Slashdot Mirror
SecurityFocus Linux Focus Area
WebJunky writes: "SecurityFocus.com has opened a Linux security focus area. It has an opening letter from Bruce Perens and some interesting articles, especially one on installing IPsec under Linux. It also has some tutorials on installing Apache and BIND securely. " Cool stuff, course most of us just stick to bugtraq anyway ;)
Why not? Let's have interactive video tutorials about setting up things (Macromedia comes to mind, do they support Linux?). Have documents to teach administrators or newbies etc.
Hmmm but who will instal the installer?
You can't handle the truth.
I think this article will be a good eye-opener for many who seem to think that securing a system means checking the bug lists and applying the appropriate patches, or by throwing in a buzz-word Firewall. Although that is an excellent start, You can see the big difference with NT and OpenBSD.
NT has a decent security model. But Microsoft's goals with NT is functionality, not security. So with file permission defaults such as Everyone: FULL CONTROL and Exchange KM Server Admin passwords being "Password", it's not hard to see that M$ wants Admins to have an easy job. Everything works, but it ain't secure. Although one can configure NT to be secure, it will take many hours of work and tests.
On the other side of the spectrum, consider OpenBSD. Paranoid? Obviously. Everything's off, users have no access to anything, users can't su unless they're allowed. Here, security is well taken care of, but the admin's big job here is opening up the system so users can get some functionality.
Then put Linux in the middle. A relatively secure OS, with (as most distros) almost all daemons running without even asking for them. Shut off sendmail, wu-ftpd, httpd, etc, and boom, magnitudes more security.
Then consider the admin who uses the root account straight through telnet. One co-worker I knew does this on a regular basis, then brags that he's never been cracked!!! Patching bugs is the easy part...
This is only the default setup. Just because by default windows is setup unsecure, it doesnt mean it is an unsecure os. The same applies to openbsd, if the admin knows what they are doing, then they will be able to choose the level of security needed. If they really don't know what to do, then thats their own fault. All of your fixes could be done in about 2 minutes by someone who has a clue as to what is going on.
Yeah, for hardcore geeks that have been messing with Linux for years, bugtraq is just fine. However, some people... including me... could benefit from a centralized location of all sorts of information related to security instead of relying on posts and threads that you could have missed months ago.
:)
I say, what's wrong with another useful tool
I've always like Perens's writings. I feel that he brings a voice of reason to a crazy, rapidly-churning linux community.
As long as he keeps to the same line where security is concerned, this will be one of my favorite sites to check.
Maybe it's because I'm a security nut and my view is slanted toward anybody who preaches security.
I feel that as Linux usage grows, there will be more of a demand for "secondary" considerations. Instead of trying to convince people that Linux is the way to go, there will be a high demand for support for these new users. This comes in the form of specialized tech support and special interest forums. That's just where I see us going in the next year.
I do what the voices on my console tell me to do.
Hate to be the devils advocate....
;)
But the reason it has it's own section is because of all the linux related bugs that pop up on
bugtraq. Before i get flamed, just subscribe to Bugtrag and you will see am not lying
Most Linux distributions, specially redhat, ship such a patch job of a distribution, it's quite
Pathetic
Why they choose not to follow the approach that has made the BSD's less bug prone, it's beyond me
I still Eric think Raymond was wrong about a Bazzar versus cathedral dev model
The cathedral model does not make software bug prone, closed source dev does
well, until so, i will continue to laugh at the gnu su man page... and will continue to Use FreeBSD
FreeBSD.... The Choice of those who know how to choose
I'd like to point out that the correct sequence is:
Up, Up, Down, Down, Left, Right, Left, Right, B, A, B, A, Start.
Hit select between the last A and Start if you want to use the Konami Code for a 2 player game.
Amateur.
love,
br4dh4x0r
OK, so I must be on a bitching bent today, but I've got to vent about this off-topic annoyance. (I'm posting at 1 instead of 2...that's an acknowledgement that I have a problem, at least, right?)
SecurityFocus's Linux section has fonts that are so small as to be completely unreadable on my Mac. Worse yet, they defined these teeny (sub SIZE=1 in HTML) fonts using CSS. Fonts that are defined in CSS can't be changed via prefs in IE or NS, for no good reason.
Now, I'm not some old fuddy-duddy. I like size 1 Georgia and Geneva just as much as the next guy, if not more so. I just wish people would look at their site in a few different browsers. I bet it's got really great info, too. I just can't see it!
I'll go home and see how it looks in M14 on X; maybe it's a bit more legible. I certainly hope so.
-Waldo
Bruce Perens' comment about viruses -"no doubt Linux is in for some viruses and security problems." - willprobably bring hoots of derision from the underinformed.
Linux has at least two major vulnerabilities to viruses. The first doesn't affect Linux directly, but is still embarrasing. If you run Linux as a file server for Win32 machines, and a (usually macro) virus gets a decent foothold in the network, you rely on the Win32 virus checkers to fix it. But they can't (easily) clean it from the file server. The Linux boxes can quite happily continue serving infected files to clean Win32 boxes. Whoops. I believe that we need a native Linux virus checker built as close to the file system as you dare.
The other problem is with binary-only kernel modules that allow connections from userland. Another post today about 'run anywhere' device drivers has exactly this architecture. Unless the supplier of the binary has done a *perfect* security job, there is a possibility that a virus-writer could exploit the binary module to do almost anything to the kernel.
The main protection that Linux has had so far from viruses is the culture of Unix. A Unix programmer good enough to write a virus would spend their time doing something useful. This will change. If even a tiny proportion of the trolls/mp3 warez lusers on this board learn some programming, we could all be in for a difficult time.
Share and Enjoy.
I understand and appreciate the fact that banner ads allow a web site to stay in business, but having banner ads that can't be scrolled out of sight is extremely tasteless.
Video? Bleech! I don't want to download for six hours (and that's on a cable modem :) to see some tech support person (or worse, Eric Raymond or one of the egocentric /. maintenance types) give me bad advice.
I'd much rather wait 10 seconds for a web page with inline screenshots. Same content, much faster, no looking at ESR. Better, no?
I use the Linux version of the flash player all the time because my job requires me to view Flash animations.
I don't know if they plan on making a Linux version of the Flash creator, or any other apps, but we may see something like that in the future.
Someone playing archaic video games. Loser.
If your box is patched for all publicly known exploits, and security holes, that means very little. There are A LOT of "underground" Security exploits crackers use. This is for ALL operating systems, not just Linux and NT. Another problem that plagues linux is lazy admins. Most Linux users aren't willing to take 15 minutes out of there days time and remove those unneeded services out of inetd.conf, and their rc scripts. The same thing goes with admins. The Linux community has its own little "MCSE" type thing going. "Oh, I can install Linux so I guess im qualified to admin a 4 node Xeon Web/SQL server cluster". Or they say "I've been using Linux for 3 years, I'm experencied". When allthough they may know the Linux ins and outs well. They know JACK about security. Linux community needs to crack down hard on security (excuse the pun). Quite a few people poke fun at NT but I say Linux and NT are equal, atleast NT admins have enough common sense NOT TO RUN WEB, DNS, FTP, SMTP, IMAP, TELNET, SUN*, ETC ETC ON A BOX THAT IS ONLY FUNCTIONING AS AN INTERNET GATEWAY! And as far as *BSD users go. There is quite a knowledge base with them, BUT you have to beat it out of them. I find it very hard to talk with BSD users about security, they don't have that "share of ideas" the Linux community has. So common, secure up those boxen! :)
For those who are very concerned with Security you should take a look at Mandrake. Depending on the "type" of install you do you can have up to 5 different security levels. The worst being "Welcome crackers" to the top "Paranoid". The Paranoid level is so paranoid that each part of the server is broken into groups and required specific access grants (via users being part of multable groups)for almost everything.. ie cdrom/floppy/sound/different exaeute permisions (/bin /sbin /usr/bin /usr/sbin etc), X, telnet ftp etc... and services are secured very nicly. But what really takes the cake is the logging. Just sitting on IRC I was able to watch my system be scanned, atempted ftp/telnet/ssh etc... Anyway there is alot involved in what Mandrake does for security and I couldn't even begin to give them a "good plug" for ther product... try it for yourself! :)
As someone without the most experience, I like knowing that I have a range of choices when it comes to security. If I want to be paranoid, I can use OpenBSD, and learn to set up the extra stuff I want. If I want to have more fun, I can use linux and learn to turn off the junk I don't wank. And if I just want to screw around and put up with the occasional crash, I can use Windows, and avoid doing anything patently stupid.
Hopefully though, security will start to become the default in more places than OpenBSD. It will be interesting to see what happens with respect to computer security over the next few years; as more people get connected to broadband and the net in general, will a similar increase in compromised systems force people to worry about it more? or will the level of computerized mischief remain low enough that only the semi-paranoid put security as their first design priority?
-------------------- the list is long. dirac angestung gesept
Games like Contra, Life Force, Super C... and you call him a loser?!?! Sombody needs to pick up a controller and re-discover what it is truly all about.
every time I visit this site, I swear to never return.
Their site has so much unnecessary formatting and takes so long to load. Obviously they're not interested in attracting unix sysadmins, or mobile users using a mobile browser.
I recommend http://packetstorm.securify.com - they still have a medium amt. of html fluff, but at least it works in lynx.
1) Go to securityfocus.com.. go make dinner and watch a sitcom, this fucker takes forever to load up with its dancing refreshing ads.
2) Find the shit you actually want to look at and right click, Open frame in a new window.
3) Close original Netscape thus killing the three ring circus that is securityfocus.com, denying them the ability to spam your brain to death with thier useless drivel. Assuming that closing Netscape didn't cause Netscape to bus error and close all Netscape windows, you can read what you want in peace. This works well with the bugtraq archive.
Whoever designed that site is a raging alcoholic, I think.
Lars -
Check your named directory and see if there is a subdirectory named "ADMROCKS". If it's there then you are running a vulnerable BIND and have been owned. If it's not there then you are probably safe.
Really. It's that bad.
(If you don't know, "ADMROCKS" is the footprint left by a popular BIND exploit.)
heh... I stand corrected... however, we used select since the dorm chums were helping us save the Earth :) That and Baseball Simulator 2.000
Yawn. Give me Quake anyday. But to discover "what it is truly all about", I usually turn off the monitor and go outside.
There is text, and when you click the 'start' button, the cursur on the screenshot does something, and you see what happens - i.e. if it is a documentation page on writing 'helloworld.c', it would show the user opening the IDE, starting a project / loading a file / whatever, typing in the code, going to the 'compile' IDE option, and executing the executable (for arguments sake, of course).
It's a pretty good idea for certain applications. For 99% of traditional UNIX stuff, it's dumb (err, how is that useful if I want to configure Apache?). But for stuff like GUI design tools (the GIMP, video editors, etc), it could be pretty neat (for newbies at least).
Macromedia bundles the movies with the product (as a direct part of the documentation), so you don't have to download them.
Hmm. Did you know that bugtraq has been part of securityfocus.com for a while now? Or were you just trying to be buzzward compliant?
Linux has not yet met the "seedy" software market, and has not yet done anything to expose itself to viruses. This will come when Linux finally accepts the inevitability of large scale closed source software on their machines. The linux community will eventually have to unravel into a user base if it is to be successful.
Well there are two debates in that last statement, and ill get to them both.
First. Linux has to accept Closed Source for this to happen. There is going to be no way that applications are going to make it to the penguin without this.. and when they do.. there are going to be the people who are going to not want to pay for them.
Boom.. viruses will come that way
Second, the linux community is a fairly clean one, with people out there to help and promote the OS. Windows, is just a bunch of people using the easiest software. What if linux overthrows Windows? Its gonna trade places. Malicious code is going to go from the hands of the bored to the machines of the unwitting. RIght now the community is actively involved with the good of the community, and there are very few people "forced" into using the software.
It will come with the degradation of the user base, if linux gets to that point. Linux cant sell without marketing to the masses.. the same masses that will bring troubles to this group.
It almost seems like linux does better with MS around... food for thought
--jay
I think Linux is due for an official, top to bottom security audit.
Do you think so?
Muchas Gracias, Señor Edward Snowden !
How feasible is that? Everyone does something different with their systems... some people are huge fans of shell scripts.. are you going to write them in perl, or python? Do you want to script? Do you want to re-code your daemons? How do you want to use your groups? Tuning X anyone *shudder* Not something that is particularly the easiest thing to explain to anyone
Linux is too diverse for even an interactive tutorial to truely give it justice. And it would be difficult with all the distros in mind.
Besides how marketable is that. Linux right now is only used by those in the know. And they all like "man" better anyway....
--jay
> well, until so, i will continue to laugh at the gnu su man page...
/etc/pan.d/su file
Just patch su with to support PAM, add the apporpriate line to the
and presto! Wheel support!
Some distros (RedHat, Debian) have PAM support compiled in but you still have to edit your PAM config files.
Argh! I can't even get the page to load, let alone get to a point where "Open in new window" will work!
Of all people, SecurityFocus should understand that there is no way I'm turning off my Proxomitron to look at their site.
I can't even read it with Lynx! After about a minute of waiting for a reply, I get an "unexpected network read error", and Lynx exits! Who ever heard of a web site crashing Lynx, for Bob's sake?!? Double and triple argh!!!
Seriously: Any and all suggestions appreciated. I want to be able to read SecurityFocus, is that so wrong?
(Does anybody else think that SecurityFocus might just be a huge honeypot infected with all sorts of browser vulnerability exploits? Naah, me neither.)
whuppy enjoys smelling like diesel fuel