The World's Most Secure OS (?)

Anonymous Coward writes "Titled The World's Most Secure OS, this article in The Standard talks about what is needed to be "Secure by Default"" Probably the best OpenBSD article I've read in recent months. Theo doesn't pull his punches (then again, he never does), in particular, discounting the "more eyes means better security" philosophy. Then again, he's probably right. [ Update: noeld wrote in with a link to a similar article at rootprompt.org. Must be something in the water. ]

Comments

Default password bloopers

[Lonesmurf]

While on the whole, I don't agree with MS' practices (coding, design, law, etc.), I have to agree with them on the judgment they made the other day (or week, who am I to remember all this crazy tech news) with regard to the default password on SQLServer 7.0.

There is a certain level of aquired knowledge and experience that I believe is necessary to work at the professional level; especially when it comes to the Internet and public software applications. One of the things that any admin knows (or at least should know!) is that you have a hard password and you change it often (I change mine on my server at home on a weekly basis).

My point is this: while an NT admin (or MCSE brat; whatever is at hand) might be able to get away with using a software with a default password, and then blame it on MS, a REAL admin knows his/her system and knows better than to not change a password. BSD is not only more secure because the default install is smart, it is more secure because the user is too.

BSD is secure because it is developed by security freaks that audit (and reaudit) the code looking for possible exploits and programming errors that could compromise a system. They have a zero tolerance stance when it comes to security, and I can do no more than commend them on this. Good job guys and gals, all of us BSDers are thankful and appreciative for all you hard work.

Rami
--

Why don't other OSs profit from OpenBSD audits?

[Leto2]

Everytime I read op Bugtraq that "OpenBSD fixed this vulnerability five months ago through a standard audit", I wonder, why the heck don't they make this fix more public, so other OS's (freebsd, linux, whatever) can also profit from it.

I'm not so paranoid to think that OpenBSD wants to keep their fixes to themselves, in order to stay "the most secure OS out there".

So what is it then? Do other OS's developers just don't look at the OpenBSD pages to see what's fixed?
If it's a public tool (e.g. GNU), do the OpenBSD people submit a patch back?

If the OpenBSD keep up the good work, I think everyone can profit from it and then Bugtraq will read "Thanks to OpenBSD, all OS's fixed this vulnerability 5 months ago"

Most Secure Well Known OS perhaps...

[kabir]

OpenBSD does an amazing job of presenting an extremely secure distribution, I will stipulate that right at the get go. I think it's a bit premeture to say that it's the Most Secure OS though. There are a number of implimentation of the DoD B1 security standard (as applies to operating systems, specifically) in the world - these include Trusted Solaris from Sun and PitBull from Argus Systems Group.

Granted, these operating systems take a quite different approach to security (rather than requiring strict application audits as in OpenBSD they instead try to eliminate the need for such audits through strict kernel control manifested in a number of sneaky ways). These systems have been, and are currently widely used by military, intelligence, financial, and, increasingly, high end e-commerce systems. In an attempt to increase public awareness and popularity of PitBull Argus Systems Group has begun giving it away for non-commercial use. Anyone interested in high security servers is highly recommended to check it out. It's no holy grail, and by no means the right solution for every problem, but it is a very interesting take on the problem, and quite a different way of looking at system architecture and administration than most of us get exposed to on a regular basis.

None of this is intended to steal OpenBSD's thunder - it's a great accomplishment, and far closer to existing operating environments than it's B1 counterparts (which makes it more accessable, and more flexable). Often, a B1 system will be severe overkill (or just too much of a pain to configure and manage), where OpenBSD will just work. So I'm not saying that OpenBSD is no good, I'm just saying that choosing the "Most Secure OS" isn't quite so clear cut...

Oh, BTW, there is a Trusted BSD project, but it's fairly young and as I understand it building a trusted OS is quite time consuming. When it's ready I think it will likely kick ass, but it may yet be a long way off.
--

Re:I wonder...

[-brazil-]

What makes it so hard for RedHat or any other company that produces Linux distros to come up with a super secure system like OpenBSD or FreeBSD?

What makes OpenBSD so secure is not the lack of severs that are installed pointlessly. It's the very, very stringent auditing, the "we don't put it in unless we are 100% certain there are no buffer overflows in it" philosophy. And that philosophy is rather incompatible with the demands of your typical Distro's customer base that always wants all the newest gadgets and features to play around with.

He didn't "discount the 'more eyes ..' philosophy"

[msouth]

Theo doesn't pull his punches (then again, he never does), in particular, discounting the "more eyes means better security" philosophy. Then again, he's probably right.

If anything, he discounted the idea that more Linux users makes Linux more secure than OpenBSD. He says that most of these people can't write programs over 300 lines, and that they're no real help to the security of the system.

But that doesn't discount the idea that, for a given system, more eyes make for better security. OpenBSD would be more secure if more people were doing the same thing that Theo does with it. Okay, there's a possibility of too many chefs spoiling the stew at some point,I guess, but in general I think that it's pretty clear that more eyes looking at a given system makes that system more secure than it would be with fewer eyes.

Anyone arging that any system Foo is more secure than any system Bar if more people are looking at Foo than at Bar has a problem with their logic. (And, granted, most people have a problem with logic.) Like one person posted, his system is pretty secure now that the power supply has failed...

Rather than say that he discounts the "many eyes" argument, I would say that he brings out how important a few well-trained eyes spending a lot of time on a set of code can be. That's easy to forget (or to never know if all you know about writing code comes from reading ESR...).

FWIW
--

Far From It.

[tqbf]

I have some respect for the effort that Theo and the auditors have put into reviewing OpenBSD. I was peripherally involved in the project for about a year, and wrote most of their advisories. I also know Theo personally and have great respect for his technical acumen.

However, the notion that OpenBSD is the "most secure OS", or even the "most secure OS in common use", is absurd. Nor is it the most secure OS "out of the box". Rather, it is the leader in out-of-the-box security in a rather narrow set of popular, open-source, Unix-like operating systems.

There have been commercially-available mandatory access control Unix-based operating systems on the market for years. The "trusted" variants of the commercial Unices are great examples. These operating systems get their security from the compartmental design of the system, and are thus largely immune to (unavoidable) trivial programmer errors.

A great microcosm of this same competition exists in the free SMTP MTA's. Modern, secure mail transports are written in a compartmentalized fashion, so that a bug in one subsystem doesn't compromise the whole thing, or worse, the whole OS it runs on. Systems like Venema's Postfix and Dan Bernstein's qmail (which has never had a published security hole) are examples of this design.

Meanwhile, legacy MTA's like Sendmail and Exim remain popular, despite a history of insecurity. Sendmail's authors would happily claim that, after literally decades of audit, it is secure despite a monolithic design. Nobody that takes security seriously buys this argument anymore, though, because effective alternatives exist that are built on a more secure design. So what's the difference between Sendmail and OpenBSD? Well, OpenBSD is orders of magnitude more complex and has had less than 10% of the long-term attention that Sendmail has had.

Calling OpenBSD "secure" in light of competition from Argus Secure Solaris or even wrapper systems like SeOS is not much better pitting Sendmail against qmail.

It's definitely true that in practical terms, OpenBSD is a more trustworthy distribution of free Unix code than Red Hat Linux. However, with very few exceptions, OpenBSD's design remains stagnant and embraces an obviously-inferior security model. Who do you expect to implement compartmentalization and Mandatory Access Control first, OpenBSD or Linux?

My money is not on OpenBSD in the long run.

NT4 *not* C2 certified

[KMSelf]

If you read the Microsoft NT C2 Configuration article closely, with comprehension, you'll find that it speaks of NT 4.0 being evaluated, but never certified, as being C2 compliant. This was addressed in this BugTraq post. Believe you me, if NT 4.0 had been certified, Microsoft would be singing it to the heavens. But they don't want you to know that. You'll also note that "The C2 Administrator's and User's Security Guide" is itself a MS Windows executable (http://www.microsoft.c om/technet/security/exe/C2SecGuide.exe), hardly the most secure and safe way to transmit data around the Internet. Anyone got an open-standards version of this document?

They also don't want you to know about the man they killed after he first got WinNT 3.51 C2 certified, then told Microsoft that it would not be possible to get C2 certification for WinNT 4.0. Ed Curry, military man, NSA-certified technician, and a former independent contractor for Microsoft first had his business, health, and ultimately life destroyed. I knew Ed only from online encounters in Nick Petreley's InfoWorld forums, but the man was a friend, willing and capable of sharing fascinating information. Ed Curry died in December of 1999 of a stress-induced stroke. He is survived by a wife and young daughter.

What part of "Gestalt" don't you understand?

Re:NT4 *not* C2 certified

[Animats]

OK. Here's NSA's official list of certified products, with the NSA Trusted System logo one very seldom sees. NT 4.0 with Service Pack 6A and additional "C2" fixes made the list, at the lowest evaluated level, after four years of work. That's not much of an achievement.

NSA's computer security evaluation program hasn't been very popular. NSA also evaluates security equipment like padlocks and safes, and back in the '80s when they started evaluating computer systems, they thought much the same approach would work. Early on, evaluations were conducted by in-house NSA staff, under a "two-try" system; the system was evaluated once, and if it didn't pass but looked promising, the vendor was given hints on what to fix. The second try was pass/fail; no further tries were allowed. It wasn't considered the job of the evaluation team to debug the system.

The current scheme is much more vendor-friendly. Evaluation is usually done by outside contractors paid by the vendor. The vendor can keep trying to pass as long as they pay the vendor. NSA then reviews the evaluation. That's how NT 4 got through.

Even under the same criteria, the new approach is much easier to pass. Under the old scheme, vendors didn't go for evaluation until they were really confident of their ability to pass, since outright rejection was possible. Now, vendors can submit whatever they've got and keep debugging until they wear down the evaluation contractor. That's not good. Note that it took Microsoft years of trying to get NT 4 through.

C2 is a very low standard. Nothing below B2 is really serious. It's embarassing that NT can't make C2 out of the box.

The list is depressing. Little has been added in recent years. The security properties of commercial products are so weak today that it's embarassing. Yes, the criteria are dated, but that's not the big problem.

It's for real

[tilly]

I know Karsten from the same online forums that we both knew Ed Curry from. Microsoft did a ton of stuff to him. Some of which simply cannot be sustantiated. For instance after his company was destroyed, at one point he got a job, then his boss' boss got a phone call from Microsoft, and his boss was ordered to fire him. Which kinda sucks when you are supporting a wife and kid.

As for the current location of that online community, follow my .sig.

BTW a question you probably have right now is whether or not we can be believed. Well we both have sufficient credibility to be automatic +2's on this site, and in fact were among the first batch of moderators selected here. You could also do a Google search for either of us. Or look for Ed Curry.

Yeah, what happened to him is pretty astounding. The lack of press reporting on it is pathetic. But I assure you that the basic story is true.

Regards,
Ben

It's not a lie or disinformation.

[malraux]

I was at IWE along with Karsten and Ben, and held several conversations with Ed. His life was basically destroyed by Microsoft because he wanted to tell the truth.


Regards,