that most vulnerabilities on OSS software are detected and fixed by the community or developers long before Mr CR Acker does, and you need to have your firewall set up to allow access to the application, you can see that it is quite difficult to get into a box that is properly maintained. The attacker also needs to get root access to your machine to do any real harm. There are a lot of other design issues that makes Linux very virus-unfriendly. It is also very un likely that you can get a rootkit or any malicious software installed by just inserting a CD, as Linux systems normally do not run anything on a CD by itself. KDE and GNOME do have the capability to do so, if it is set up to do it, but then it is run as a normal user and not root (except if the user is stupid enough to run a desktop as root and in that case he/she deserves what they get)
I have never run a anti-virus program on Windows, because I thought this is only money-making. As I did not use Outlook, but Eudora, turned html-view and automatic downloading off and only opened attachements I knew what they are. I never had any problems.
The strategy of not using Outlook and IE is good. I think most of the virus problems are caused and sustained by those two apps.. Fortunately wwe do not have them on Linux. :-) To come back to the ZoneAlarm thing. I have gkrellm running on all my desktops, so I can always see what the CPU, network and disk usage is (together with a number of other things). I can immediately see if my network, CPU or disk usage is not what I expect it to be and then I use tools like ps and netstat to see what is doing stuff on my machine that I do not expect. I suppose this is my way of doing what ZoneAlarm is doing. I just approach it from a UNIX perspective. :-) -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On Monday 13 March 2006 05:55, Andre Truter wrote:
To come back to the ZoneAlarm thing. I have gkrellm running on all my desktops, so I can always see what the CPU, network and disk usage is (together with a number of other things).
I'd like to get gkrellm running on my Suse 10.0 system. So I downloaded gkrellm-2.2.5.tar.gz untared it and ran 'make', following the install instructions and got this error as user and root: (cd src && make gkrellm) make[1]: execvp: ./configure: Permission denied make[1]: Entering directory `/home/myhome/bin/gkrellm-2.2.5/src' grep: configure.h: No such file or directory grep: configure.h: No such file or directory grep: configure.h: No such file or directory grep: configure.h: No such file or directory cc -Wall -O2 -I.. `pkg-config --cflags gtk+-2.0 gthread-2.0` -DENABLE_NLS -DLOCALEDIR=\"/usr/local/share/locale\" -c -o main.o main.c In file included from main.c:23: gkrellm-private.h:22:23: error: configure.h: No such file or directory make[1]: *** [main.o] Error 1 make[1]: Leaving directory `/home/myhome/bin/gkrellm-2.2.5/src' make: *** [all] Error 2 This is where the problem starts: make[1]: execvp: ./configure: Permission denied. Is 'make' trying to make configure.h here? Why is permission denied--even as root? What does execvp mean? Thanks, Jerome
Am Dienstag, 14. März 2006 09:28 schrieb Susemail:
I'd like to get gkrellm running on my Suse 10.0 system. So I downloaded gkrellm-2.2.5.tar.gz untared it and ran 'make', following the install instructions and got this error as user and root:
Why don't you just use Yast to install a rpm? I have gkrellm 2.2.7-2 istalled and running without any problems... Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On Monday 13 March 2006 23:05, Daniel Bauer wrote:
Am Dienstag, 14. März 2006 09:28 schrieb Susemail:
I'd like to get gkrellm running on my Suse 10.0 system. So I downloaded gkrellm-2.2.5.tar.gz untared it and ran 'make', following the install instructions and got this error as user and root:
Why don't you just use Yast to install a rpm? I have gkrellm 2.2.7-2 istalled and running without any problems...
Daniel
-- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
I tried Yast first. I got "No Results". What installation source are you using? Jerome
Am Mittwoch, 15. März 2006 04:59 schrieb Susemail:
Why don't you just use Yast to install a rpm? I have gkrellm 2.2.7-2 istalled and running without any problems...
I tried Yast first. I got "No Results". What installation source are you using? Jerome
packman.iu-bremen.de/suse/10.0/ ftp.uni-erlangen.de/pub/Linux/MIRROR.suse/pub/suse/i386/supplementary/KDE/update_for_10.0/yast-source/ ftp.uni-erlangen.de/mirrors/opensuse/distribution/SL-10.0-OSS/inst-source/ ftp.uni-erlangen.de/mirrors/opensuse/distribution/SL-10.0-OSS/inst-source-java/ ftp.uni-erlangen.de/mirrors/suse/pub/suse/i386/10.0/SUSE-Linux10.0-GM-Extra/ I am sorry, but I don't know from which one of these sources the gkrellm rpm comes... When I switch each one of these individually to "on" and the others to "off" (as installation source), I don't see an available version of gkrellm in Yast, too. *) But when I switch all of these sources to "on" gkrellm is there: available version 2.2.7-2. *) Don't know if I did something wrong, when setting these sources individually to on or off, didn't have much time, though. But at least I can confirm that gkrellm is there when I use all those sources together... Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On Wednesday 15 March 2006 04:22, Daniel Bauer wrote:
I am sorry, but I don't know from which one of these sources the gkrellm rpm comes
Install and use "pin" to find this out: carlh@linux:~> pin gkrellm grepping /var/lib/pin/ARCHIVES.gz ... please wait pin 0.34 - package info for gkrellm ------------------------------------------------------------------ *** no rpm named gkrellm installed ------------------------------------------------------------------ ------------------------------------------------------------------ *** zgrep gkrellm /var/lib/pin/ARCHIVES.gz ------------------------------------------------------------------ ./DVD1/suse/i586/kdeutils3-3.4.2-6.i586.rpm: -rw-r--r-- 1 root root 1102 May 23 14:09 /opt/kde3/share/apps/ksim/themes/ksim/gkrellmrc ./DVD1/suse/i586/kdeutils3-3.4.2-6.i586.rpm: -rw-r--r-- 1 root root 1102 May 23 14:09 /opt/kde3/share/apps/ksim/themes/ksim/gkrellmrc_ksim ./DVD1/suse/i586/vim-6.3.84-2.i586.rpm: -rw-r--r-- 1 root root 4342 Sep 13 03:26 /usr/share/vim/vim63/syntax/gkrellmrc.vim ./DVD1/suse/i586/kdeaccessibility3-3.4.2-6.i586.rpm: -rw-r--r-- 1 root root 3337 Jul 20 18:36 /opt/kde3/share/icons/mono/scalable/apps/gkrellm.svgz ./DVD1/suse/i586/kvim-6.2.14-121.i586.rpm: -rw-r--r-- 1 root root 4342 Sep 13 04:38 /opt/kde3/share/vim/vim62/syntax/gkrellmrc.vim ./DVD1/suse/noarch/susehelp-2005.08.01-2.noarch.rpm: -rw-r--r-- 1 root root 253 Sep 9 20:54 /usr/share/susehelp/meta/Administration/System/gkrellm.desktop ./DVD1/suse/noarch/gnome2-SuSE-10.0-9.noarch.rpm: drwxr-xr-x 2 root root 0 Sep 14 13:50 /opt/gnome/share/themes/6nome/gkrellm2 <snipped the rest> regards, Carl
On Tuesday 14 March 2006 09:28, Susemail wrote:
Is 'make' trying to make configure.h here?
Yes
Why is permission denied--even as root?
Most likely because the partition where you have /home is mounted with the 'noexec' flag, which disallows any programs from being executed on it. Edit /etc/fstab to remove it, and either remount /home or reboot
What does execvp mean?
execute a program, sending it an array of variables, and using $PATH to search for the program. It just means make is trying to run a program, in this case 'configure' -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On Tuesday 14 March 2006 09:27, Anders Johansson wrote:
On Tuesday 14 March 2006 09:28, Susemail wrote:
Is 'make' trying to make configure.h here?
Yes
Why is permission denied--even as root?
Most likely because the partition where you have /home is mounted with the 'noexec' flag, which disallows any programs from being executed on it. Edit /etc/fstab to remove it, and either remount /home or reboot
Hi Anders, Here is the relevant line: /dev/hda3 /home auto defaults,user 0 0 I don't know how to check if 'defaults' includes the 'noexec' flag or how to remove it if it does.
What does execvp mean?
execute a program, sending it an array of variables, and using $PATH to search for the program.
It just means make is trying to run a program, in this case 'configure'
Thanks Anders, Jerome
-- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On Wednesday 15 March 2006 00:26, Susemail wrote:
Here is the relevant line: /dev/hda3 /home auto defaults,user 0 0
I don't know how to check if 'defaults' includes the 'noexec' flag or how to remove it if it does.
'defaults' doesn't, but 'user' does. Just change that from defaults,user to just defaults and everything should be fine again. -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On Tuesday 14 March 2006 13:42, Anders Johansson wrote:
On Wednesday 15 March 2006 00:26, Susemail wrote:
Here is the relevant line: /dev/hda3 /home auto defaults,user 0 0
I don't know how to check if 'defaults' includes the 'noexec' flag or how to remove it if it does.
'defaults' doesn't, but 'user' does. Just change that from defaults,user to just defaults and everything should be fine again.
-- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
I changed the line: /dev/hda3 /home auto defaults 0 0 but still the same result: # make (cd po && make all) make[1]: Entering directory `/home/myhome/bin/gkrellm-2.2.5/po' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/myhome/bin/gkrellm-2.2.5/po' (cd src && make gkrellm) make[1]: execvp: ./configure: Permission denied make[1]: Entering directory `/home/myhome/bin/gkrellm-2.2.5/src' grep: configure.h: No such file or directory grep: configure.h: No such file or directory grep: configure.h: No such file or directory grep: configure.h: No such file or directory cc -Wall -O2 -I.. `pkg-config --cflags gtk+-2.0 gthread-2.0` -DENABLE_NLS -DLOCALEDIR=\"/usr/local/share/locale\" -c -o main.o main.c In file included from main.c:23: gkrellm-private.h:22:23: error: configure.h: No such file or directory make[1]: *** [main.o] Error 1 make[1]: Leaving directory `/home/adriel/bin/gkrellm-2.2.5/src' make: *** [all] Error 2 Jerome
On Thursday 16 March 2006 17:53, Anders Johansson wrote:
On Friday 17 March 2006 03:55, Susemail wrote:
I changed the line: /dev/hda3 /home auto defaults 0 0
but still the same result:
Did you reboot afterwards?
No. And thanks for ' rpm -qa kde\* ' and 'locale'. Jerome
-- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
Someone wrote:
Run a firewall like SuSEFirewall. THe default setup should protect you 10 times better than what you are protected on your Windows box.
I enable logdigest on my servers that are connected to the net and I configure it to mail me every hour, so I can see relatively quickly if something goes wrong.
---- The above says it all: instead of having an interactive tool that requires the interactive user's permission, most Linux users have to rely on a "log file" -- that _retrospectively_ will tell you what has happened on your box. It doesn't allow you to permit/deny traffic in real time, nor does it allow real-time interactive firewall rule construction based on usage. It isn't about the relative strengths of security but about real-time interactivity. Linux is poor in real-time, interactive controls and monitoring. I find the discussion about how the user should or shouldn't be doing things amusing -- i.e. "Dear ex-windows user: um, we don't have the features and abilities you want, so we want to educate you on what you think you should want and give you lots of reasons why what you want doesn't really protect you (which is what we wanted to tell you what you really wanted)." Bleh! *Differences of Win vs. Linux Security model* There is a fundamental difference in the security model and tools available for windows and for linux. With Windows, you only have the concept of one active user at the desktop -- and that user usually "owns" the computer and usually has that computer to themselves. Such a design isn't where Linux has come from. Linux is descended (in thought and design concept) from unix -- which was designed for multi-user computer sharing -- usually with no one at the console. It wasn't designed for attended monitoring 24x7, whereas Windows is designed from the point of the "single-user", who is usually in attendance when the computer is being used. In the Windows philosophy of _past_, nothing should happen on your computer unless you "instigate it". NOTE: there is a difference between the historic use of 1-windows user/computer and later editions of Windows used as a server. Even Windows as a server isn't designed as *nix has been. Multi-user *nix was the norm and it has been adapted for single-user use. With windows, it is the opposite -- it was designed for solo, non-networked use and has been adapted for network use. Everything about Windows was designed for "interoperability" with other Windows computers in a "non-threat" environment. *nix was designed for separating users to allow multiple "academics" to share information, but still keep them separate. It heralds back to "Multics" that was designed with security in mind in the 1960's, but I digress. Windows in its current incarnation (XP as version 5.1 of "NT") is similar in design to many current *nix implementations. NT was _supposedly_ descended from mainframe OS principles. Like *nix, NT supports multiple users. Like *nix NT supports levels of privileged code. NT has superior security features to many *nix implementations, however, it's insecure by *configuration*. NT (as used for Windows XP sold for individual computers) is still configured for compatibility with the older, single-user Win9x systems. It is the default configuration for usability and compatibility that makes WinNT based systems less secure than their *nix counterparts. Most NT applications require "root access" to install. Many NT applications install system drivers as part of their typical install. At least WinNT has the concept of 2 driver privilege levels: Ring 0 & Ring 1 (which is different from user processes that operate at Ring 3). Few, if any *nix systems use more than the 2-ring security model. Single process capabilities have been present in NT since it's 4.x days -- likely 3.x (though I had no experience w/such). Linux had process capabilities so screwed up that they were complete disabled in 2.2.16 (~2000) as a critical security flaw because the implementors and reviewers of capabilities in linux, /at the time/, had a fundamental lack of understanding of how they should work. One of the worst offenders is *non-system software* -- _games_ in Windows. How many games try to install "copy-protection" into a user's computer by attempting direct access to the hardware and/or by installing specialized drivers? Such applications are uncommon in *nix. In historic *nix systems, users _couldn't_ install applications requiring direct-hardware access. I could go on for ever on the differences in design, but suffice it to say: if the linux desktop "shell" required constant "root access" to install and run hardware, and if it provided all of the "automatic" features of Win XP, it would be just as insecure (perhaps more so) as Windows. To get back to the Original Poster's article -- and some people's claim that *nix doesn't provide real-time monitoring and permission grants to interactive users only shows the lack of flexibility of the *nix model. Some claim it would be "possible to provide the same functionality in *nix". I challenge you to do so with the same constraints on easy of install and control for what ever user is using the desktop. It won't be easy: You will have to: 1) identify what process is attempting unauthorized access. (remember, the process may be owned by any user -- not just the "logged in user). 2) display a high priority popup on the ... well...who? The primary console user's terminal? What if someone is running "Citrix" or logged in via Terminal Services? Who gets the message? In Windows, it is the console user. 3) Allow the Console user to decide if the "arbitrary process" (good chance it isn't owned by the user) should be granted the appropriate access. Same with incoming connections -- they are probably going into some "system process" (response to "bind/dns", incoming "email" handled by sendmail, etc). 4) Allow the "unprivileged" user to decide on network access for some non-user owned (likely, system level) process. Ex. I just use a browser to look at a site. Say it is configured to use a proxy (squid). I see a message that squid wants an outside line. Do I allow it? Is it my browser? If I do allow it, squid is allowed for all users and all processes -- it isn't just my browsing. Suppose I choose to allow it - some firewall rule (running with system privileges) needs to be modified. This means my "interactive popup" is allowed to modify system firewall tables? That breaks the fundamental user-superuser separation on *nix. 5) To modify firewall rules, the user must (at least temporarily) be running with system (root) privileges. You've violated *nix's main protection. 6) If the *nix system is running "X", more than one user may be running a console session. How will you trace what "outgoing connection attempt" is related to which user (if any). How will these users decide on which non-user utils get access? Bottom line: I submit that you can't require instantaneous user interaction on *nix and have the system function "normally". Most network activity on a *nix system happens on *behalf* of a user -- maybe no specific user, but just as part of making the *nix system responsive and robust. You can't provide something as convenient as "ZoneAlarm" on Linux without _alot_ of work and a violation of the *nix system design. If you create the support structure necessary to support such "automation", including the ability to click on mail attachments like ".pdf" and have them auto-open acrobat, you create the same opportunity for "holes" in *nix as in WinNT bases systems. Do you need more examples? Note -- manual, human-based *logfile review* is _unacceptable_. It is _reactive_, time consuming and error prone. In the one-hour between being mailed "logs", a well qualified hacker could be in, plant a trojan and clean up the logs to remove a trace of their being there. If you have to sleep or go on a vacation for any number of days, you have even less responsiveness to intrusions. Sorry, but in my opinion, Linux is considerably more lacking in real-time, interactive security response tools that talk to the active user. In the absence of a real-time, at the console user, traffic is *blocked*. This is very *untrue* for the average *nix system, where systems are expected to run "unattended". None of this should be taken to mean that Linux, as used today is less secure than Windows -- but it easily could be if it was _configured_ to be as easily interoperable as WinNP is (by requirement of legacy compatibility) to be. It should be noted that the main hindrance to good security is _usability_. The less usable a security system is, the more likely users are to find a way to work around it. The presence of an easy-to-use, interactive, graphical firewall configuration tool that allows real-time monitoring and feedback -- so a user can see that if an application wants web access, they get immediate prompting that tells them the application is attempting network access, informs them what application(s) are attempting what type of internet access. Post examination of log files doesn't provide that type of interactive training. FYI -- I do have linux log files that show me blocked outgoing firewall traffic. It isn't uncommon to see applications (running on Windows through a linux proxy server) to simply and mysteriously "not work". It's only later, if I examine log files and remember what I was doing at the time, do i find that I couldn't watch some "video" because my firewall blocked outgoing ports by my "http-proxy" (squid) to some site. It is rare that I know why the application(s) failed at the time they fail -- there is no interactive message to tell me that a forbidden network traffic type is being automatically blocked. That is way less usable (and useful) than having a popup instantly tell me that my attempt to play some video is accessing some weird port, that isn't in the normal video port range. It's even less easy to "temporarily" allow one specific traffic request through. I.e. - on linux, I'd have to add some firewall rule, go back and run my app, then re-edit the firewall rule to remove the temporary access. **Very** inconvenient. That's not my idea of _usable_ security. Ms. Linda Walsh
Overall comment: Linda, saying something three times in a row doesn't make it true. On Tuesday 21 March 2006 22:55, Linda Walsh wrote:
The above says it all: instead of having an interactive tool that requires the interactive user's permission, most Linux users have to rely on a "log file" -- that _retrospectively_ will tell you what has happened on your box.
It doesn't allow you to permit/deny traffic in real time, nor does it allow real-time interactive firewall rule construction based on usage.
This idealistic talk about real time neglects three important things: firstly, I dare you to show me one single windows user of any experience level who hasn't gone mad at the constant popups from zonealarm and just presses "allow always" to the outbound requests from Internet Explorer, thus completely disabling any and all protection this tool may have given you Secondly, you're assuming that virus writers don't know how to bypass ZoneAlarm. Dangerous assumption In this overlong rant you're also mixing talk of inbound and outbound connections. Well, here's a LART for you: I can put a SUSE box online for a year completely unattended, and I'll put up a cash prize of one million US dollars for anyone gaining access to it. You know how I can be so bold? Because a machine that doesn't accept connections can't be hacked. An out of the box SUSE installation will not listen to external ports. Even ssh is blocked by default. And if a windows user sets up a server on his desktop machine where he is a console user, he will press the "Allow Always" button in ZoneAlarm every bit as much as he would simply open the port in SuSEfirewall2 on a SUSE box
I find the discussion about how the user should or shouldn't be doing things amusing -- i.e. "Dear ex-windows user: um, we don't have the features and abilities you want, so we want to educate you on what you think you should want and give you lots of reasons why what you want doesn't really protect you (which is what we wanted to tell you what you really wanted)." Bleh!
"I want a nuclear bomb so I can get rid of the moles from my back yard" Now now, don't tell this person that a nuke isn't the best way to fight moles, give the man what he wants. right?
To get back to the Original Poster's article -- and some people's claim that *nix doesn't provide real-time monitoring and permission grants to interactive users only shows the lack of flexibility of the *nix model.
Not really, people's claiming it doesn't make it so. It can be done.
1) identify what process is attempting unauthorized access. (remember, the process may be owned by any user -- not just the "logged in user).
AppArmor does this as part of its basic functionality
2) display a high priority popup on the ... well...who? The primary console user's terminal? What if someone is running "Citrix" or logged in via Terminal Services? Who gets the message? In Windows, it is the console user.
This is yet another place where it breaks down, of course. If you're talking about Citrix and Terminal Services then you're not talking about a regular home user. Using ZoneAlarm in a company setting is just silly
3) Allow the Console user to decide if the "arbitrary process" (good chance it isn't owned by the user) should be granted the appropriate access. Same with incoming connections -- they are probably going into some "system process" (response to "bind/dns", incoming "email" handled by sendmail, etc).
Oh yeah, and you'll be spending 90% at least of your day clicking on popup buttons if you're going to require interactive response to IP packets on the level of dns responses. And incoming email handled by sendmail????????? Are you seriously suggesting using ZoneAlarm on a mail server? No way, under any circumstances on any OS
4) Allow the "unprivileged" user to decide on network access for some non-user owned (likely, system level) process. Ex. I just use a browser to look at a site. Say it is configured to use a proxy (squid). I see a message that squid wants an outside line. Do I allow it? Is it my browser? If I do allow it, squid is allowed for all users and all processes -- it isn't just my browsing. Suppose I choose to allow it - some firewall rule (running with system privileges) needs to be modified. This means my "interactive popup" is allowed to modify system firewall tables? That breaks the fundamental user-superuser separation on *nix.
Indeed, and in this model it wouldn't work even on windows.
5) To modify firewall rules, the user must (at least temporarily) be running with system (root) privileges. You've violated *nix's main protection.
Not at all. This isn't the year 2000 anymore. Capabilities do work now
6) If the *nix system is running "X", more than one user may be running a console session. How will you trace what "outgoing connection attempt" is related to which user (if any). How will these users decide on which non-user utils get access?
Simple, they won't. And you won't find many multi-user windows boxes using ZoneAlarm either
Bottom line: I submit that you can't require instantaneous user interaction on *nix and have the system function "normally".
And I submit that in the silly circumstances you picture, you can't do it on any OS Most network activity on
a *nix system happens on *behalf* of a user -- maybe no specific user, but just as part of making the *nix system responsive and robust. You can't provide something as convenient as "ZoneAlarm" on Linux without _alot_ of work and a violation of the *nix system design.
And I put it to you that AppArmor is just that, and done in a way that makes sense even on a multiuser platform
If you create the support structure necessary to support such "automation", including the ability to click on mail attachments like ".pdf" and have them auto-open acrobat
which of course already exists
you create the same opportunity for "holes" in *nix as in WinNT bases systems.
No, those come with scripting, and trust in extensions. Just having a pdf open in acroread won't do any damage, but if acroread suddenly acquired a scripting capability on the level of MSOffice, then yes, it could happen. Also, linux generally looks at a file to determine what it is, so a file.exe.gif won't be misinterpreted
Do you need more examples?
Yes please
Note -- manual, human-based *logfile review* is _unacceptable_. It is _reactive_, time consuming and error prone. In the one-hour between being mailed "logs", a well qualified hacker could be in, plant a trojan and clean up the logs to remove a trace of their being there. If you have to sleep or go on a vacation for any number of days, you have even less responsiveness to intrusions.
Since you mentioned sendmail above, I'm just picturing you sitting by an exchange server, feverishly clicking "yes, allow" every time an incoming email comes in. Does it pay well?
Sorry, but in my opinion, Linux is considerably more lacking in real-time, interactive security response tools that talk to the active user. In the absence of a real-time, at the console user, traffic is *blocked*. This is very *untrue* for the average *nix system, where systems are expected to run "unattended".
So are most windows servers. You really can't mix the server and desktop environments and expect a sane discussion
None of this should be taken to mean that Linux, as used today is less secure than Windows -- but it easily could be if it was _configured_ to be as easily interoperable as WinNP is (by requirement of legacy compatibility) to be.
Nah, interoperability has nothing to do with it. Compatibility in the user experience, to a certain extent (users expect things to behave in a certain way, even if it kills them) but it could be done safely. Sure, things like ActiveX need to die, and the scripting capabilities of certain things should be cut down, or at least placed in a sandbox, but it can be done
FYI -- I do have linux log files that show me blocked outgoing firewall traffic. It isn't uncommon to see applications (running on Windows through a linux proxy server) to simply and mysteriously "not work". It's only later, if I examine log files and remember what I was doing at the time, do i find that I couldn't watch some "video" because my firewall blocked outgoing ports by my "http-proxy" (squid) to some site. It is rare that I know why the application(s) failed at the time they fail -- there is no interactive message to tell me that a forbidden network traffic type is being automatically blocked. That is way less usable (and useful) than having a popup instantly tell me that my attempt to play some video is accessing some weird port, that isn't in the normal video port range.
I lost you. How is any system supposed to determine what is running *on a different machine*? Not gonna work, not on windows, or on linux. If you have a separate firewall, it's not going to be able to decide if it's internet explorer or MYDOOM.EXE requesting outbound access. Also, what is "the normal video port range"? I wasn't aware that outbound had any sort of defined range (other than 1024-65535) either on windows or linux -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On 3/21/06, Linda Walsh <suse@tlinx.org> wrote: [...]
It isn't about the relative strengths of security but about real-time interactivity. Linux is poor in real-time, interactive controls and monitoring.
I disagree. If you tail the log file, you can immediately see what is going on in realtime. What I would agree to is that I don't know of any graphical tools that will show this information to you. What would be handy is a tool that parses the log file or listens for notifications and then show important messages in a display. It should also filter the messages so that you don't get flooded with messages. This is something that can be done relatively easy, but I think the main reason why it has not been done is because the focus of Linux security has been mainly server based, due to the design of the system.
I find the discussion about how the user should or shouldn't be doing things amusing -- i.e. "Dear ex-windows user: um, we don't have the features and abilities you want, so we want to educate you on what you think you should want and give you lots of reasons why what you want doesn't really protect you (which is what we wanted to tell you what you really wanted)." Bleh!
I think you are misunderstanding the thread (or at least my part of the thread). It is not about telling the user that Linux lack the features, etc, it is about getting the user to focus on the right place. It has no value creating tools that make Linux act like Windows if it is misleading the user in the process. The problem is that the bigger threat on a Linux system is not viruses and spyware trying to get outside access, but crackers trying to get access from outside. So, what is the use of giving a user a nice app that acts like a Windows tool, by reporting all outgoing attempts and by doing so, the newbie is focussing on non-existing viruses, while he/she never realise that they are being hacked to pieces. I suggest to rather educate the user to understand the differences in security issues and introduce the user to the appropriate tools, rather than to give the user a false sense of security. [...]
Some claim it would be "possible to provide the same functionality in *nix". I challenge you to do so with the same constraints on easy of install and control for what ever user is using the desktop. It won't be easy:
You will have to:
1) identify what process is attempting unauthorized access. (remember, the process may be owned by any user -- not just the "logged in user).
Yes, with netstat and ps you can determine which process is using a port and who ownes the process.
2) display a high priority popup on the ... well...who? The primary console user's terminal? What if someone is running "Citrix" or logged in via Terminal Services? Who gets the message? In Windows, it is the console user.
Well, the user that has the monitoring tool running. On a sever system it would be the Sys Admin and on a normal desktop it would the the owner of the system. [...] (snipped rest to make mail shorter) The rest of the comments is mixing single-user scenarios with a server scenario and it is assuming that it is important to know who and what is trying to make outbound connections. First, we need to look at single user/server scenarios. Single user scenario: lets say we do think it is important to monitor outgoing connections, then it would only make sense to show each user his/her own connection attempts (applications run by the user that try to establish an outside connection) If you start to look at system processes that initiate access then you move into the server arena. If you run a firewall/gateway/proxy, then you normally don't have a person sitting there authorrising access by clicking yes/no on pop-ups. Does a Windows based firewall/gateway do this? I can just imagine the poor firewall administrator at Microsoft having to authorise each user's attempts to access the web or send mail. Imagine how slow the internet access would be. Now, if you look at your server, you configure your firewalls, proxies, etc to allow certain types of access (inside or out). You should in any case not have normal users working on a firewall. [...]
as part of making the *nix system responsive and robust. You can't provide something as convenient as "ZoneAlarm" on Linux without _alot_ of work and a violation of the *nix system design.
The question is: Why do you want the "ZoneAlarm" functionality on a Linux system? Your problem is not applications trying to access the internet from inside. Your focus areas are access attempts from outside (firewall handles that) and somone breaking into your system and installing a rootkit. (firewall, intrusion detection and checkrootkit) If someone installed a rootkit, then a 'ZoneAlarm' clone will not help much as you can tunnel over port 80 or something. If someone managed to get the level of access to your system to install a rootkit, then they can do basically anything on your system and you are screwed. So, first line of defence is firewall blocking unathorised access. Second line of defence is intrusion detection, like snort. Then, you can also chek for rootkits and unexpected changes in files.
If you create the support structure necessary to support such "automation", including the ability to click on mail attachments like ".pdf" and have them auto-open acrobat, you create the same opportunity for "holes" in *nix as in WinNT bases systems. Do you need more examples?
No, not exactly true. First, a pdf document (or any attachement) will not be executed, so how can it compromise your system? The only way is if there is a vulnerability in acrobat reader or the application you use to open a file with. You cannot 'fool' a *nix system into executing something or opening it with the wrong application by changing the extention, because it looks at the contents of a file to determine it's type and the file has to have executable bit set. Then, if you do manage to get something to execute, it can only do damage to the extent of the priveledges of the user running it, which should not allow it to install anything or damage the system, else something is wrong with the user's privelidges.
Note -- manual, human-based *logfile review* is _unacceptable_. It is _reactive_, time consuming and error prone. In the one-hour between being mailed "logs", a well qualified hacker could be in, plant a trojan and clean up the logs to remove a trace of their being there. If you have to sleep or go on a vacation for any number of days, you have even less responsiveness to intrusions.
If you want an interactive view of what is going on with your network traffic, you can use ethereal to see in realtime exactly what traffic is going where. There are some other tools available to give you an interactive view on your network activity, but the problem is that you cannot sit and watch all the traffic activity and expect to pick up when someone try to attack you. You need intrusion detection software like snort to highlight possible attacks. Look at a tool like sguil (http://sguil.sourceforge.net/), it is a graphical user interface to snort and other tools. It gives a realtime view of possible issues. I actually just stumbled onto squil, but I think it might be exactly the tool that you need. It is in my opinion the 'ZoneAlarm' for *nix. PS: I found another GUI: Razorback (http://www.intersectalliance.com/projects/RazorBack/) -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
Andre Truter wrote:
On 3/21/06, Linda Walsh <suse@tlinx.org> wrote: [...]
It isn't about the relative strengths of security but about real-time interactivity. Linux is poor in real-time, interactive controls and monitoring.
I disagree. If you tail the log file, you can immediately see what is going on in realtime.
Not really. The log is _retrospective_. It tells you what just happened and it it doesn't popup with an interactive message telling you something has happened "out of the ordinary". Zone alarm (and the ilk) tells you what _is_ happening -- allows you to decide what to permit *before* letting it happen, then allows the operation to proceed. With log files, the system already made a decision about what to do, and you are seeing what decision it made "seconds ago" (to borrow from Data's perspective, "an eternity in computer time...").
What I would agree to is that I don't know of any graphical tools that will show this information to you.
What would be handy is a tool that parses the log file or listens for notifications and then show important messages in a display. It should also filter the messages so that you don't get flooded with messages.
---- Again...all retrospective. I don't want to know what happened. I might want my firewall to stop traffic that is out of the ordinary -- not deny it, but pause it, and let me decide what to do. By default, if I'm not there to decide, the network request will timeout.
This is something that can be done relatively easy, but I think the main reason why it has not been done is because the focus of Linux security has been mainly server based, due to the design of the system.
The real-time aspect isn't relatively easy. When something happens at the network layer, there is no tracking to know what program running by what user "instigated" the network traffic.
I find the discussion about how the user should or shouldn't be doing things amusing -- i.e. "Dear ex-windows user: um, we don't have the features and abilities you want, so we want to educate you on what you think you should want and give you lots of reasons why what you want doesn't really protect you (which is what we wanted to tell you what you really wanted)." Bleh!
I think you are misunderstanding the thread (or at least my part of the thread). It is not about telling the user that Linux lack the features, etc, it is about getting the user to focus on the right place.
I have secure systems setup with both Windows and Linux. I don't think it is out of place to want a real-time decision capacity on my linux-based personal computer.
It has no value creating tools that make Linux act like Windows if it is misleading the user in the process. The problem is that the bigger threat on a Linux system is not viruses and spyware trying to get outside access, but crackers trying to get access from outside.
That's no more of a problem on linux than on Windows. It's just that with automation, Windows has more ways to "trick" user applications to open doors for outside crackers.
So, what is the use of giving a user a nice app that acts like a Windows tool, by reporting all outgoing attempts and by doing so, the newbie is focussing on non-existing viruses, while he/she never realise that they are being hacked to pieces.
ZoneAlarm in the firewall defense isn't about viruses. It is about permitting network traffic, either in or out. Making sure no processes are going "out" w/o permission in no way negates ZA's inbound firewall with the same real-time, interactive capabilities. In realtime I can see if someone is pounding my system, or I can see in real time that my printer is sending out network "advertisements" on my local net. I can choose to deny one and allow the other -- as they happen -- not by looking at a log file later. And, I'm sorry -- doing a "tail -f" of a log file is a very poor interactive defense mechanism. One blink and a burst will have things scrolling off the screen. By the time I figure out if the burst was important, it is way after the fact.
Yes, with netstat and ps you can determine which process is using a port and who ownes the process.
--- ??? I don't think so -- only if the network connection is persistent. If it is a UDP packet? There is nothing to look at in those real-time tools. Even if they replot once/second, you can't see the application, ports and addresses of the 100-1000 packets that can come in during 1 second. The event of interest is *over* by the time you bring up ps or netstat -- even if you have netstat running repeatedly in a TTY window (assuming you have screen real-estate to keep such things open while you are watching a movie). With the WinXP method -- the security popup comes up on top of the movie. It demands instant attention *before* it allows the action to complete.
If you start to look at system processes that initiate access then you move into the server arena.
Eh? I'm a single user of my system. My "server" system (which just serves me), right now has 97 processes running -- only 13 under my userid. The computer is just serving me. Even on my WinXP laptop, only 15 out of 27 processes are "owned" by me. On Windows, more things are handled in threads than in separate processes, under threads, only 79 out of 289 belong to me. This isn't a server.
If you run a firewall/gateway/proxy, then you normally don't have a person sitting there authorrising access by clicking yes/no on pop-ups. Does a Windows based firewall/gateway do this?
--- YES, you do (on a windows workstation) Zonealarm is a firewall. It pops up a question dialog for any traffic not explicitly permitted (when properly configured).
I can just imagine the poor firewall administrator at Microsoft having to authorise each user's attempts to access the web or send mail. Imagine how slow the internet access would be.
I'm the only one on my system. There is no other "administrator". It pops up questions to me when I am at the console.
The question is: Why do you want the "ZoneAlarm" functionality on a Linux system? Your problem is not applications trying to access the internet from inside.
Naw...rootkits never happen on linux. Zonealarm protects against *both* incoming and outgoing.
Your focus areas are access attempts from outside (firewall handles that) and somone breaking into your system and installing a rootkit. (firewall, intrusion detection and checkrootkit)
Mostly retrospective. Many breakins in the real world happen because of some "anomalous" traffic going *out* from the system.
If someone installed a rootkit, then a 'ZoneAlarm' clone will not help much as you can tunnel over port 80 or something. If someone managed to get the level of access to your system to install a rootkit, then they can do basically anything on your system and you are screwed.
If they thought of everything. Not alot of pieces of malware, for example, bother to detect proxies.
So, first line of defence is firewall blocking unathorised access. Zonealarm does that. Second line of defence is intrusion detection, like snort. Then, you can also chek for rootkits and unexpected changes in files.
Retrospective and easily fooled.
No, not exactly true. First, a pdf document (or any attachement) will not be executed, so how can it compromise your system? The only way is if there is a vulnerability in acrobat reader or the application you use to open a file with.
Bingo! pdf's, postscript files, even jpg's have had exploits in them that exploited standard applications on the inside.
If you want an interactive view of what is going on with your network traffic, you can use ethereal to see in realtime exactly what traffic is going where.
I want something that pops up a notice anytime any non-permitted program attempts any action that is out of the ordinary. If my "C" compiler attempts to open "/etc/passwd" with write access, or "/etc/shadow" with _any_ permission, I'd like to see that pop up in real time -- not wait for a log review sometime later when the log in question may have been tampered with or deleted.
There are some other tools available to give you an interactive view on your network activity, but the problem is that you cannot sit and watch all the traffic activity and expect to pick up when someone try to attack you.
On Windows, you don't need that -- it only shows you the exceptions, and blocks any traffic, in or out, that isn't explicitly permitted. On my system, for example, no browser (IE, firefox, opera) is able to run javascript or java from any site, unless I have explictly permitted that site through my web-filter. I don't have to worry about visiting some random website that will exploit the latest java[script] or activeX bug -- they are all blocked. If I wished to configure it, each time my "firewall" detected incoming javascript from a website, it could popup a question to ask if I wished to let the javascript through (using a previously built-up "whitelist" of previously approved websites). Barring corruption of "trusted websites", I don't have to worry about downloading trojan script-code. I don't have to run an "intrusion [virus] detection program". It doesn't get that far. Because I can block all network access in or out of my machine on my Windows box, I feel it is more secure than my linux box -- because on linux, something could have snuck-in via a corrupt binary or downloaded patch and I wouldn't know about it for days or longer depending on how well the evidence was buried in a log file. The main reason windows has more security problems than linux is because the defaults on windows-applications are designed for ease of use *over* security. It is often a trade-off. But linux provides *SO MUCH* logging about everything, that it's hard to sort through _everything_ to see what is important. At the very least, custom scripts and filtering are required and that right there puts it beyond most users (like my mom, etc...). linda
On 3/22/06, Linda Walsh <suse@tlinx.org> wrote:
On my system, for example, no browser (IE, firefox, opera) is able to run javascript or java from any site, unless I have explictly permitted that site through my web-filter. I don't have to worry about visiting some random website that will exploit the latest java[script] or activeX bug -- they are all blocked.
OK, Linux don't have things like ActiveX and Javascript can be controlled with the different browsers themselves. FireFox lets you enable or disable javascript and you can tell it to only allow javascript from certain sites. If I wished to configure it, each time my "firewall" detected incoming
javascript from a website, it could popup a question to ask if I wished to let
How does a firewall detect incoming javascript? I suppose the only way to do this is to inspect each HTML file passing through and look for the javascript headers. AFAIK, IPCop has a plugin that allow things like that.
the javascript through (using a previously built-up "whitelist" of previously approved websites). Barring corruption of "trusted websites", I don't have to worry about downloading trojan script-code.
Firefox does this on Linux. I don't have to run an
"intrusion [virus] detection program". It doesn't get that far.
Ummm.. Intrusion Detection systems have nothing to do with viruses. Intrusion detection systems monitors incoming connections and prevent and warn possible breakin attempts. (where the real threat is on linux) Go and read up on snort, it seems to be exactly what you need.
Because I can block all network access in or out of my machine on my Windows box, I feel it is more secure than my linux box -- because on linux, something could have snuck-in via a corrupt binary or downloaded patch and I wouldn't know about it for days or longer depending on how well the evidence was buried in a log file.
First: You can set up your linux firewall to also block both incoming and outgoing traffic. In fact, I can set up my Linux firewall in such a way that my network connection becomes totally inefective. It is as if the network card does not work at all. No traffic flowing. Secondly: How can something sneek in via a corrupt binary via a firewall? You have to download in and install it. How does ZoneAlarm protect you against that? On Linux you have tools like checkrootkit, etc that inspect every file on your system and immediately lets you know if the file was tampered with. AppArmour is also a tool that will let you know immediately if files are acessed without permission. It prevents the access and then notifies you. So it is pro-active.
The main reason windows has more security problems than linux is because the defaults on windows-applications are designed for ease of use *over* security. It is often a trade-off. But linux provides *SO MUCH* logging about everything, that it's hard to sort through _everything_ to see what is important. At the very least, custom scripts and filtering are required and that right there puts it beyond most users (like my mom, etc...).
Well, the idea is that the normal user should not need to worry about security. Linux has been designed in such a way that it looks after itself. You don't need to monitor the security systems. But, I think you need to have a look at squil and snort, as that is basically what you want. It will notify you immediately of any suspect activity on your ports. It does not read log files, it acts the moment the activity is happening on the port, so it is rather pro-active than re-active. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On Wednesday 22 March 2006 02:25, Andre Truter wrote:
But, I think you need to have a look at squil and snort, as that is basically what you want.
No, I think what Linda wants is a way for her to be able to justify downloading and running whatever executable she finds on the net, on the basis of "ZoneAlarm will tell me if it's something bad"
It will notify you immediately of any suspect activity on your ports. It does not read log files, it acts the moment the activity is happening on the port, so it is rather pro-active than re-active.
Proactive means doing something before the fact to prevent its happening in the first place. In this case, it means having a sane configuration. There are two scenarios, server and desktop. When you run servers listening on incoming connections from the internet, you need to let that happen in your packet filter, or you will very quickly get bored. Interactive approval of packets is simply not an option. Security here is complex, multilayered, and does not allow easy solutions a la ZoneAlarm The second scenario is the desktop. Here you normally don't have things listening on the internet, which means the only attack vector is the software you yourself run. As long as you don't run garbage you find just anywhere on the net, you should be reasonably safe here, but caution is the best guard. Far better than having ZoneAlarm pop up to tell you "you have been infected by something, you better reinstall your system." Be careful with what you install and run -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
Andre Truter wrote:
OK, Linux don't have things like ActiveX and Javascript can be controlled with the different browsers themselves.
That's the point -- those technologies aren't built into the Window\ manager on Linux. If you ported "Explorer" to Linux, "Linux" could be infected with the same viruses as Windows. It's the desktop and the automated MS applications that allow virii in.
FireFox lets you enable or disable javascript and you can tell it to only allow javascript from certain sites.
FF is an agnostic technology. It functions the same on Windows as on Linux. You are making my point. Choose better applications on Windows and you'll reduce your security-liability footprint.
How does a firewall detect incoming javascript?
Many firewall products have this feature. A firewall product sits on the boundary between "out there" and your system. In order for HTTP protocol to be passed "in", it has to go through a firewall. The Firewall simply does "deep inspection". Hardware firewall products (Juniper, et al) have this feature. So do some software firewall products.
the javascript through (using a previously built-up "whitelist" of previously approved websites). Barring corruption of "trusted websites", I don't have to worry about downloading trojan script-code.
Firefox does this on Linux.
Firefox does this. Period. It does it on Windows as well. One of the easier ways of reducing your security profile on Windows: switch to FireFox and T-bird. Neither has to do with the underlying security of the OS.
I don't have to run an
"intrusion [virus] detection program". It doesn't get that far.
Ummm.. Intrusion Detection systems have nothing to do with viruses.
---- That's where you are mistaken. I listed virus in brackets because that's what a virus is -- it is an intrusion of an outside program that has been run in some "privileged" mode such that it has installed portions of itself behind for _possible_ purposes of spreading, or just "owning" the machine. Both intrusion and virus detection software look for signs of altered or corrupt software retrospectively. Good intrusion detection software looks for signatures of known root-kits and infection vectors. About the only thing "virus" detection haws over I.D. is "on-access" scanning -- which is a bit like russian roulette. You hope your virus scanner is up-to-date enough to catch some number of known signatures. On Linux -- people tend more to rely on trusted software sources and gpg-signed binaries. But in both cases "intrusion detection" or virus detection, the scanners scan retrospectively for
Intrusion detection systems monitors incoming connections and prevent and warn possible breakin attempts. (where the real threat is on linux)
How many systems are "owned" linux vs. windows? I'd suggest the total is higher for windows. What's the difference in the intrusion detection you are talking about? You are referring to the singular case where someone is actually behind 1 specific attack on your system instead of it being one of a thousand automatic attack vectors. It makes much more sense for a "intruder-wanna-be" to use multiple viruses and launch 10's - 100's of thousands automated attacks. It's not profitable to waste time attacking 1 system unless you have some specific objective. It's far easier just looking for "easy pickings" -- people who have left their doors "unlocked".
Go and read up on snort, it seems to be exactly what you need. Am already familiar w/it.
Because I can block all network access in or out of my machine on my Windows box, I feel it is more secure than my linux box -- because on linux, something could have snuck-in via a corrupt binary or downloaded patch and I wouldn't know about it for days or longer depending on how well the evidence was buried in a log file.
First: You can set up your linux firewall to also block both incoming and outgoing traffic. In fact, I can set up my Linux firewall in such a way that my network connection becomes totally inefective. It is as if the network card does not work at all. No traffic flowing.
Cement-Pro also protects your system. You encase your system in 6-feet of cement. Nothing gets in or out. What's your point?
Secondly: How can something sneek in via a corrupt binary via a firewall? You have to download in and install it. How does ZoneAlarm protect you against that?
Same way as on Linux -- if you download a corrupt binary, you lose. If you run a pre-built RPM or binary on Linux you can suffer the same problems as on Windows. Your linux system will be compromised faster since there are almost no linux-virus detector's for downloaded binaries (RPMs). By a feature of the RPM system -- if you install an RPM, you've already used root, so any software you've installed has complete control over your system.
On Linux you have tools like checkrootkit, etc that inspect every file on your system and immediately lets you know if the file was tampered with.
Is it "on-access"? I don't think so. When you install, it uses "HTTP" to go out onto the net to download instructions -- does a linux system detect what applications are accessing HTTP and to what target system? An application like ZoneAlarm will tell you in real-time -- as soon as outside communication is attempted, that program "address book" is trying to use HTTP to contact "owned-systems.ru". On Linux, you may see an outgoing http log entry to owned-systems.ru, but are you going to know what program accessed it? That information generally isn't in my squid-log. If it is, it's too late -- the access has happened. With the "zone-alarm", the idea is that anytime a program on your "internal computer zone" attempts to cross onto the "internet zone", you get a real-time alarm and get to decide if it is allowed or not based on program name, and destination. In linux firewall rules, you have the destination, but do you have the source program or filename available so you can tell what program is trying to go out on HTTP?
AppArmour is also a tool that will let you know immediately if files are acessed without permission. It prevents the access and then notifies you. So it is pro-active.
How does it detect access? Signatures? Are they checked before every execution? Windows NT has this capability built-in. You can setup the default on Windows to deny every unregistered binary. Only binaries in known system locations can be setup to be allowed execution. If you copy a system binary to an unknown location and try to execute it, it will fail. This is already built-in to WinXP but is rarely used that way. I don't know of any Linux distro that ships with such capabilities built-in and enforced by the OS.
The main reason windows has more security problems than linux is because the defaults on windows-applications are designed for ease of use *over* security. It is often a trade-off. But linux provides *SO MUCH* logging about everything, that it's hard to sort through _everything_ to see what is important. At the very least, custom scripts and filtering are required and that right there puts it beyond most users (like my mom, etc...).
Well, the idea is that the normal user should not need to worry about security. Linux has been designed in such a way that it looks after itself. You don't need to monitor the security systems.
That's what you want to believe -- Linux doesnt' provide a real-time alarm system like zone-alarm that pops up graphically to tell the user about each network access. All it provides are log files that let you examine things after the fact. How is that more secure?
But, I think you need to have a look at squil and snort, as that is basically what you want. It will notify you immediately of any suspect activity on your ports.
How will you know it is suspect if it is going out on HTTP or SMTP? Do they permit access based on program and target machine? I'm not familiar with "Squil".
It does not read log files, it acts the moment the activity is happening on the port, so it is rather pro-active than re-active.
If true, then great! You solved the original poster's problem -- it can pop up a graphical UI and ask the user if the traffic is permitted if it doesn't already fall into a permitted class. That's what they wanted -- something that popped up in real time any time traffic not explicitly permitted happened. Perhaps you can instruct the original post on how that works. Personally, I haven't seen that on Linux, but if you have a solution, great! Let's hear it. :-). linda
On 22/03/06, Linda Walsh <suse@tlinx.org> wrote:
Andre Truter wrote:
OK, Linux don't have things like ActiveX and Javascript can be controlled with the different browsers themselves.
That's the point -- those technologies aren't built into the Window\ manager on Linux. If you ported "Explorer" to Linux, "Linux" could be infected with the same viruses as Windows. It's the desktop and the automated MS applications that allow virii in.
???? No, Linux cannot be infected with the same viruses (virii if you prefer) as Microsoft operating systems can be. There are some viruses that only affect certain versions of Windows too. A virus could infect Internet Explorer only if it was running in WINE. Once WINE was closed the virus would have nowhere to live/hide. On a Windows system the virus hides away in whatever files the virus writer has chosen. Those files do not exist in the same manner on a Linux system. Or have I been told wrong all these many times? -- ============================================== I am only human, please forgive me if I make a mistake it is not deliberate. ============================================== Xmas may be over but, PLEASE DON'T drink and drive you'll make it to the next one that way. Kevan Farmer Linux user #373362 Cheslyn Hay Staffordshire WS6 7HR
On 3/22/06, Kevanf1 <kevanf1@gmail.com> wrote:
???? No, Linux cannot be infected with the same viruses (virii if you prefer) as Microsoft operating systems can be. There are some viruses that only affect certain versions of Windows too. A virus could infect Internet Explorer only if it was running in WINE. Once WINE was closed the virus would have nowhere to live/hide. On a Windows system the virus hides away in whatever files the virus writer has chosen. Those files do not exist in the same manner on a Linux system.
Or have I been told wrong all these many times?
Nope, here is an article of a guy that tried really hard to get his Linux box infected http://os.newsforge.com/article.pl?sid=05/01/25/1430222&from=rss -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On 22/03/06, Andre Truter <andre.truter@gmail.com> wrote:
On 3/22/06, Kevanf1 <kevanf1@gmail.com> wrote:
???? No, Linux cannot be infected with the same viruses (virii if you prefer) as Microsoft operating systems can be. There are some viruses that only affect certain versions of Windows too. A virus could infect Internet Explorer only if it was running in WINE. Once WINE was closed the virus would have nowhere to live/hide. On a Windows system the virus hides away in whatever files the virus writer has chosen. Those files do not exist in the same manner on a Linux system.
Or have I been told wrong all these many times?
Nope, here is an article of a guy that tried really hard to get his Linux box infected
http://os.newsforge.com/article.pl?sid=05/01/25/1430222&from=rss
--
Thank you Andre, for a while there I thought I was going totally loopy. At least I am learning something from all these technical websites and books I read :-) -- ============================================== I am only human, please forgive me if I make a mistake it is not deliberate. ============================================== Xmas may be over but, PLEASE DON'T drink and drive you'll make it to the next one that way. Kevan Farmer Linux user #373362 Cheslyn Hay Staffordshire WS6 7HR
On 3/22/06, Linda Walsh <suse@tlinx.org> wrote:
Andre Truter wrote:
OK, Linux don't have things like ActiveX and Javascript can be controlled with the different browsers themselves.
That's the point -- those technologies aren't built into the Window\ manager on Linux. If you ported "Explorer" to Linux, "Linux" could be infected with the same viruses as Windows. It's the desktop and the automated MS applications that allow virii in.
Nope, that is wrong. There have been people that have actively tried to install Windows viruses on Linux and the best that a virus could do on Linux was to delete a few of the user's files. It could not survive for long and it could not propagate itself. Due to the design of the system, Linux is very unfriendly environment for a virus.
FireFox lets you enable or disable javascript and you can tell it to only allow javascript from certain sites.
FF is an agnostic technology. It functions the same on Windows as on Linux. You are making my point. Choose better applications on Windows and you'll reduce your security-liability footprint.
Yes, exactly. You said that ZoneAlarm does this, so I said that you can use FF on Linux to get the same functionality. I know FF does this on Windows too.
How does a firewall detect incoming javascript?
Many firewall products have this feature. A firewall product sits on the boundary between "out there" and your system. In order for HTTP protocol to be passed "in", it has to go through a firewall. The Firewall simply does "deep inspection". Hardware firewall products (Juniper, et al) have this feature. So do some software firewall products.
Is this not exactly what I said when I mentioned the IPCop plugin?
Ummm.. Intrusion Detection systems have nothing to do with viruses.
---- That's where you are mistaken. I listed virus in brackets because that's what a virus is -- it is an intrusion of an outside program that has been run in some "privileged" mode such that it has installed portions of itself behind for _possible_ purposes of spreading, or just "owning" the machine. Both intrusion and virus detection software look for signs of altered or corrupt software retrospectively. Good intrusion detection software looks for signatures of known root-kits and infection vectors.
No, Intrusion detection systems monitors incoming traffic and react to malicious attacks on your ports. It does not check files for signatures, that is what anti-virus does and anti-rootkits. Checking the files for viruses is after the fact. An intrusion detection system prevents anything from reaching your system.
--- How many systems are "owned" linux vs. windows? I'd suggest the total is higher for windows. What's the difference in the intrusion detection you are talking about? You are referring to the singular case where someone is actually behind 1 specific attack on your system instead of it being one of a thousand automatic attack vectors. It makes much more sense for a "intruder-wanna-be" to use multiple viruses and launch 10's - 100's of thousands automated attacks. It's not profitable to waste time attacking 1 system unless you have some specific objective. It's far easier just looking for "easy pickings" -- people who have left their doors "unlocked".
I don't really get your point here. I don't know of a single Linux sytem that has been infected by a virus (that the user did not install on purpose. Linux systems gets "owned" by people exploiting vulnerabilities on a machine that have the vulnerable software listening on an open port. The other way is to physically gain access to the machine, or to convince the root user to install comprimised software. In the last two cases you are dealing with social engineering and something like AppArmour can protect you there. In the forst case, your firewall and IDS can protect you. In neither of the cases is there any use in having a system that tells you that an application tries to access the internet. If you get to that point, you are already screwed. You should use your firewall and AppArmour to make sure you don't get to that point.
---- Cement-Pro also protects your system. You encase your system in 6-feet of cement. Nothing gets in or out. What's your point?
My point is that if you are worried about a compromised application on your Linux system trying to "phone home", then set up your Linux Firewall to block outgoing traffic too.
--- Same way as on Linux -- if you download a corrupt binary, you lose. If you run a pre-built RPM or binary on Linux you can suffer the same problems as on Windows. Your linux system will be compromised faster since there are almost no linux-virus detector's for downloaded binaries (RPMs). By a feature of the RPM system -- if you install an RPM, you've already used root, so any software you've installed has complete control over your system.
That is why you have gpg signature checking built into your package managers. They act as anti-virus software. All built in.
On Linux you have tools like checkrootkit, etc that inspect every file on your system and immediately lets you know if the file was tampered with.
Is it "on-access"? I don't think so. When you install, it uses "HTTP" to go out onto the net to download instructions -- does a linux system detect what applications are accessing HTTP and to what target system? An application like ZoneAlarm will tell you in real-time -- as soon as outside communication is attempted, that program "address book" is trying to use HTTP to contact "owned-systems.ru".
But is it not too late then? That means that you have already been compromised. The idea on Linux is to prevent that situation, not sit and wait until it happens and then it can proudly inform you that you have been owned.
AppArmour is also a tool that will let you know immediately if files are acessed without permission. It prevents the access and then notifies you. So it is pro-active.
How does it detect access? Signatures? Are they checked before every execution?
You set up your AppArmour to allow a user access to certain files.
built-in to WinXP but is rarely used that way. I don't know of any Linux distro that ships with such capabilities built-in and enforced by the OS.
AFAIK, SE Linux enforce it.
Well, the idea is that the normal user should not need to worry about security. Linux has been designed in such a way that it looks after itself. You don't need to monitor the security systems.
---- That's what you want to believe -- Linux doesnt' provide a real-time alarm system like zone-alarm that pops up graphically to tell the user about each network access. All it provides are log files that let you examine things after the fact. How is that more secure?
Again, you are looking at this from the wrong side. Tools like ZoneAlarm will inform you that you have already been infected, while Linux security systems prevents you from being infected in the first place. I would rather spend more time and energy on preventing being owned that being informed that I have been owned.
Perhaps you can instruct the original post on how that works. Personally, I haven't seen that on Linux, but if you have a solution, great! Let's hear it. :-).
I have provided the link, all the documentation and software is there. My point is still that people coming from a Windows background treats Linux security from the wrong end. The functionality of ZoneAlarm that the original OP wanted is useless on Linux, as it only informs you that you HAVE ALREADY been compromised. If you get to that stage, you can just as well format your disk and re-install as you are screwed. I suggest that the OP should rather look at the tools that PREVENT a system from being owned. Those tools are a firewall, IDS, AppArmour, etc. If you want to know if you have already been owned then you can use tripwire and checkrootkit. A system like ZoneAlarm will not have any effect if you have been compromised, as the atacker initiate the connection from outside and compromise an application that normally do have net access (how else will they get to the app if it is not listening on a socket). These are applications like sendmail, telnet, apache, ssh, etc. So, let's look at a situation: You have your Linux system with the newly ported ZoneAlarm running, and it tells you that sendmail wants to access the net. So you say OK, as you want your mail to be sent. Now the atacker compromise sendmail and they are happily using sendmail to do all kinds of nasty stuff. How will ZoneAlarm protect you? Sendmail is supposed to access the net. See my point? You should catch the guy before he gets to sendmail and that is what a firewall and IDS is for. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On Wednesday 22 March 2006 18:14, Andre Truter wrote:
Nope, that is wrong.
Please don't let's feed the trolls anymore, Ms. Walsh is clearly not interested in a discussion here. If she were she'd respond when she's called on her mistakes, instead she just continues on her wishful thinking crusade about what windows can do in an ideal world. So let's kill the thread, ok? -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On 22/03/06, Anders Johansson <andjoh@rydsbo.net> wrote:
On Wednesday 22 March 2006 18:14, Andre Truter wrote:
Nope, that is wrong.
Please don't let's feed the trolls anymore, Ms. Walsh is clearly not interested in a discussion here. If she were she'd respond when she's called on her mistakes, instead she just continues on her wishful thinking crusade about what windows can do in an ideal world.
So let's kill the thread, ok?
--
I think some of us were enjoying the amusement of the dream of an ideal 'Windows' world :-) Sadly that dream always turns into a nightmare. -- ============================================== I am only human, please forgive me if I make a mistake it is not deliberate. ============================================== Xmas may be over but, PLEASE DON'T drink and drive you'll make it to the next one that way. Kevan Farmer Linux user #373362 Cheslyn Hay Staffordshire WS6 7HR
Am Mittwoch, 22. März 2006 18:32 schrieb Anders Johansson:
On Wednesday 22 March 2006 18:14, Andre Truter wrote:
Nope, that is wrong.
Please don't let's feed the trolls anymore, Ms. Walsh is clearly not interested in a discussion here. If she were she'd respond when she's called on her mistakes, instead she just continues on her wishful thinking crusade about what windows can do in an ideal world.
So let's kill the thread, ok?
I read this thread with great amusement (as I am so very happy that after years of computer-related frustration I finally found my way to Linux), but I also learn a lot here. It's very interesting, at least for people like me, actually coming from the M$-space, really having that kind of security view, really trying to understand something. And although it's kind of a joke, of course, when Linda promotes the "security" of Win, at least I receive the impression that she's not stupid at all, maybe delibiberately provoking. So I don't see any reason to flame her... As I still haven't really understood, why there should not be a tool that would warn me if ET wants to call home. I'll follow this thread with interest and joy as long as it exists. Especially because I am not so sure that I always really know what I install here, cannot check a source-code, don't even know, how I can distinguish "good" from "bad" software... So please go on and feed us with more controversial info. Thanks! Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
----- Original Message ---- From: Daniel Bauer Sent: Wednesday, March 22, 2006 1:42:02 PM
Am Mittwoch, 22. März 2006 18:32 schrieb Anders Johansson:
On Wednesday 22 March 2006 18:14, Andre Truter wrote:
Nope, that is wrong.
Please don't let's feed the trolls anymore, Ms. Walsh is clearly not interested in a discussion here. If she were she'd respond when she's called on her mistakes, instead she just continues on her wishful thinking crusade about what windows can do in an ideal world.
So let's kill the thread, ok?
I read this thread with great amusement (as I am so very happy that after years of computer-related frustration I finally found my way to Linux), but I also learn a lot here. It's very interesting, at least for people like me, actually coming from the M$-space, really having that kind of security view, really trying to understand something.
[snip]
Especially because I am not so sure that I always really know what I install here, cannot check a source-code, don't even know, how I can distinguish "good" from "bad" software...
?So please go on and feed us with more controversial info. Thanks!
Just to stop feeding that thread :) - try using FireStarter (http://www.fs-security.com) Dmitry
Daniel
What is wrong with setting up a Linux firewall to stop all suspect packets (either by time out or other rules) then periodically checking the log files? It should just work. This is Linux not Microsoft Windows, it's different so don't go expecting it to be the same. -- ============================================== I am only human, please forgive me if I make a mistake it is not deliberate. ============================================== Xmas may be over but, PLEASE DON'T drink and drive you'll make it to the next one that way. Kevan Farmer Linux user #373362 Cheslyn Hay Staffordshire WS6 7HR
Anders Johansson wrote:
On Wednesday 22 March 2006 18:14, Andre Truter wrote:
Nope, that is wrong.
Please don't let's feed the trolls anymore, Ms. Walsh is clearly not interested in a discussion here.
What discussion was addressed to me that I did not respond to? Clearly no one here understands the nature of 99% of Windows virii and how they could easily run on Linux if Linux had a full port of Explorer, ActiveX and the desktop libraries. It is rare that malware attacks come in through open Windows "ports" -- it is through application level attacks that most Windows malware is spread -- Outlook was one of the first favorites, now it's constantly Explorer or the Windows _equivalent_ of Apache : "IIS: the MS web server". Equating Explorer or Apache with with Windows is like calling KDE or Apache, "Linux". Linux is a kernel and Windows NT is a kernel.
If she were she'd respond when she's called on her mistakes,
If I make one, I may or may not respond -- is there some rule that I'm suppose to roll over and expose my belly? You may be clueless, I'm not playing by "doggie" dominance and hierarchy rules. It's weird to be put in a position of defending MS, since I tend to strongly dislike them, but so many people really don't know what they are talking about. Where do you think Window's (as separate application on top of WinNT) got it's "ActiveX" technology from? Before that it was called DCOM, and before that "COM" and before that...I think "CORBA"?, but Window's "COM" technology came from Unix (Sun). Look at technology common to Windows & *nix, say Java: how much less secure is Java on Windows than Gnunix? What started this conversation no one has addressed: the primitive [absent] interactive GUI "Firewall" technology available on Windows. Don't think I don't know what I am talking about. I've had over 15 years in unix & Linux experience. I've run Windows as a desktop for more than a couple of years as it has a superior GUI. But you don't try to tell me that the lack of an interactive GUI firewall that checks all inbound/outbound traffic isn't needed or useful. If I install FF, on Linux, on startup, *by default*, it will go out and download the Firefox home page after you first install it. Unless you are on a separate subnet and block the use of outgoing port 80, it will succeed. When I install the same program on my Windows box, Firefox is blocked and I receive a popup on my desktop telling me that application "Firefox" is trying to contact host "xxyz" on port 80. Do I wish to allow this? That ability isn't readily available on Linux. That's not to say it _couldn't_ be done, it's just saying that it doesn't currently have the interactive GUI to control an all encompassing Firewall of the type that has been available on Windows for over 6 years (or more). I'm not saying I can't configure a firewall that will block FF by default on Linux when it starts and will *ask* me what to do when it detects the effort: "should it be: 1) allowed always, 2) denied always, 3) allowed this one time, or 4) denied this one time?" The behavior I see on Linux is "silent failure" -- a log file entry is generated, and it doesn't tell me what application made the request.
instead she just continues on her wishful thinking crusade about what windows can do in an ideal world.
--- I'm only talking about what my Windows box is configured to do in the *real* world vs. my Linux box[en]. It certainly isn't a "crusade". If I have my druthers to setup an email/browsing client for someone who is OS-agnostic, I've chosen Gnunix as it's less likely to have problems. That certain doesn't mean mean it's *perfect*. Why are so many people caught in black & white thinking? So many people are caught up in defending Gnunix that they can't see the flaws. Instead of answering the original poster with a means to do what they wanted to do, the *Linux* way is to convince them how stupid it is to want what they want. Rather than hearing abuse for liking security popups from my firewall, I'm told I don't know what I want and I really did want "black" and any choice other than "black" is obviously stupid coming from a "troll". The reason MS has been successful in the marketplace is that rather than spending all this energy telling me why I shouldn't want what I want, they have traditionally just bent over backwards to enable it (too much so, allowing harm from the opposite direction). Neither direction is 100% right. They need sensible blending -- something you won't have as long as you color everything "MS", "wrong". -l
On 3/30/06, Linda Walsh <suse@tlinx.org> wrote:
Clearly no one here understands the nature of 99% of Windows virii and how they could easily run on Linux if Linux had a full port of Explorer, ActiveX and the desktop libraries.
But Linux don't have those flaws, while Windows do. You cannot install a Windows system without it. So, even though the components that make it insecure is not the kernel, the system as a whole is still insecure as those are core parts of the system. Besides, if you want to make Linux just as vulnerable to viruses as Windows by porting ActiveX to it, you will firstly have to do the porting in a very stupid way. You will have to tie the ActiveX into the kernel's security level (like Windows have), so you will be actively MAKING an insecure Linux. But that would be stupid, would it not? What would the point be? Who would be stupid enough to use such a system? (Hmmm... Maybe if you get MicroSoft's marketing department to seel it, you will be able to sell it to people) But then it is definately not Gnu/Linux anymore and the Gnu/Linux community will never accept or allow such a beast.
Where do you think Window's (as separate application on top of WinNT) got it's "ActiveX" technology from? Before that it was called DCOM, and before that "COM" and before that...I think "CORBA"?, but Window's "COM" technology came from Unix (Sun).
I don't know if COM and DCOM comes from CORBA, but if it does then MS did a pretty crappy job of copying CORBA functionality. CORBA is a stand-alone bus that allow clients to talk to each other. THe clients interface with the CORBA bus via an API, but do not share memory space with the bus itself. With COM and ActivX the API gives your app access to the memory space of the ActiveX component, which again use a shared system bus. If you plug into the Windows system bus, you can see all messages gong around. You can intercept messages meant for other applications, change it and send if off again. With the message busses used on *nix systems you cannot do that, because there are diferent busses and you can only access what the bus allow you to see.
Look at technology common to Windows & *nix, say Java: how much less secure is Java on Windows than Gnunix?
Very much. Due to the common message bus that Windows use, the java application potentially have access to any other application, while on a *nix system, the java engine is run as a normal user and there is no common message bus. In fact, java normally does not have access even to the KDE or GNOME message busses. If a java app gets compromised, it will only effect the user.
What started this conversation no one has addressed: the primitive [absent] interactive GUI "Firewall" technology available on Windows.
I think you are still not getting the point. You percieve Linux as being primitive because it does not feature a useless application that can only give you a false sense of security. You are still measuring linux security according to Windows security features and issues. The point is that you should first look at where the real threats are on a Linux system and then think from that angle. On Linux you should NOT focus on a tool that can tell you that you HAVE ALREADY been compromised. If you say that Linux is primitive because it does not have a fancy GUI that can tell me that I am already compromised, then I say that I prefer the primitive sytem that rather prevent me from being compromised in the first place.
If I install FF, on Linux, on startup, *by default*, it will go out and download the Firefox home page after you first install it. Unless you are on a separate subnet and block the use of outgoing port 80, it will succeed. When I install the same program on my Windows box, Firefox is blocked and I receive a popup on my desktop telling me that application "Firefox" is trying to contact host "xxyz" on port 80. Do I wish to allow this?
OK, so help me understand the usefulness of this.. I start up a browser with the intent of acessing web pages on a web server, that is normally via port 80. Now I have an application that tells me that the browser is trying to access port 80. Well, I kind of expect it to access port 80 that is why I started it up. Why would I want an application to tell me this? Or do you start up Firefox and use it as a local file browser. FireFox should NOT access port 80, that would be wrong....
That ability isn't readily available on Linux. That's not to say it _couldn't_ be done, it's just saying that it doesn't currently have the interactive GUI to control an all encompassing Firewall of the type that has been available on Windows for over 6 years (or more).
That is because that functionality is moot on Linux. You don't need it as the security issues are different.
The behavior I see on Linux is "silent failure" -- a log file entry is generated, and it doesn't tell me what application made the request.
No, not silent failure, but silent protection. A firewall is not there to tell you what is trying to go where, it's main purpose is to prevent thngs from going through it. If you want to see what traffic os going where, use something like Ethereal. [...]
The reason MS has been successful in the marketplace is that rather than spending all this energy telling me why I shouldn't want what I want, they have traditionally just bent over backwards to enable it (too much so, allowing harm from the opposite direction). Neither direction is 100% right. They need sensible blending -- something you won't have as long as you color everything "MS", "wrong".
The reason MS is successfull does not have much to do with giving users what they want. It has to do with very clever marketing and social engineering. They have managed to form the market to thier view of it. MS (and cronies) basically tells you that you need a tool to tell you that an application wants to access the net. They fabricate the need by perception. You have been brain washed into believing that the best way to protect your system is to be notified that you have been compromised. Does that make sense? To me that is not logical. The MS-dominated IT sector has also very successfully brainwashed people into believing that a computer system is virus prone, that it has to be rebooted often and that instability is normal. These are all things that should not make sense, but somehow people believe it. It is like getting people to believe that it is normal for a car's brakes to fail every now and again. Ford will have difficulty in making people believe and accept this, because there are a lot of other car manufacturers that will not play along with this. Unfortunately the IT world have been domintated for so long by MS that they managed to establish certain perceptions about how a computer should function. People started to accept that a PC crash every now and again. People loose files and just carry on because that is the nature on a PC. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
I don't know if COM and DCOM comes from CORBA,
It doesn't.
With COM and ActivX the API gives your app access to the memory space of the ActiveX component, which again use a shared system bus. If you plug into the Windows system bus, you can see all messages gong around. You can intercept messages meant for other applications,
Complete rubbish. Windows is a full fledged protected mode OS, applications are very much shielded from each other - yes, I believe Linux is superior but due to differences far more subtle then you are describing.
With the message busses used on *nix systems you cannot do that, because there are diferent busses and you can only access what the bus allow you to see.
This statement is so vague as to be meaningless. And many of the messaging technologies used by X-windows environments over the years have been horribly insecure.
Look at technology common to Windows & *nix, say Java: how much less secure is Java on Windows than Gnunix?
Very much. Due to the common message bus that Windows use, the java application potentially have access to any other application,
Bogus.
What started this conversation no one has addressed: the primitive [absent] interactive GUI "Firewall" technology available on Windows.
I think you are still not getting the point.
I think YOU are entirely missing the point. An interactive firewall IS EASIER TO USE! Otherwise apps silently fail to work - this has nothing whatsoever to do with worms, viruses, trojans, etc... It has to do with informing the poor user what is going on. Lack of such a feature on the LINUX desktop IS a deficiency no matter how you want to spin it. Like no feedback for offline print queues and the inability to edit filesystem ACLs in the GUI.
You percieve Linux as being primitive because it does not feature a useless application that can only give you a false sense of security.
I don't percieve the LINUX desktop as primitive, but it certainly has functionality gaps that still need closing. This is a legitimate user need.
The point is that you should first look at where the real threats are on a Linux system and then think from that angle.
The inability of the system to INFORM the user that it blocked an applications attempt tp communicate is NOT a "security" problem, it is a usability problem.
On Linux you should NOT focus on a tool that can tell you that you HAVE ALREADY been compromised.
Because an app is trying to open a port means you've been comprimised? Again - Bogus.
On Thursday March 30 2006 21:51, Adam Tauno Williams wrote:
Complete rubbish. Windows is a full fledged protected mode OS, applications are very much shielded from each other - yes, I believe Linux is superior but due to differences far more subtle then you are describing.
Look up shatter attacks on Windows. These are very dangerous attacks that cannot be fixed without Microsoft completely re-writing how Windows uses messages between applications. From what my hacker/security engineer friend tells me, this sounds exactly like what Andre was describing. -- ~R~ ---------------------------------------------------------- Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!
On Friday 31 March 2006 3:31 pm, Roger Haxton wrote:
Look up shatter attacks on Windows. These are very dangerous attacks that cannot be fixed without Microsoft completely re-writing how Windows uses messages between applications. From what my hacker/security engineer friend tells me, this sounds exactly like what Andre was describing. As a reference, there was a pretty good discussion of Windows security flaws and Crossover Office and if some of these vulnerabilities could affect Linux if we run IE, Outlook, et. al.
-- Jerry Feldman <gaf@blu.org> Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9
Am Donnerstag, 30. März 2006 23:35 schrieb Andre Truter:
If a java app gets compromised, it will only effect the user.
Sorry, I don't really get that point: "it will only effect the user". *I* am the user and it's exactly me whom I don't want to be affected. Quasi all of my data, all my e-mails, all my settings are "only user". So if this gets compromised, it don't care too much, if the rest of the system is still doing fine - I am not. (ok, this applies only to a single-user machine, however) To make it clear: as a non-professional "just-user" of a PC it's no comfort that "only the user" can be affected, because in case of an attack I will not be happy, when I can say: "Oh, only my stuff is gone - but the system still feels fine - Yippee!"
What started this conversation no one has addressed: the primitive [absent] interactive GUI "Firewall" technology available on Windows.
I think you are still not getting the point.
Me neither! it may seem to you. I understand that there are huge differences between W and Linux, and I very much appreciate this - i'd never never want to go back to W, that would be a nightmare (also, but not just because of security). But on the other hand: what's against it, if you get noticed when a program wants to call outside?
You percieve Linux as being primitive because it does not feature a useless application that can only give you a false sense of security.
If you have the, let's say "zone alarm" warnings, that doesn't mean that you should rely _only_ on this. I wouldn't call it a "false" but an "additional" sense of security.
... On Linux you should NOT focus on a tool that can tell you that you HAVE ALREADY been compromised.
Why not? Not everybody is a systems engineer (or wants to become one) with indeep knowledge of security etc. issues. I guess, most of the users just want to sit in front of a computer and _use_ it, as you want to see the time on your watch, even if you have no idea about on what frequency the quartz inside runs or how gears must be mounted so that they don't block. ok, you may say, those users shall go back to W. But is this what you really want? Me not. It's one of the reasons not "everybody" uses Linux that it has the image of beeing for "specialists" only. ...and about "HAVE ALREADY been compromised": ok, but then it's still better to find out by a warning than not to find out at all, don't you think so too? And, what exactly means "beeing compromised"? I, for example, just don't want Acrobat to call home (in fact I don't even know, if it does on Linux; it does on W if you don't stop it with z.a. or similar). I want to be able to block things like that easily whithout an university degree in firewalling.
No, not silent failure, but silent protection. A firewall is not there to tell you what is trying to go where, it's main purpose is to prevent thngs from going through it.
I think "firewall" and the discussed zone-alarm feature of warnings for outgoing calls are two different things. If you set up a Linux-PC (well, I know only SUSE...), you might be more secure than on W, but it is still possible, that you download or run a program that does things you don't want it to. Of course it would be best, to use only secure, trusted software, but how should an average fool (like me) decide, what is secure, whom schould I trust, whom not? In reality people just download programs if they think, they'd like to have it. Then it's just nice if you can be sure, that this program cannot connect to the internet without your explicit permission. I acknowledge that this *alone* doesn't make a system secure, but why not have it as an _additional_ comfortable feature?
If you want to see what traffic os going where, use something like Ethereal.
Well, again, for the kind of users I belong to, all those logs and other interesting and impressive things are very mystic. Often I simply don't understand, if a message is a warning, an error or just normal. Is it important? Must I google around about that or can I just leave it as it is? etc.etc. It's quite a difference to read and decipher system messages or just having a window popping up, telling me "Acrobat wants to connetc to the net. Do you want to allow this for now, for ever, not now, not at all?". I could understand something like this and - important - my action would simply be to click the desired answer. I don't have to search in systems settings how to avoid a program to connect, I don't even have to understand what ports are, what they do and how and why to open or close them. And, as said before, for most of the computer users (W or Mac or Linux, doesn't matter) the computer is just a tool. They have a profession other than programming and they have other hobbies than "computering". It shouldn't be a precondition for Linux users to develop indeep system knowledge. If this would be the case, then Linux would be nothing but a game for some freaks or, in the better case, a system for special needs run by specialists. ...
The reason MS is successfull does not have much to do with giving users what they want. It has to do with very clever marketing and social engineering....
I personally cannot understand why M$ is (was?) so successful. But it often happens in the real world that it is the worst that finally succeeds. In case of M$ I think "white-collar crime" is an important issue...
... People started to accept that a PC crash every now and again. People loose files and just carry on because that is the nature on a PC.
Here I fully aknowledge. It's crazy. Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On 3/31/06, Daniel Bauer <linux@daniel-bauer.com> wrote:
Am Donnerstag, 30. März 2006 23:35 schrieb Andre Truter:
If a java app gets compromised, it will only effect the user.
Sorry, I don't really get that point: "it will only effect the user". *I* am the user and it's exactly me whom I don't want to be affected.
The point is not that it is OK if you cet compromised, but the point was that if you get compromised on Windows, your whole system is in trouble, while on Linux, only the user is.
To make it clear: as a non-professional "just-user" of a PC it's no comfort that "only the user" can be affected, because in case of an attack I will not be happy, when I can say: "Oh, only my stuff is gone - but the system still feels fine - Yippee!"
Hehe, yes. You can still restore you backups and carry on. The thing is not that an attack is justified, but if you do get attacked, the damage is limited. Remember that Linux is a true multi-user system. Even if you are using it as a home PC and you are the only user, the system is still a multi-user system. You have a number of ssytem users running on the machine. Not real people, but according to the system, all are users.
But on the other hand: what's against it, if you get noticed when a program wants to call outside?
First question: Why do you want to be notified of this? What is the reasoning behind this user request?
... On Linux you should NOT focus on a tool that can tell you that you HAVE ALREADY been compromised.
[...]
...and about "HAVE ALREADY been compromised": ok, but then it's still better to find out by a warning than not to find out at all, don't you think so too? And, what exactly means "beeing compromised"? I, for example, just don't want Acrobat to call home (in fact I don't even know, if it does on Linux; it does on W if you don't stop it with z.a. or similar). I want to be able to block things like that easily whithout an university degree in firewalling.
I don't have anything against the ZoneAlarm type functionality apart from the fact that it draws your atention away from the real threats. If you want such functionality, then ask the ZoneAlarm people to port it, or ask someone to write such an application. Fact is that Linux is lacking in security or being primitive because it does not have such a tool, it just does not need such a tool. The orignal poster suggested that Linux is primitive because it does not have this and I am saying that it is not because the tools that protect you from the real threats are quite mature on Linux.
No, not silent failure, but silent protection. A firewall is not there to tell you what is trying to go where, it's main purpose is to prevent thngs from going through it.
I think "firewall" and the discussed zone-alarm feature of warnings for outgoing calls are two different things. If you set up a Linux-PC (well, I know only SUSE...), you might be more secure than on W, but it is still possible, that you download or run a program that does things you don't want it to.
AppArmour and your anti-rootkit software should help you here Of course it would be best, to use only secure, trusted software, but
how should an average fool (like me) decide, what is secure, whom schould I trust, whom not? In reality people just download programs if they think, they'd like to have it. Then it's just nice if you can be sure, that this program cannot connect to the internet without your explicit permission.
By using the appropriate tools mentioned above, you should never get to the point where you need this type of functionality. I still don't see much need for an application that lets you interactively block access from inside to outside, except if you don't want Acrobat to phone home. But if that is something that will make people happy, they are free to create such an application. Fact is still that the lack of such an application does NOT make Linux primitive or insecure, as that is not where the security issues are. The only usefulness such a tool will have to to allow you te prevent Acrobat (or what ever) application from acessing the net. But I don't see this as a security issue, it is just a user preference issue. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
Am Freitag, 31. März 2006 10:20 schrieb Andre Truter:
If a java app gets compromised, it will only effect the user.
Sorry, I don't really get that point: "it will only effect the user". *I* am the user and it's exactly me whom I don't want to be affected.
The point is not that it is OK if you cet compromised, but the point was that if you get compromised on Windows, your whole system is in trouble, while on Linux, only the user is.
ok, got that. Anyway, on W you don't need a virus or worm to get compromised - windows is so-to-say "self-compromising" :-)
...
But on the other hand: what's against it, if you get noticed when a program wants to call outside?
First question: Why do you want to be notified of this? What is the reasoning behind this user request?
Well that's easy to say: I want my privacy to be respected. I don't want a music company to know which CD's I listen to, I don't want Hollywood to know, what moovie I'm looking at, I don't want to give my e-mail contacts to a spam company, I don't want any program telling it's developer or company automatically, that I am using it... and so on. To use a picture: If you are responsible for a kindergarden you will make sure that no "bad guys" come in, but you also want to make sure that no child runs out the door to the street. So having somebody watching who is going in _and_ out, wouldn't be a bad idea. Of course nobody should feel secure only because the door is monitored, it's just a (small) _part_ of the security. You'll also need fire extinguishers, medicine chest, a phone to call for help...
... On Linux you should NOT focus on a tool that can tell you that you HAVE ALREADY been compromised.
[...]
...and about "HAVE ALREADY been compromised": ok, but then it's still better to find out by a warning than not to find out at all, don't you think so too? And, what exactly means "beeing compromised"? I, for example, just don't want Acrobat to call home (in fact I don't even know, if it does on Linux; it does on W if you don't stop it with z.a. or similar). I want to be able to block things like that easily whithout an university degree in firewalling.
I don't have anything against the ZoneAlarm type functionality apart from the fact that it draws your atention away from the real threats.
If you want such functionality, then ask the ZoneAlarm people to port it, or ask someone to write such an application.
I wouldn't. I have read things about ZoneAlarm that don't make it very credible. I don't want to propagate z.a., it's just this one feature (warnings, easy blocking internet-access of programs) that I'd like to have in Linux, too. But I agree, that I'm far away of knowing, if such a "warn-application" is useful or useless on Linux; I'd just like it for the reasons mentioned above...
Fact is that Linux is lacking in security or being primitive because it does not have such a tool, it just does not need such a tool.
The orignal poster suggested that Linux is primitive because it does not have this and I am saying that it is not because the tools that protect you from the real threats are quite mature on Linux.
Of course Linux is _not_ primitive at all. No system is primitive just because of the lack (if it is a lack then) of one feature. If you want this word to be used I'd call W primitive - if you compare it to Mac for example. But this if off-topic anyway.
No, not silent failure, but silent protection. A firewall is not there to tell you what is trying to go where, it's main purpose is to prevent thngs from going through it.
I think "firewall" and the discussed zone-alarm feature of warnings for outgoing calls are two different things. If you set up a Linux-PC (well, I know only SUSE...), you might be more secure than on W, but it is still possible, that you download or run a program that does things you don't want it to.
AppArmour and your anti-rootkit software should help you here
Yeah, I'd have to learn about that. I just was held off using AppArmour by reading it's descriptions, which I simply don't understand. Maybe I will one day - but untill that day, I'd like to have something easier, you know, just click-click... ;-) I installed chkrootkit, but I never used it till now. Yast says: "However, it is always recommended that this program be used from a rescue system or a system with a similar purpose." So, will it damage something, when I run it, or what else is this sentence trying to tell me? Must I make a "rescue system" to use it, and if, how? You see, those are the issues that people coming form such a primitive system like W simply don't get a grip on so easily...
...
I still don't see much need for an application that lets you interactively block access from inside to outside, except if you don't want Acrobat to phone home. But if that is something that will make people happy, they are free to create such an application.
I would if I could.
Fact is still that the lack of such an application does NOT make Linux primitive or insecure, as that is not where the security issues are. The only usefulness such a tool will have to to allow you te prevent Acrobat (or what ever) application from acessing the net. But I don't see this as a security issue, it is just a user preference issue.
Ok, I guess you know much much more about this topic than I do, so I simply believe what you say (does this make my system insecure? ;-) ). Let's call it a user preference issue. An issue I'd really welcome, although I know, it probably wouldn't prevent a "bad" program using a door to the outside world thru using another program to which I allowed connecting... Daniel -- Daniel Bauer photographer Basel Switzerland professional photography: http://www.daniel-bauer.com special interest site: http://www.bauer-nudes.com
On 3/31/06, Daniel Bauer <linux@daniel-bauer.com> wrote:
Well that's easy to say: I want my privacy to be respected. I don't want a music company to know which CD's I listen to, I don't want Hollywood to know, what moovie I'm looking at, I don't want to give my e-mail contacts to a spam company, I don't want any program telling it's developer or company automatically, that I am using it... and so on.
I don't know AppArmour very well yet, but I had a quick look in the documentation and it seems that it is what you are looking for. I have to agree that setting it up can be a bit daunting, but the standard profiles that comes with it is probably already adequate for what you need. I would suggest playing around with it. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On Friday 31 March 2006 12:00, Daniel Bauer wrote:
I installed chkrootkit, but I never used it till now. Yast says:
"However, it is always recommended that this program be used from a rescue system or a system with a similar purpose."
So, will it damage something, when I run it, or what else is this sentence trying to tell me? Must I make a "rescue system" to use it, and if, how? You see, those are the issues that people coming form such a primitive system like W simply don't get a grip on so easily...
If your system is compromised, you can not trust it anymore. No parts of the software should be trusted. e.g: Your /bin/ls could have been changed to never show the malicious software. Your /bin/ps could have been changed to never show malicious processes. The list goes on... If you boot up from a fresh readonly medium as a CDROM than you start with an "uncompromised " system. And you can trust the output of rpm, lsof, netstat, ls and friends. Only then you can see if the MD5 signatures from the rpm's match your binaries. j -- Jonas Helgi Palsson "Microsoft is not the answer. Microsoft is the question. NO is the answer." -Erik Naggum
I need to break this up as my typing speed isn't what it used to be. Andre Truter wrote:
On 3/30/06, Linda Walsh <suse@tlinx.org> wrote:
Clearly no one here understands the nature of 99% of Windows virii and how they could easily run on Linux if Linux had a full port of Explorer, ActiveX and the desktop libraries.
But Linux don't have those flaws, while Windows do.
Which flaws are you referring to? I said Linux isn't affected by most Windows-based virii because Linux doesn't provide the "ease-of-use" & "automation" libraries that most malware targets in the Windows environment. I don't believe I referred to flaws. It sounds like you are equating "libraries" with "flaws". Is this what you meant? I might point out that _Linux_ doesn't provide _any_ application libraries. Third parties provide applications and libraries which are distributed by specific distributions. When you refer to Linux, are you referring to all distributions that use the Linux OS as their base? Windows isn't an OS it's a windowing, application environment. It started as a $100 dollar, separately packaged "add-on"Up until recently it ran on MS-DOS -- a single-user OS designed for *non-networked* use. Windows was ported to run on "NT", which MS introduced as their "business" solution. Windows is equivalent in Linux to "KDE" or "Gnome" and every other standard application library provided on top of a Linux kernel.
You will have to tie the ActiveX into the kernel's security level (like Windows have), so you will be actively MAKING an insecure Linux.
Are you referring to the multiple special hooks for graphics acceleration in the Linux Kernel, like the specialized XFree graphics subsystem drivers? No, cause tying putting hooks in the kernel to allow graphics acceleration would just be "stupid", right? How about the automation that already exists in KDE (and probably gnome) that allows one to click on a file and have a file-specific handler (or interpreter) run. It doesn't have to be built into the kernel to be insecure. Just run all the processes as root. How many times has linux been hacked because a daemon was compromised and running as "root"? It's common now for some of these to drop root privileges and/or run in a restraining "chroot" jail (ex. bind/named), but many haven't been converted, and there seem to be new ones being written all the time that forget the lessons of yesterday.
(Hmmm... Maybe if you get MicroSoft's marketing department to seel it, you will be able to sell it to people) But then it is definately not Gnu/Linux anymore and the Gnu/Linux community will never accept or allow such a beast.
There is no "accept" / "allow". it's whatever will sell to the masses. Each new version of SuSE (I only mention SuSE because I'm not that familiar with other distro's, having run SuSE's since SuSE 7.x) has more daemons running that I've never heard of. With the interwoven dependencies I have mentioned elsewhere in email, tons of unnecessary software and daemons are installed in the default system -- if you follow the install rules -- like you said in Windows: you can't install a system without them.
Where do you think Window's (as separate application on top of WinNT) got it's "ActiveX" technology from? Before that it was called DCOM, and before that "COM" and before that...I think "CORBA"?, but Window's "COM" technology came from Unix (Sun).
Correction on this - COM came from DDE and OLE, which didn't include networking initially. CORBA 2.0 was designed for compatibility with OLE & COM. CORBA had DCOM compatibility by version 2.3.
CORBA is a stand-alone bus that allow clients to talk to each other. THe clients interface with the CORBA bus via an API, but do not share memory space with the bus itself.
??? By share the same memory space, do you mean run on the same computer? Not since Win98/WinME have Windows processes run in a shared memory space.
With COM and ActivX the API gives your app access to the memory space of the ActiveX component, which again use a shared system bus.
On a hardware level, perhaps, but in software, no worse than Linux, where any root-level process can read (and write) all of memory through /proc/kcore.
With the message busses used on *nix systems you cannot do that, because there are diferent busses and you can only access what the bus allow you to see.
You are not making any sense. All root level processes on a "normal" version of Linux (not SELINUX), have access to each other and can screw with other process's memory space given enough work. In NT, processes under different user-id's and non-root processes don't have any more ability to write over other users' processes than on Linux.
Very much. Due to the common message bus that Windows use, the java application potentially have access to any other application, while on a *nix system, the java engine is run as a normal user and there is no common message bus. In fact, java normally does not have access even to the KDE or GNOME message busses.
If a java app gets compromised, it will only effect the user.
You apparently don't know about the versions of Linux that have shipped as "single user systems", where the one user is "root". You can configure Linux to have just as many security problems as Windows.
What started this conversation no one has addressed: the primitive [absent] interactive GUI "Firewall" technology available on Windows.
I think you are still not getting the point.
The point in in the subject of the message. Show me the Linux answer to "common" Windows functionality -- interactive firewall and security control.
You percieve Linux as being primitive
--- Incorrect. Read the subject. I perceive the SuSE Firewall product as being primitive compared to user-interactive products on Windows that provide the same level of security but have the additional ease of real-time user interaction.
because it does not feature a useless application that can only give you a false sense of security.
This is what I mean -- you can't admit Linux is lacking in an interactive bi-directional firewall & HTML filtering product.
You are still measuring linux security according to Windows security features and issues.
It's not a measure of security -- it's a measure of usability -- of whether or not you can answer the original posters question. They wanted an interactive firewall control -- not a non-interactive one that makes all decisions for him up front and silently records results to a log file.
The point is that you should first look at where the real threats are on a Linux system and then think from that angle.
On Linux you should NOT focus on a tool that can tell you that you HAVE ALREADY been compromised.
Have a tool *block* non-permitted applications by default doesn't tell me I've been compromised. You see, many tools writers write their tools to "call home" after you have installed them. This allows them to track who has installed their tool and, at the least, gage numbers. Firefox is such a tool. When you first install it, it tries to call home. Do I want it to? No. You are making the claim that because Firefox initiates web-access to a Firefox-custom site when it starts up, that I am already compromised. I disagree. It's not just Firefox, but most program's "help" features seem to attempt network communication (whether I only want to search my local machine or not). Another example -- Thunderbird. Would I expect an "email" client to attempt a download from port 80 when I first start it? That's what it does. It tries to download a special "start page" when you start it for the first time and unless you disable it's default start page. Do I want to signal to 'mozilla.org" every time I read email? On Windows, I have a chance to interactively monitor each new program's behavior and decide to permit or deny activity. On linux, I don't have that option.
OK, so help me understand the usefulness of this.. I start up a browser with the intent of acessing web pages on a web server, that is normally via port 80.
Please, don't insult my intelligence. You can't figure out any usage of Firefox beyond accessing external web sites on port 80? Firefox can be used to browse a local internet and it can be used to browse external sites not on port 80, or be configured to go through a proxy. On my system, a program trying to go out on port 80 is the first evidence that a program is trying to do something _behind my back_. I know at the very least, it is misconfigured or it is trying to do some action I didn't specifically authorize. On your Linux system, you have no clue -- from what you tell me, you have port 80 open by default, so any application can contact external websites on port 80 and download code or "register" your presence. That's insecure.
Well, I kind of expect it to access port 80 that is why I started it up. Why would I want an application to tell me this?
Because it is not something specifically permitted. You seem to believe that any application going out port 80 should be unquestioned and allowed. My security policy on my Windows machine says no traffic goes out of port 80. Any software that is following my security policy will not go out port 80. Any software that tries to go out port 80 will cause me to be immediately notified -- interactively with what application is attempting the *unauthorized* access and what website it is trying to contact.
Or do you start up Firefox and use it as a local file browser. FireFox should NOT access port 80, that would be wrong....
=== It does and you are obviously unaware of this because you haven't been monitoring your port-80 traffic.
That is because that functionality is moot on Linux. You don't need it as the security issues are different.
No they aren't. I have similar security policies for my windows as for my Linux machines. There are variations based on my usage, but I am aware of the risks.
The behavior I see on Linux is "silent failure" -- a log file entry is generated, and it doesn't tell me what application made the request.
No, not silent failure, but silent protection.
You are jumping around. We are talking about othewise legitimate applications that make unpredictable network accesses -- like Firefox, when you first start it to browse files. You wouldn't expect it to access the internet, but that's what it does -- so does Thunderbird. Um...we just talked about allowing FireFox to go out of port 80. If I run an MP3 player, if it tries to download music from "website:5004", you can bet that on Windows, I'd get an immediate warning that "MP3AMP" is trying to access "music.site" on port 5004. Should it be permitted? I can look at the URL and see it's on a non-standard web-traffic port (though it may be standard for MP3 broadcasts, it's not for generic web content). I can choose to allow it or not. On linux I had the same problem -- but there, my firewall silently blocks attempts to go out on port 5004 -- why? Because when I set up the firewall, I didn't "predict" every possible port that music might be playing from. Not playing is a "failure" -- it is not "silent protection". From any user's perspective, it if doesnt' work, it's broken. On linux, I had no idea why it wasn't working the first time it happened. Only days later did I see a few lines out of 1000's of log lines showing me that there had been unauthorized attempts to contact "music.site:5004" that had been _silently_ blocked. Later, I could log into my firewall console and add rules to permit this, but when it was happening, all I knew was frustration -- my MP3 player wasn't working with random sites.
A firewall is not there to tell you what is trying to go where, it's main purpose is to prevent thngs from going through it.
Wny do you think they have security cameras in banks? Are they to deflect the bullets of robbers? If something "happens", you want to know who what where and when. Giving me no information is next to useless. Sorry -- Linux doesn't provide useful information in these situations. Not knowing "who" (or "what") is trying to violate security policy in what way is poor protection -- giving me that information in real time is in NO way, useless. -l
Linda Walsh wrote:
Clearly no one here understands the nature of 99% of Windows virii and how they could easily run on Linux if Linux had a full port of Explorer, ActiveX and the desktop libraries.
Absolutely. And if the sky fell down we'd all be wearing a blue hat. Regards, -- Jos van Kan registered Linux user #152704
On Thursday 30 March 2006 5:44 pm, Jos van Kan wrote:
Linda Walsh wrote:
Clearly no one here understands the nature of 99% of Windows virii and how they could easily run on Linux if Linux had a full port of Explorer, ActiveX and the desktop libraries.
Absolutely. And if the sky fell down we'd all be wearing a blue hat.
Regards, -- Jos van Kan registered Linux user #152704
I am hopelessly lost here. ( Not aiming this at you Jos, ;- ) but I think I missed a couple of layers of this,um, erm, discussion (?) ) Why would anyone port Explorer ( I am guessing IE is the program?) to Linux ? And ActiveX either? Both of those programs/systems are owned by the MS company. They, I can assure you , have no interest at all in porting them to Linux, at least not any variant of linux that Linus would accept. And I believe he still owns the rights to define what is and isn't able to be called " Linux" does he not? I doubt he will go for "embrace and extend" or "envelope and smother.. " The Explorer functionality we have as in many different web browsers. Top of heap currently Firefox and Konqi, there were several variants from the Gnome groups that I used to use as well.. there are even text only browsers. In the event you wanted to check something and for security reasons you didn't want to allow anything other than text. Or perhaps you are a blind person who has no need of the slower speeds of graphics and do have a "reader" program to assist your web enjoyment... And if you really feel you have lost something by not having IE to websurf w/; well, your legally owned copy of IE can be installed and run, dangers from bugs or virii and all, tho only the user is in trouble. Not for the linux system itself. If you trash your user space you are NOT going to take the system down.. As a normal user you won't be allowed to delete or change vital Kernal parts either. A Commercial company called Codeweavers will sell you a way to setup and use your own legal copies of those programs and several others.. a nice sandbox that they spend lots of time tightening precisely so your warnings from a firewall ( Zone Alarum? ) are not necessary. As someone said, if you open your web browser , do you not intend it to connect to the internet? So why do you need a popup to tell you that it is doing so? Warnings you are being scanned or that someone is attempting to get into your servers or your personal computer ... that is useful.. and there are many of these programs available. As one of the group often says "google is your friend" in these instances. ( I apologise profoundly to the originator of that remark.. I've forgot your appelation. ) As for the firewall issue. Please clarify your usage of "firewall" as a program.. there are once again many to choose from , each distro usually packages one or more ... on a Suse system the builtin one is SuseFirewall ,possibly w/ the number "2" still part of the name... A basic locked down systems will be running from time of install of the distro by default.. ( some of the older versions required one to check a box during the setup for one's internet or lan connection.) At this part of my day I don't recall any more if that step is necessary in 10.0 ... If you didn't set it up on install of the distro, or wish to tighten the open ports it's easy to do in Yast (firewall settings areas IIRC). Of course as an old time user you already know you need root's password to do any of this , whether setup or just reading the info... The Vanilla version of the firewall and kernal have kept many many systems safe w/ the local users needing to know nothing more about it than that check box to start the thing. Even, I might add, while windows boxes all over were falling prey to Mellissa, I love you, and The series of "RED" worms that just blitzed Windows world up to and including the current one . If this isn't what you meant in your attempt to start a discussion , I suspect Anders is correct and I shall defer to his judgement in this matter. <aside to Anders et al > Sometimes, there needs to be translation from feminine usage to male or visa versa since it is abundantly clear the two halves of humanity do not intend the identical meaning and shadings of words, no matter what the National tongue . <heavy sigh> -- j It goes like this , the 4th the 5th , the minor fall the major lift, befuddled king composin' ( song lyric)
troll (learning kind) feeding troll here... On Thu, 30 Mar 2006 11:52:35 -0800 Linda Walsh <suse@tlinx.org> wrote:
If I install FF, on Linux, on startup, *by default*, it will go out and download the Firefox home page after you first install it. Unless you are on a separate subnet and block the use of outgoing port 80, it will succeed. When I install the same program on my Windows box, Firefox is blocked and I receive a popup on my desktop telling me that application "Firefox" is trying to contact host "xxyz" on port 80. Do I wish to allow this?
That ability isn't readily available on Linux.
Is it possible that people running GNU Linux know that this "feature" (feel-good is what it really is) isn't needed - maybe that is the reason it hasn't been created (yet?!?!?- i don't need it.) not worth a reply Linda, let it die.
On Thursday 30 March 2006 13:52, Linda Walsh wrote:
Anders Johansson wrote:
On Wednesday 22 March 2006 18:14, Andre Truter wrote:
Nope, that is wrong.
Please don't let's feed the trolls anymore, Ms. Walsh is clearly not interested in a discussion here.
--- What discussion was addressed to me that I did not respond to?
Clearly no one here understands the nature of 99% of Windows virii and how they could easily run on Linux if Linux had a full port of ^ Explorer, ActiveX and the desktop libraries.
TADA!! You just answered all your inane questions and put downs of Linux in your above statement. Just in case you missed it, the winning 'DUH' from you is......................... "if".
* Linda Walsh (suse@tlinx.org) [20060330 21:52]:
When I install the same program on my Windows box, Firefox is blocked and I receive a popup on my desktop telling me that application "Firefox" is trying to contact host "xxyz" on port 80. Do I wish to allow this?
Experience shows that the average user will just click 'yes' in most cases so the effect is lost. Even if there are reasons to have a personal firewall (I strongly doubt that), you've choosen the wrong list. suse-security@suse.com would be far better to discuss this topic.
the *Linux* way is to convince them how stupid it is to want what they want.
What's so wrong with that aproach?
The reason MS has been successful in the marketplace is that rather than spending all this energy telling me why I shouldn't want what I want, they have traditionally just bent over backwards to enable it
But unlike Linux, MS has a) full controll over Windows and b) the deep pockets to pay people that write such apps. Linux is by far volunteer work, so you have either write such an app yourself, convince those that could do it or hire people who do the job for you. And at lest for the last two points you've picked the wrong list. Philipp
Þann Miðvikudaguren den 22 mars 2006 18:14 skrifaði Andre Truter:
Nope, that is wrong. There have been people that have actively tried to install Windows viruses on Linux and the best that a virus could do on Linux was to delete a few of the user's files. It could not survive for long and it could not propagate itself.
Due to the design of the system, Linux is very unfriendly environment for a virus.
This isn't an infectious anything, it's merely a program that uses several different "weaknesses" in your own system, to acquire access to run on your Operating System. Since the Operating Systems are quite different, a malicious program made for Windows, will simply have similar ability to run on Linux, as a program made for the good old MS-DOS will have. This does NOT mean, that there aren't weaknesses in Linux, nor that malicious software for it don't exist.
FireFox lets you enable or disable javascript and you can tell it to only allow javascript from certain sites.
--- FF is an agnostic technology. It functions the same on Windows as on Linux. You are making my point. Choose better applications on Windows and you'll reduce your security-liability footprint.
Yes, exactly. You said that ZoneAlarm does this, so I said that you can use FF on Linux to get the same functionality. I know FF does this on Windows too.
How does a firewall detect incoming javascript?
--- Many firewall products have this feature. A firewall product sits on the boundary between "out there" and your system. In order for HTTP protocol to be passed "in", it has to go through a firewall. The Firewall simply does "deep inspection". Hardware firewall products (Juniper, et al) have this feature. So do some software firewall products.
Is this not exactly what I said when I mentioned the IPCop plugin?
Ummm.. Intrusion Detection systems have nothing to do with viruses.
---- That's where you are mistaken. I listed virus in brackets because that's what a virus is -- it is an intrusion of an outside program that has been run in some "privileged" mode such that it has installed portions of itself behind for _possible_ purposes of spreading, or just "owning" the machine. Both intrusion and virus detection software look for signs of altered or corrupt software retrospectively. Good intrusion detection software looks for signatures of known root-kits and infection vectors.
No, Intrusion detection systems monitors incoming traffic and react to malicious attacks on your ports. It does not check files for signatures, that is what anti-virus does and anti-rootkits.
Checking the files for viruses is after the fact. An intrusion detection system prevents anything from reaching your system.
--- How many systems are "owned" linux vs. windows? I'd suggest the total is higher for windows. What's the difference in the intrusion detection you are talking about? You are referring to the singular case where someone is actually behind 1 specific attack on your system instead of it being one of a thousand automatic attack vectors. It makes much more sense for a "intruder-wanna-be" to use multiple viruses and launch 10's - 100's of thousands automated attacks. It's not profitable to waste time attacking 1 system unless you have some specific objective. It's far easier just looking for "easy pickings" -- people who have left their doors "unlocked".
I don't really get your point here.
I don't know of a single Linux sytem that has been infected by a virus (that the user did not install on purpose.
Linux systems gets "owned" by people exploiting vulnerabilities on a machine that have the vulnerable software listening on an open port. The other way is to physically gain access to the machine, or to convince the root user to install comprimised software. In the last two cases you are dealing with social engineering and something like AppArmour can protect you there. In the forst case, your firewall and IDS can protect you. In neither of the cases is there any use in having a system that tells you that an application tries to access the internet. If you get to that point, you are already screwed. You should use your firewall and AppArmour to make sure you don't get to that point.
---- Cement-Pro also protects your system. You encase your system in 6-feet of cement. Nothing gets in or out. What's your point?
My point is that if you are worried about a compromised application on your Linux system trying to "phone home", then set up your Linux Firewall to block outgoing traffic too.
--- Same way as on Linux -- if you download a corrupt binary, you lose. If you run a pre-built RPM or binary on Linux you can suffer the same problems as on Windows. Your linux system will be compromised faster since there are almost no linux-virus detector's for downloaded binaries (RPMs). By a feature of the RPM system -- if you install an RPM, you've already used root, so any software you've installed has complete control over your system.
That is why you have gpg signature checking built into your package managers. They act as anti-virus software. All built in.
On Linux you have tools like checkrootkit, etc that inspect every file on your system and immediately lets you know if the file was tampered with.
--- Is it "on-access"? I don't think so. When you install, it uses "HTTP" to go out onto the net to download instructions -- does a linux system detect what applications are accessing HTTP and to what target system? An application like ZoneAlarm will tell you in real-time -- as soon as outside communication is attempted, that program "address book" is trying to use HTTP to contact "owned-systems.ru".
But is it not too late then? That means that you have already been compromised. The idea on Linux is to prevent that situation, not sit and wait until it happens and then it can proudly inform you that you have been owned.
AppArmour is also a tool that will let you know immediately if files are acessed without permission. It prevents the access and then notifies you. So it is pro-active.
---- How does it detect access? Signatures? Are they checked before every execution?
You set up your AppArmour to allow a user access to certain files.
built-in to WinXP but is rarely used that way. I don't know of any Linux distro that ships with such capabilities built-in and enforced by the OS.
AFAIK, SE Linux enforce it.
Well, the idea is that the normal user should not need to worry about security. Linux has been designed in such a way that it looks after itself. You don't need to monitor the security systems.
---- That's what you want to believe -- Linux doesnt' provide a real-time alarm system like zone-alarm that pops up graphically to tell the user about each network access. All it provides are log files that let you examine things after the fact. How is that more secure?
Again, you are looking at this from the wrong side. Tools like ZoneAlarm will inform you that you have already been infected, while Linux security systems prevents you from being infected in the first place.
I would rather spend more time and energy on preventing being owned that being informed that I have been owned.
Perhaps you can instruct the original post on how that works. Personally, I haven't seen that on Linux, but if you have a solution, great! Let's hear it. :-).
I have provided the link, all the documentation and software is there.
My point is still that people coming from a Windows background treats Linux security from the wrong end. The functionality of ZoneAlarm that the original OP wanted is useless on Linux, as it only informs you that you HAVE ALREADY been compromised. If you get to that stage, you can just as well format your disk and re-install as you are screwed.
I suggest that the OP should rather look at the tools that PREVENT a system from being owned.
Those tools are a firewall, IDS, AppArmour, etc.
If you want to know if you have already been owned then you can use tripwire and checkrootkit.
A system like ZoneAlarm will not have any effect if you have been compromised, as the atacker initiate the connection from outside and compromise an application that normally do have net access (how else will they get to the app if it is not listening on a socket). These are applications like sendmail, telnet, apache, ssh, etc.
So, let's look at a situation: You have your Linux system with the newly ported ZoneAlarm running, and it tells you that sendmail wants to access the net. So you say OK, as you want your mail to be sent.
Now the atacker compromise sendmail and they are happily using sendmail to do all kinds of nasty stuff. How will ZoneAlarm protect you?
Sendmail is supposed to access the net.
See my point? You should catch the guy before he gets to sendmail and that is what a firewall and IDS is for.
-- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za
~ A dinosaur is a salamander designed to Mil Spec ~
On 3/24/06, Orn E. Hansen <orn_hansen@thalamus.nu> wrote:
This isn't an infectious anything, it's merely a program that uses several different "weaknesses" in your own system, to acquire access to run on your Operating System. Since the Operating Systems are quite different, a malicious program made for Windows, will simply have similar ability to run on Linux, as a program made for the good old MS-DOS will have.
Yes, this is correct. I was replying to the comment that "Linux will also be vulnerable to the same viruses as Windows" which is not true.
This does NOT mean, that there aren't weaknesses in Linux, nor that malicious software for it don't exist.
Also correct, but it DOES mean that the weaknesses and types of malicious software is very different and should be treated in a different manner. A virus as we define it (a malicious program that imbed itself in a system and then replicate itself and distribute itself to other systems) does not have a good chance of survival on Linux. There are about 40 viruses and worms that has been written for Linux, but most of them are concept viruses created to prove a point, but they are only effective if you manually install them or give them the correct favourable environement and then they only do minimal damage, within the rights of the user it is being run. There was a worm or two that managed to survive in the wild for a short period of time, but they only managed to affect a small number of machine (which had the correct combination of vulnerable software runing on the correct ports, because the administrators are lazy) I remember that when the Ramen worm came out, I was running a RedHat 7.0 system at home and still a Linux newbie. My home box was already patched against it at that time. I just saw the worm's attempts to break in in my logs. So any proper sys admin should have had thier systems patched also. Viruses are not a big threat to a Linux system, due to it's design, you are more likely to be compromised by an actual person breaking into your system. And that is exactly my point. People try to treat Linux like Windows, so they focus on protection against viruses and spyware (a non-existant enemy), while they should be looking for trouble on breakin attempts on thier firewall. It is no use we help newbies to go ghost hunting for a 1% threat while they are totally oblivious to the real threats. We should help people to rather focus on the real threats. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
Þann Föstudaguren den 24 mars 2006 08:41 skrifaði Andre Truter:
Also correct, but it DOES mean that the weaknesses and types of malicious software is very different and should be treated in a different manner. Agreed ... my own sentiment is, that the word "Virus" should not be used at all on Linux systems. I find the word "lame".
A virus as we define it (a malicious program that imbed itself in a system and then replicate itself and distribute itself to other systems) does not have a good chance of survival on Linux. Backdoors have been notorious in Unix systems. I've got one notorious one in mind, that was inbedded into the C compiler itself when compiling "login.c". And creating a system that "erases" itself, is not that uncommon either. Creating a "software" package that does "propagate" some controlling structure, that will ensure the "removal" of the software after a specific date, for an example.
Fact of the matter is, that the "professional" community was using these kind of features long before Windows was born, or became popular. An example of such structure built into a system, was the Atari ST system, which would scan for a specific byte sequence on an even ram address on warm reboot, and execute that block if it found it. This was built into the ROM bios itself.
Viruses are not a big threat to a Linux system, due to it's design, you are more likely to be compromised by an actual person breaking into your system.
Has little to do with the design of the system. It has a lot more to do with how the Linux community is, as in open source and regular updates. A program pretending to be "bash" shell for example, is not going to live long, because its going to be removed and reinstalled pretty regularly. And trying to put something inside a ".profile" script or similar, is likely to be discovered as most Linux users are enthusiasts that are fiddling with these things all the time. As in this community a source code is likely to be scrutinized by many, especially on volatile systems.
It is no use we help newbies to go ghost hunting for a 1% threat while they are totally oblivious to the real threats. We should help people to rather focus on the real threats.
Unix has never strived to be "Idiot proof", like Windows and Mac do. Nor do I think the "Idiot proof" stragedy should be deployed at all. My personal sentiment here is, that the user her/himself is responsible for the security of their data. And in environments where security is of special interest, some security enhancements such as selinux with rolebased access is proper.
On Friday 24 March 2006 21:52, Orn E. Hansen wrote:
Backdoors have been notorious in Unix systems. I've got one notorious one in mind, that was inbedded into the C compiler itself when compiling "login.c". [...] Has little to do with the design of the system. It has a lot more to do with how the Linux community is, as in open source and regular updates. A program pretending to be "bash" shell for example, is not going to live long, because its going to be removed and reinstalled pretty regularly. And trying to put something inside a ".profile" script or similar, is likely to be discovered as most Linux users are enthusiasts that are fiddling with these things all the time. As in this community a source code is likely to be scrutinized by many, especially on volatile systems.
I believe you were referring to this: http://www.acm.org/classics/sep95/ and one of Thompson's points was that you can't even trust the source -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
Þann Föstudaguren den 24 mars 2006 22:31 skrifaði Anders Johansson:
I believe you were referring to this:
http://www.acm.org/classics/sep95/
and one of Thompson's points was that you can't even trust the source
And a point well made ...
-- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On Wednesday 22 March 2006 01:45, Linda Walsh wrote:
Mostly retrospective. Many breakins in the real world happen because of some "anomalous" traffic going *out* from the system.
huh?
I want something that pops up a notice anytime any non-permitted program attempts any action that is out of the ordinary. If my "C" compiler attempts to open "/etc/passwd" with write access, or "/etc/shadow" with _any_ permission, I'd like to see that pop up in real time -- not wait for a log review sometime later when the log in question may have been tampered with or deleted.
ZoneAlarm monitors file accesses??? I thought it was only a simple packet filter AppArmor does monitor file accesses, incidentally -- Certified: Yes. Certifiable: of course! jabber ID: anders@rydsbo.net
On Tue, 2006-03-21 at 16:45 -0800, Linda Walsh wrote:
I want something that pops up a notice anytime any non-permitted program attempts any action that is out of the ordinary. If my "C" compiler attempts to open "/etc/passwd" with write access, or "/etc/shadow" with _any_ permission, I'd like to see that pop up in real time -- not wait for a log review sometime later when the log in question may have been tampered with or deleted.
Then write ZoneAlarm and have them port their software over for you. And if "your" "C" compiler attempts to write to /etc/passwd you are not being a careful by not checking the source you are trying to compile. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998
Tue, 21 Mar 2006, by suse@tlinx.org:
Someone wrote:
Run a firewall like SuSEFirewall. THe default setup should protect you 10 times better than what you are protected on your Windows box.
I enable logdigest on my servers that are connected to the net and I configure it to mail me every hour, so I can see relatively quickly if something goes wrong.
---- The above says it all: instead of having an interactive tool that requires the interactive user's permission, most Linux users have to rely on a "log file" -- that _retrospectively_ will tell you what has happened on your box.
It doesn't allow you to permit/deny traffic in real time, nor does it allow real-time interactive firewall rule construction based on usage.
See, you don't need to if you have an OS which uses a well-defined, and controllable set of network connections, instead of an arbitrary amount of ports and protocols that nobody understands or wishes to know about. If I install a Linux then *I* decide which service listens to what, *not* the "inventor" of the OS or application as it's the case in Windows.
It isn't about the relative strengths of security but about real-time interactivity. Linux is poor in real-time, interactive controls and monitoring.
1st BS. Where is the 'tail -f' util in Windows? Where is the 'ifconfig eth0 down' command in Windows in case of an emergency? Where are the zillion other *nix monitoring applications, freely available on SF.net, for Windows?
I find the discussion about how the user should or shouldn't be doing things amusing -- i.e. "Dear ex-windows user: um, we don't have the features and abilities you want, so we want to educate you on what you think you should want and give you lots of reasons why what you want doesn't really protect you (which is what we wanted to tell you what you really wanted)." Bleh!
Well chosen argument.
*Differences of Win vs. Linux Security model*
There is a fundamental difference in the security model and tools available for windows and for linux. With Windows, you only have the concept of one active user at the desktop -- and that user usually "owns" the computer and usually has that computer to themselves.
Apart from all the others that also 'own' that box you mean.
Such a design isn't where Linux has come from. Linux is descended (in thought and design concept) from unix -- which was designed for multi-user computer sharing -- usually with no one at the console. It wasn't designed for attended monitoring 24x7, whereas Windows is
BS #2. "Attended monitoring" is something different than some poor luser looking at a screen 24/7. In *nix operators are way smarter than that, and have learned to rely on countless scripts to make life-with-*nix easier and more reliable. Something Windows users haven't learned yet in the 10 odd years their system exists.
designed from the point of the "single-user", who is usually in attendance when the computer is being used.
Yeah, "point, click, drooll, repeat"
In the Windows philosophy of _past_, nothing should happen on your computer unless you "instigate it". NOTE: there is a difference between the historic use of 1-windows user/computer and later editions of Windows used as a server. Even Windows as a server isn't designed as *nix has been. Multi-user *nix was the norm and it has been
Then why do you later on claim NT was derived from "mainframe OS principles"? The MS team was helped out by DEC VMS people, a mini-computer OS. NT itself of course, is nothing like VMS. That's BS #3
adapted for single-user use. With windows, it is the opposite -- it was designed for solo, non-networked use and has been adapted for network use.
"Very poorly" you should add.
Everything about Windows was designed for "interoperability" with other Windows computers in a "non-threat" environment. *nix was
Like in a bunker with 40" walls and absolutely no network anywhere near the place.
designed for separating users to allow multiple "academics" to share information, but still keep them separate. It heralds back to "Multics" that was designed with security in mind in the 1960's, but I digress.
And still you wonder why *nix has no need for "personal firewalls"..
Windows in its current incarnation (XP as version 5.1 of "NT") is similar in design to many current *nix implementations. NT was _supposedly_ descended from mainframe OS principles. Like *nix, NT supports multiple users. Like *nix NT supports levels of privileged
Uhm, it can serve files to multiple users, yes, but so can DOS. That is not the same thing as being a multi-user OS. Only Windows 2003 server can really give e.g. a remote desktop to more than one persons simultaneously.
code. NT has superior security features to many *nix implementations,
They managed to hide it well, good job there.
however, it's insecure by *configuration*.
When every damn configuration of the OS is unsafe to start with, it's very hard to see the safeness of the OS itself.
NT (as used for Windows XP sold for individual computers) is still configured for compatibility with the older, single-user Win9x systems. It is the default configuration for usability and compatibility that makes WinNT based systems less secure than their *nix counterparts.
Eventhough they've had, what, 10 years of experience, i.e. right from the start of Win95 (and even before), that "usability" and "compatibility" is basically an open door for malware. Smart people over there in Redmond.
Most NT applications require "root access" to install. Many NT applications install system drivers as part of their typical install. At least WinNT has the concept of 2 driver privilege levels: Ring 0 & Ring 1 (which is different from user processes that operate at Ring 3).
And what do the choose to do?: put all of the drivers that can do most of the harm in ring 0, and give every damn user full access via layers of mystic DLLs, explorer 'shortcuts' to the OS and graphics access calls.
Few, if any *nix systems use more than the 2-ring security model. Single process capabilities have been present in NT since it's 4.x days -- likely 3.x (though I had no experience w/such). Linux had process capabilities so screwed up that they were complete disabled in 2.2.16 (~2000) as a critical security flaw because the implementors and reviewers of capabilities in linux, /at the time/, had a fundamental lack of understanding of how they should work.
If you say so (but you've been giving so much BS already..), but even if it's true, it was solved so fast few people even knew about it. Know fact is: *nix security works, Windows's doesn't.
One of the worst offenders is *non-system software* -- _games_ in Windows. How many games try to install "copy-protection" into a user's computer by attempting direct access to the hardware and/or by installing specialized drivers? Such applications are uncommon in *nix. In historic *nix systems, users _couldn't_ install applications requiring direct-hardware access.
That was because the virtual layer in /dev was adequate to use all of the hardware that existed in those days, without messing with ports and interrupts like windows required.
I could go on for ever on the differences in design, but suffice it to say: if the linux desktop "shell" required constant "root access" to install and run hardware, and if it provided all of the "automatic" features of Win XP, it would be just as insecure (perhaps more so) as Windows.
We have a saying in Holland: "als m'n tante een pikkie had gehad was ze m'n oom geweest" And you are now just FUDding, to make your own point. *nis /doesn't/ do that, and that's _why_ it's much more secure. Looking for none existing reasons how *nix would also be unsecure is BS #4
Some claim it would be "possible to provide the same functionality in *nix". I challenge you to do so with the same constraints on easy of install and control for what ever user is using the desktop. It won't be easy:
So, nothing's lost, only for thse who whish to make another Windows out of *nix. [snip babeling about "zonealarm" functionality]
Note -- manual, human-based *logfile review* is _unacceptable_. It is _reactive_, time consuming and error prone. In the one-hour between being mailed "logs", a well qualified hacker could be in, plant a trojan and clean up the logs to remove a trace of their being there. If you have to sleep or go on a vacation for any number of days, you have even less responsiveness to intrusions.
Like I said before: *nix admins are smarter then their Windows counterparts; they know and use the powers of scripting to the full, and let the machine do the work of man. You remind me of "Lost", where in the 2nd season the people have an Apple computer, and for some reason (we're not that far yet in Holland), every 108 minutes someone has to type in a series of numbers to keep the damn thing happy. HELLO! they have a bloody computer there! How bloody hard is it to make the thing do that on its own. even on an Apple!? Windows admins I find, work in the same way, Laboriously doing the same thing over and over by hand, that what could much easier be done by their computer.
Sorry, but in my opinion, Linux is considerably more lacking in real-time, interactive security response tools that talk to the active user. In the absence of a real-time, at the console user, traffic is *blocked*. This is very *untrue* for the average *nix system, where systems are expected to run "unattended".
You think so, because you obviously have no real experience with administering a *nix system for any length of time, so you think with your Windows-half of your brain when you see a *nix box.
None of this should be taken to mean that Linux, as used today is less secure than Windows -- but it easily could be if it was _configured_ to be as easily interoperable as WinNP is (by requirement of legacy compatibility) to be.
"Interoperability" you claim, of an OS that knows only it's own tongue. - There's no recognition of other hardware filesystems than MS's - No recognition of network filesystems other than MS's - No compiler support for programming languages other than MS's chosen few - No support for other CPU architectures other than i386 Shall I go on? That's BS #5
It should be noted that the main hindrance to good security is _usability_. The less usable a security system is, the more likely users are to find a way to work around it.
As proved by NT's ACL system, that few people understand, and even less actually use. *nix file permission system may look (too) simple for you, but it is practical, easily understandable, and in 99% of the cases all that's needed.
The presence of an easy-to-use, interactive, graphical firewall configuration tool that allows real-time monitoring and feedback -- so a user can see that if an application wants web access, they get immediate prompting that tells them the application is attempting network access, informs them what application(s) are attempting what type of internet access. Post examination of log files doesn't provide that type of interactive training.
"training" to get really fed up with the 'n'th warning of that stupid thing, and either disabling the damn thing, or say "y" or "n" to every warning, whatever it takes to shut it up.
FYI -- I do have linux log files that show me blocked outgoing firewall traffic. It isn't uncommon to see applications (running on Windows through a linux proxy server) to simply and mysteriously "not work". It's only later, if I examine log files and remember what I was doing at the time, do i find that I couldn't watch some "video" because my firewall blocked outgoing ports by my "http-proxy" (squid) to some site. It is rare that I know why the application(s) failed at the time they fail -- there is
So, that's you being less-then-knowlegable about network protocols. Don't come here blaming Linux for your lack of experience.
no interactive message to tell me that a forbidden network traffic type is being automatically blocked. That is way less usable (and useful) than having a popup instantly tell me that my attempt to play some video is accessing some weird port, that isn't in the normal video port
If you need to run applications on Windows of which you don't know what they do, but you think they should "just work", then why the hell do you run a firewall in the first place? Just turn it off, because with a Windows "firewall" you would give permission to go out to the Internet under any circumstance anyway.
range. It's even less easy to "temporarily" allow one specific traffic request through. I.e. - on linux, I'd have to add some firewall rule, go back and run my app, then re-edit the firewall rule to remove the temporary access. **Very** inconvenient. That's not my idea of _usable_ security.
No, that's your idea of how *nix should work exactly like Windows. Well, news-flash, it doesn't! Theo -- Theo v. Werkhoven Registered Linux user# 99872 http://counter.li.org ICBM 52 13 26N , 4 29 47E. + ICQ: 277217131 SUSE 9.2 + Jabber: muadib@jabber.xs4all.nl Kernel 2.6.8 + See headers for PGP/GPG info. Claimer: any email I receive will become my property. Disclaimers do not apply.
On Tuesday 21 March 2006 21:55, Linda Walsh wrote:
It isn't about the relative strengths of security but about real-time interactivity. Linux is poor in real-time, interactive controls and monitoring. <large snip>
Linda - general point: Linux must be doing something right - it has former Windows users like yourself trying it out. But if you want to learn to drive a car as opposed to riding a bicycle, you put the time in. Sorry, but you have to do that here with Linux. You seem to be looking for a Microsoft Windows (behaviour-wise) that is not Microsoft Windows (drawbacks-wise) - doesn't exist, I'm afraid. You either use Microsoft Windows and put up with its general crappiness, or use Linux and invest some time in changing over. Part of this involves asking a specific question about a specific problem you have. Your long spiel does not do that (although Anders and others have tried to pick out question-like things under the general rant). Frankly, new users coming here and saying "this Linux thing better work the way I'm used to, or I'm not going to use it" cuts no ice here - most of us have heard this sort of thing many times before, and Linux' market share is still rising. So my general advice would be to step back, do a bit of research (most of the things you are looking for are available in some firewall package (of which there are dozens on Linux) - try Guarddog, Firestarter, etc), and cut down on the whingeing. -- Pob hwyl / Best wishes Kevin Donnelly www.kyfieithu.co.uk - KDE yn Gymraeg www.rhedadur.org.uk - Rhedeg berfau Cymraeg www.cymrux.org.uk - Linux Cymraeg ar un CD
Kevin Donnelly wrote:
On Tuesday 21 March 2006 21:55, Linda Walsh wrote:
It isn't about the relative strengths of security but about real-time interactivity. Linux is poor in real-time, interactive controls and monitoring.
Linda - general point: Linux must be doing something right - it has former Windows users like yourself trying it out. I thought I should correct this impression. I'm coming from Unix & a Linux background and have been using Windows more. I've been using *nix (including Gnunix since ~'99) companies since '89.
I've started using Windows more because of Linux's shortcomings. That doesn't mean Windows is *perfect* or necessarily even "better", it's like trying to decide which is better: "apples" or "oranges". -l
On Sun, 12 Mar 2006 21:36:11 +0100, you wrote:
On Friday 10 March 2006 18:05, Daniel Bauer wrote:
As much as I understand it (and I don't understand very much :-) ) the SUSE-firewall doesn't care abaout which application is using a specific port, so in my opinion it could easily be possible for a maleficent program to get an internet connection.
maleficient? Please tell me you got that from babelfish :)
Yes it's easy for a program to get internet access in linux, SuSEfirewall2 won't block outgoing connections by default. If you worry about these things, you might want to look at AppArmor, which is included by default in 10.0 and can block much more than just network access
zonealarm isn't exactly the solution. It's not too difficult to defeat, so the only thing you get from it is a false sense of security. If you're worried about outgoing connections, the only real solution is to only run software you trust.
On systems that I'm forced to run windows on, I use both Norton systemworks (includes antivirus) and ZoneAlarm on. ZoneAlarm is configured ENTIRELY to prevent outgoing access from software that's not supposed to be requesting internet access - the whole network is behind a normal firewall, which is (besides being a normal firewall) also running snort_inline - which is configured to monitor inbound AND outbound traffic. Any bets which direction causes me more trouble? Seriously, Zonealarm is really pretty good if you use it the way I do - to catch ET phoning home. I recommend that everyone who thinks Microsoft "really isn't that bad" to watch it for an average week. Mike- -- If you're not confused, you're not trying hard enough. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at catherders.com. If email from you bounces, try non-HTML, non-encoded, non-attachments,
On Friday 10 March 2006 08:25 am, Shriramana Sharma wrote:
I wonder how SUSE Firewall works.
Back in Windows, with ZoneAlarm, when I first install it, it asks me for permission and preconfigures my default browser and mail client to access the net. After that, every new application that tries to access the net or every incoming connection from the net, it asks me for permission.
Don't forget how it then goes about mucking up the rest of your already messed up registry and never gets truly uninstalled, even when you install a good software firewall like Outpost. Unfortunately, my Cisco client for Windows comes with a ZA component.
But SUSE Firewall never asks me anything.
How do I know which applications it forbids and which it allows? How does it know which applications to forbid and which to allow?
Yast > Security and Users > Firewall. There's a ton of fun configuration details there. I currently have my firewall off but if you have it enabled it defaults to things like turning off ports you probably don't need.
I would much prefer a ZoneAlarm-like firewall that tells me what it is doing.
No, you don't. It just sucks up resources. Next thing you know, it's going to be saying, "Dave...that's not a good idea. What are you doing, Dave?"
Please share your knowledge with me. Thank you.
Check out the user manual, chapter 23 either in your dead tree version or online. There's also a program, called AppArmor, which does.... ...um.... ...well.... ....actually I have no clue what it does and can't find anything on it, but I'm sure it does something good. -- kai - www.perfectreign.com www.livebeans.com - the new NetBeans community 43...for those who require slightly more than the answer to life, the universe and everything.
On 3/10/06, kai <kai@perfectreign.com> wrote:
There's also a program, called AppArmor, which does....
...um....
...well....
....actually I have no clue what it does and can't find anything on it, but I'm sure it does something good.
from what I understand AppArmor "hardens applications" -- so I think that means it's a tool for doing a fancy "chroot jail" of an application. p
On 3/10/06, Shriramana Sharma <samjnaa@gmail.com> wrote:
I wonder how SUSE Firewall works.
Like a real firewall
Back in Windows, with ZoneAlarm, when I first install it, it asks me for permission and preconfigures my default browser and mail client to access the net. After that, every new application that tries to access the net or every incoming connection from the net, it asks me for permission.
But SUSE Firewall never asks me anything.
A firewall is not supposed to ask you questions, it is supposed to protect you from the outside. Again the Windows philosophy has managed to screw up the perception of how a computer (or in this case a firewall) is suppsoed to work. ZoneAlarm protects your PC from outside access (or at least that is what it is suppsoed to do), but it also protects the rest of the world against your PC. Because Windows suffers from viruses and spyware which sends out information to the outside world and "phone home" or infect other machines, you need to also monitor outgoing connections on a Windows box, that is why ZoneAlarm asks you every time an app tries to contact the outside world. But, on Linux, we do not have the virus and spyware problem, so we don't need to police our own machine so intensely. The normal firewalls (like what UNIX and Linux, etc use) normally only blocks incoming traffic, as it is suppsosed to protect you from the outside world and not the other way around. But, it is also possible to let a real firewall check both ways of the traffic and I believe this is normally done when the internal network contains Windows machines or when they want to prevent employees from using certain protocols. So, under normal circumstances, you do not need to worry about which application is accessing what, except if you think that your machine has been compromised, but then you need to use a rootkit tool to find the breach.
How do I know which applications it forbids and which it allows? How does it know which applications to forbid and which to allow?
THe firewall do not monitor appications, but ports and it normally only monitor ports for outside access. You can set up your firewall to log everything and then you see in the logs exactly what it is doing. You can also use "netstat -pant" to show you all the active connections and which applications are using it. Or you can use something like etherreal to see exactly what traffic is going where on your machine. There are other tools available too, but I cannot think of the names now.
I would much prefer a ZoneAlarm-like firewall that tells me what it is doing.
I don't trust ZoneAlarm as far as I can throw it, because I am not really sure what it is doing. The fact that it pops up a nice little window that informs me that FireFox wants to access the net does not give me much confidence. I am interested in who is acessing which ports on my machine and I want to see it in real-time as close to the source as possible. I don't have a clue what ZoneAlarm is really doing and what it is showing me. Is it the same thing? ZA feels to me like a black box and I have to trust that what the UI is showing me is what it is actually doing, but I cannot go and look inside to see what is really happening. With the Linux fkirewall I can go and do a dump of the iptables rules and see what it is supposed to do and then I can check my ports and traffic to see if it is really doing what it should. Hopes this helps a bit to explain a bit of how a firewall works. (Although I am not a security expert, but I have played around with a few firewalls and experimented a bit) If you don't trust your own PC or the users of your PC, you can use AppArmour to only allow certain applications to be used. This can be very handy, but it is also a process to set it up, as your need to know precicely which libraries are acessed by an application, etc. But it should prevent unauthorised applications (like spyware, if any exist and is viable for Linux) from running. -- Andre Truter | Software Engineer | Registered Linux user #185282 ICQ #40935899 | AIM: trusoftzaf | http://www.trusoft.co.za ~ A dinosaur is a salamander designed to Mil Spec ~
On Friday 10 March 2006 11:25, Shriramana Sharma wrote:
I would much prefer a ZoneAlarm-like firewall that tells me what it is doing.
Please share your knowledge with me. Thank you.
playing with KDE 3.51 on SUSE Linux 10.0
Here is the link for Guarddog on Packman for SUSE 10. It might meet your requirements. http://packman.links2linux.org/index.php4?action=402&vn=2 regards, columbo -- SUSE 9.3 Pro - KDE 3.5 "If the world should blow itself up, the last audible voice would be that of an expert saying it can't be done." - Peter Ustinov
participants (28)
-
Adam Tauno Williams -
Anders Johansson -
Andre Truter -
Carl Hartung -
columbo -
Daniel Bauer -
Dimych -
JB -
Jerry Feldman -
jfweber＠gilweber.com -
Jonas Helgi Palsson -
Jos van Kan -
kai -
Ken Schneider -
Kevanf1 -
Kevin Donnelly -
Linda Walsh -
Michael W Cocke -
Mike McMullin -
Orn E. Hansen -
Per Jessen -
Peter Van Lone -
Philipp Thomas -
Roger Haxton -
Shriramana Sharma -
Steve Jeppesen -
Susemail -
Theo v. Werkhoven