Battle of the Secure Distros

CrazyEd writes "LinuxSecurity is reporting that EnGarde Secure Linux has received the Network Computing Editor's Choice award to win the battle of the Secure Linux distributions. Well deserved, me thinks." Update: 06/10 15:16 GMT by T : An anonymous reader points out that Linuxlookup.com reviewed this distro last week, awarding it a perfect score.

Comments

Ad Revenue?

[bLanark]

When I visit the site to check out the story, I see a banner ad for - EnGarde Secure Linux!

(I'd do the same, of course)

Re:Ad Revenue?

[opcenter]

LinuxSecurity is the same company as EnGarde Secure Linux, but they didn't write the review, they just linked to it (as they should, it's good and free marketing for them). The review was done by Network Computing who is not affiliated with them.

Re:Ad Revenue?

[DontBugMe]

Even Linuxlookup.com ( http://www.linuxlookup.com/html/reviews/software/e ngarde1.1.html ) gave Engarde Linux a perfect score last week and they don't even have ads! Doesn't mean the editors at Network computing were bias during the review for selling ad space. bah

Re:Great!

[UnderAttack]

In particular no problem at $550 a pop...

Admin

[sofist]

A distro is (or any software for that matter(yes Windows to)) only secure if the admin who runs the distro knows what is he doing.

Re:Admin

[nickread]

And that is of course the easy part

Re:Admin

[alapalaya]

I disagree with you. I think that to be a good sysadmin is quite difficult and requires a lot of study, trial and error and passion. (Please note, I'm not a sysadmin, even if I can accomplish the easier sysadmin tasks).
In particular, you must know in deep detail all the technologies involved in a complex networking environment (they are countless: DNS, email, NEWS, NIS, LDAP, routing, and so on...).
It is difficult to barely know all of them, and to secure an installation you must know them good. And this is no easy...

Of course I agree with the point that the software must be "secure-able", otherwise you can be the best sysadmin... you system will always be full of flwas if the software you are using is bugged (...who said something about the windows?...).
Cheers

Re:Admin

[UnderAttack]

IMHO, a 'secure distro' is secure by default. You plug in the CD, turn on the box, install it and just keep clicking 'ok'. At the end, you should end up with a secure box. Now it is up to the admin to open the holes.

However, many distros go a different path by enabling services and allowing installs with weak passwords (or no passwords).

For a nice security benchmark, see the Center for Internet Security. I wait for the day where a default install of RedHat will score a perfect 10 with it... (It is more around 5 right now on their 0-10 point scale).

Re:Admin

[dgym]

Too true, any secure system can be made insecure by a poor admin, but not all systems can be made secure by a competant admin.

These secure distros try to be by default very secure and should only normally become insecure by an admin doing something silly or not keeping up to date with patches. Some of the other distros don't pay as much attention to security, but a really good admin can nail these systems down too. I for one like the fact that this distro comes with no setuid-root programs, its a good precautionary measure.

In some systems, admins do not have a chance to secure the machine because of lack of control. This is normally the case where closed source software kindly leaves you with a gaping security hole, and until someone eventually comes out with a patch the best you can do is stop using it. Ofcourse you were probably using this software for a purpose, and so not using it for a while could not be an option, hence an all too common situation of knowingly running insecurely, and there is nothing the admins can do.

Infact millions of people have done this recently, with the realease of XP the installation was vulnerable to network based attacks from the start. The only way to correct the problem was to install a patch - which meant you had to connect to the internet using that machine to register the software and get the patch from 'the company that shall not be named'. When you have to make yourself vulnerable to get the patch that stops you being vulnerable, security is impossible.

The most valuable part of EnGarde Secure Linux is probably the patch system, if it (or something just like it) was taken up by more distros then securing boxes would be easier and therefor might happen more. I would like to see something similar in gentoo keeping me up to date, because finding out what is going on is often the hardest part. Was there a ptrace vulnerability I missed? Ohh damn.

Re:Admin

[fruey]

The key is this: there are too many admins who patently don't know what they're doing, and some who will even admit it.

I spend a lot of time with other people's networks, and have yet to see one which stands up to how I would run my network. That's how I make money, incidentally - fixing other people's networks and securing them where possible.

A guage of how secure things are out-of-the-box is important. Some people will never switch off the default daemons, etc. Some people insist on using some Microsoft DCOM rubbish and opening holes over their firewalls to do it because they can't do anything else. They don't know how and don't care to know.

So, this kind of survey is important for those lesser admins who are probably not geeks and just trying to hold on to their jobs. Perhaps they are good at other things and valuable for the company, and the same is too tight to invest in a proper sysadmin so they dump him the job because he can hack a few basics together and get it to work.

All those of you saying "RedHat isn't secure out of the box" and all that OpenBSD stuff are already enlightened. These surveys are not for you. They are for all those other readers who don't fathom why you're mentioning OpenBSD in the first place.

Re:Admin

[guacamole]

Well, then by this standard RedHat (7.1 and up) is fairly secure against external threats because a minimal number of services are running by default and all ports under 1024 are firewalled off.

Re:Admin

[shren]

I can not find the CIS benchmarks on the CIS page. Do they only release tools and not the result of benchmark tests?

Re:Admin

[guacamole]

NFS locking and portmap are running but both ports are firewalled off by default. NFSD is not running unless you enabled it. LPD is running but it is also firewalled off. Medium security (which is the default) is all that you need for this kind of fireall. Highest security level is wayyy .. too restrictive.

NSA not even mentioned.

[bodin]

Interesting that the NSA security enhanced linux is not even mentioned.

http://www.nsa.gov/selinux/

--
I vote for OpenBSD

Re:NSA not even mentioned.

[octogen]

NSA SELinux is (currently) not meant to be a secure Linux distribution. It's rather something like a "Demo"-Implementation of MAC in the Linux-Kernel.

Quotes: NSA SE-Linux FAQ
13.Is it secure?
[...] Put another way, "secure system" means safe enough to protect some real world information from some real world adversary that the information owner and/or user care about. Security-enhanced Linux is only a research prototype that is intended to demonstrate mandatory controls in a modern operating system like Linux and thus is very unlikely to meet any interesting definition of secure system. [...]

16.Did you try to fix any vulnerabilities?
No, we did not look for or find any vulnerabilities in the course of our work. We only changed enough to add our new mechanisms.

You can find the full SE-Linux FAQ here

Re:NSA not even mentioned.

[pstreck]

SELinux isn't designed to be a standalone distro, but a set of enhancements to common software that is in all distros.

Better than SELinux?

[I)_MaLaClYpSe_(I]

I am currently trying to write a HOWTO/make an RPM for the NSA SELinux to work with a SuSE distro (Vanilla kernel)...

Shell I stop doing so now and just install this distro instead?

Is it really more secure than LVM/RSBAC patched kernels with additional hardening?

For sure?

just my two cents...

RedHat

[ranulf]

It's a shame given how easy it is to make a RedHat box secure that they don't just do it by default.

Because I'm always installing Linux for clients, RedHat is always specified, so I have no choice, but I've got it down to taking about 10 minutes to have a really secure box. It's just a case of knowing what needs to be done, which sadly, Linux newbies won't know.

In my opinion, security should be paranoid to start with. If that stops the users from doing something, fine. They'll have an incentive to try and figure out how to allow what they wan to do. Make it too easy, and they'll just live in blissful ignorance.

Re:RedHat

[Phil Hands]

Because I'm always installing Linux for clients, RedHat is always specified, so I have no choice,...

I too regularly install GNU/Linux for clients, and more often than not they specify RedHat (occasionaly SuSE), but I've not installed anything other than Debian for years (except during RHCE/RHCX courses ;-), so you do have a choice.

The trick is to ask them why they specified RedHat. Most of them will cheerfully admit that they said that because it's the only distro.they've heard of so they were saying "RedHat Linux" in the same way they might say "Microsoft DOS", never realising there was a "DR-DOS" (once upon a time ;-).

It doesn't normally take too much effort to convince them that they are paying me for my expertise, so if I recommend a particular flavour they might as well listen.

The only time I'd take such a request seriously would be if they were already a RedHat shop, and had a lot of in-house RedHat expertise.

The last time that was claimed the "expert" turned out to be clueless, and the existing RedHat systems so broken (9GB swap, 800MB root, permissions all +rwx) that I ended up having to reinstall them anyway --- they're a Debian shop now ;-)

I've since decided that any RedHat shop that decides to hire me in, is probably not full of experts (otherwise they'd do it themselves), so take a lot of convincing that going with the flow is the wise thing to do.

If you have a good technical reason not to install RedHat, and you can justify it, give it a try.

The worst that happens is they say no (and you get to look smug if their decission bites them).

The best that might happen is that they decide to respect your opinion, which bodes well for the future business relationship, and means you get to work on the system you feel best fits the problem, which avoids stress and frustration.

Re:RedHat

[xtremex]

I use a 486 running IPCop as my firewall. Works absolutely fantastic. Web based interface. It's a spinoff of SmoothWall because the owner's a dick. :)

Re:RedHat

[ceswiedler]

A completely valid reason for insisting on RedHat, even when you the expert prefer Debian (for also valid reasons) is that it's much easier to find a RedHat admin to replace or support you, because of the RHCE courses. In general it's easier to find admins for RedHat, particularly less-experienced ones. Wizards tend to be capable of dealing with any flavor of OS, but you don't always want to pay for a wizard.

If you were going to set up a large and complex shop, and then turn the maintenance over to $60,000/yr worth of support personnel (whose turnover rate might be high), which distro would you recommend?

I know a shop where the head admin is having to get rid of Linux boxes (for Windows ones), because no one else in the company knows Linux. He understands that it's not just technical superiority that matters, but supporting the technology as well.

Re:RedHat

[ranulf]

Depends on exactly what your requirements, but generally turn off everything you don't need.

I start with a shell alias like this:
alias nsl='netstat -alnp --protocol=inet|cut -c-6,21-94|tail +2|grep -v ESTABLISHED|grep -v CLOSE_WAIT'

At a glance you will see what services are running and listening to ports. The "Local Address" column is the most useful. Anything starting 127.0.0.1 can be safely ignored, the rest will be based on what you feel you need.

As a general rule, boxes I configure offer WWW (port 80), SMTP (port 25), POP3 (port 110) and DNS (port 53). I turn everything else off, or if I do need it, I firewall it (see later).

Now, how to get rid of things. Obviously, this varies from thing to thing, but take for example the lines starting
udp 0.0.0.0:2599
tcp 0.0.0.0:
udp 0.0.0.0:111

Now, as I'm not running NFS or NIS, I don't need any of these services. If you're not sure what, say, port 111 is, the -p option to netstat is great - it lists the PID and process name, so we know to close down portmap. Now, this is started by /etc/rc.d/init.d/portmap via a symlink in /etc/rc.d/rc3.d (assuming you start in runlevel 3). Simply rename the link there to start with a K, like this:
[root@pootle init.d]# cd /etc/rc.d/rc3.d/
[root@pootle rc3.d]# mv S14nfslock K86nfslock_S14
[root@pootle rc3.d]# mv S13portmap K87portmap_S13
[root@pootle rc3.d]# ./K86nfslock_S14 stop
[root@pootle rc3.d]# ./K87portmap_S13 stop

Now, run netstat again, and see what ports remain for you to tidy up. You'll probably remain with ones that you really do want to keep, e.g. postgres on 5432, tomcat control on 8008, MySQL on 3306, etc...

This would normally be a job for the firewall. If you have one, use it! However, just in case a machine inside your net is compromised, you can run additional filtering rules on every machine. For instance, my /etc/sysconfig/ipchains file looks like this:
# open up the POP server
-A input -p tcp -s 0/0 -d 0/0 110 -y -j ACCEPT
# open up the WWW server
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT
...
# close all reserved ports
-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT

# protect mysql
-A input -p tcp -s 0/0 -d 0/0 3306 -y -j REJECT
# protect postgres
-A input -p tcp -s 0/0 -d 0/0 5432 -y -j REJECT
-A input -p udp -s 0/0 -d 0/0 1026 -j REJECT

and so on. Basically, the theory is, explicitly open up the ports <1024 that you want to allow access to, and block anything else to the priviledged ports. Then, by default allow all higher ports access (otherwise, you'll get problems connecting from the machine to other machines), but explicitly close services you don't want publically available, e.g. databases, etc...

Other stuff you'll want to do is remove telnet and ftp from your machine and install openssh. With both of those protocols, you run the risk of passwords being snooped along the way, and ftp gets hacked fairly regularly. If you do need to upload files regularly from Windows machines, check out WinSCP2 - it's really good.

Next off is protecting services that have a track record of being hacked, such as named. There are several tricks; running as a non-root user is always best if you can, running in a chrooted environment is better still. The first gives the program so few privileges that it can basically only access files it owns. Good, unless you have have local root-exploitable holes. The second runs the application completely in a sandbox, where it sees a very restricted view of the directory system, e.g. on my machine, all DNS data lives under /chroot/named, and if it was hacked, the best they'd be able to do is destroy DNS data. This can be complicated to set up, and I'd advise you to search the web for in-depth discussions.

I will often use a combination of techniques, e.g. DNS on my systems run as user named, live in a chrooted filesystem, and also have packet filtering rules, so that they only talk to machines which are dedicated secondary DNS servers.

Of course, you also need to audit anything that is left available. If you run CGI scripts that will accept data unchecked and pass it to a shell command, your machine will be compromised. Keep an eye on security mailing lists or websites - if you run software that vulnerabilites are discovered in, you need to patch them quick, e.g. SSH bugs found a few months ago, etc... But by keeping things down to an absolute minimum (using seperate boxes for each service if you can) and really considering who needs to use them, you stand a good chance of being really secure.

This is getting too long now! Hope some of this helps...

Re:RedHat

[SealBeater]

it's much easier to find a RedHat admin to replace or support you, because of the RHCE courses.

Have you ever seen or taken the RHCE tests? Granted I haven't either, but I took the BOSON practice test. Now I am not saying that there is any relation between the two, but the practice test was full of questions such as "What is listed in the submenu when you right click the GNOME foot?" and "What's the best way to laugch NAUTILUS?" If that's the kind of test you have to take to pass, forget about it.

In general it's easier to find admins for RedHat, particularly less-experienced ones.

You get what you pay for.

SealBeater

Re:RedHat

[xtremex]

Well, actually, I have 7 boxes (a Sun Ultra, A couple *BSD boxes, and a couple Linux boxes). I use the firewall box (small system, 700 MB harddrive) to forward ports to the other machines. My solaris box is a Webserver, and I have a freebsd box as a webserver as well. I have a CVS box. I just have tons of crap on my network. :)

Re:RedHat

[Peter H.S.]

You (and all those who come after you) would find it significantly easier if you simply did:

/sbin/chkconfig --del nfslock
/sbin/chkconfig --del portmap

It is important to note, that the services continues to run after this, until the box is restarted, or the services are explicitly shutted down.

A "/etc/init.d/[service] stop" should be issued after deleting it with chkconfig.

That said, chkconfig is a breeze to work with, and probably the first command I use, on a newly installed Red Hat box.

Re:RedHat

[Phil Hands]

Have you ever seen or taken the RHCE tests?

Yes I have (to my shame ;-) I'm an RHCE & an RHCX (i.e. I get to invigilate RHCE exams).

The RedHat test is a pretty decent test, unlike the one you describe. There are one or two bits that I found anoying (as a Debian user) because they appear to have decided that rather than fixing some things that I'd consider to be usability bugs, they'll just add the work-around proceedure into the test, but that only accounts for a couple of percent.

I'd be unhappy about letting someone that failed the RHCE be a sysadmin on anything I cared about.

Most people that pass it, and also get a year or so's experience around the same time, can probably be trusted to have a clue. They also would have little trouble administrating a Debian system, or any other GNU/Linux system, once they got over their confidence problem about it not being RedHat.

After all, I got 99.6% on the RHCE exam, and the first time I had installed RedHat was 4 days earlier at the start of the fast-track course. It's really not that different from Debian (/etc/rc.d/nit.d vs /etc/init.d, rpm vs dpg, um, what else?)

LINUX BG

[oliverthered]

I have the most secure distro,
but unfortunatly you can't have a copy, just incase you find a bug.

Logon requires you press ctrl+alt+delete , because it's oh so hard for memory resident apps to not die when this happens.

My mouse has only 1 button to confuse any computer literate people, and allow me to catch them in the act.

I've remapped the keyboard, to confuse those who touch type.

No network (because the kernel dosn't have the correct drivers),

No-ones hacked it yet.

I don't give a flying filesystem check

[gd23ka]

... if some website or magazine issues an "editor's award" or whatever to product, _especially_ when we're talking about security.

Orange Book etc

[Dynamoo]

Because someone always mentions DOD-5200.28-STD Trusted Computer System Evaluation Criteria ("Orange Book") compliance let me just say by the time it would get round to being certificated as a proper defense-grade OS it will be hideously obsolete - the latest Micro$oft OS to be certified "secure" (hahahahah) is NT 4.0 which shows how long the process takes. Take a history trip and look at some of the Certified Products.

In any case, to be a properly secure distribution you need DoD/NSA style certifications. The Common Criteria go part of the way there, but again certification is slow and really not universally accepted. (There's a flame bait for you CC fans).

Bottom line - true security requires seriously lengthy evaluation and certification. And even so, a product like NT 4.0 is still being found to have security holes to this day.

Sigh.. anyone fancy rewriting Multics for the Intel platform? :)

Re:Orange Book etc

[broody]

If the the EGOVOS announcement goes beyond vapor, CC may be in the future of Linux. For some reason though Slashdot just won't accept that as a story.

BTW, you might want to get a handle on the basic background of CC before shooting your mouth off. TCSEC is no longer accepting new products for evaluation, though those who started the old process can finish it. Common Criteria really means it now. Read the friendly website.

Re:Orange Book etc

[SuiteSisterMary]

It's worth mentioning that the above poster doesn't know what he's talking about. No operating system in the history of the series has ever been rated as anything. Why? Because the rating takes into account all of the other important factors for computer security, like hardware, setup, physical location, and so on. So, yeah, the last time Microsoft submitted a system to be tested, I believe it was compaq hardware, it got the coveted C2 rating. But they never bothered since, because you need a full and functional installation (and I mean physical, not software) to be rated. I'll also point out that "Linux" as it stands doesn't even meet the basic requirements, such as ACLs. Yes, they can be bolted on, but....

Re:Orange Book etc

[xtremex]

dynamoo listed UNICOS as secure. I rememebr UNICOS when I was in the service. That was truly a beautiful UNIX. I would HOPE they call it secure, since the Dept of Defense is the major purchaser of Cray IIs!

Re:Orange Book etc

[Shirotae]

It's also worth mentioning that the second you attach that NT system to a LAN (or any other network iirc) it is no longer C2 certified.

That is not the case for NT4. The cited report refers to the NT 3.51 evaluation since the NT4 evaluation had not been published when it was written. The summary of the NT4 evaluation says "A networked configuration was evaluated for interconnecting the various hardware with Windows NT workstations and servers.". The full evaluation report is available for those who want to read it.

Windows NT4 (with specified SPs and fixes) also has an ITSEC E3/F-C2 certificate, and networking is mentioned in that one too - search from the CESG certified products page if you want details.

These certificates do not necessarily mean much in practice, but we should refer to up to date ones if we refer to them at all.

There can be only one...

[Noryungi]

OpenBSD 3.1!!! =))

Sorry, could not resist...

Re:OpenBSD

[Gleef]

They at least should have included OpenBSD in the testing, for comparison's sake.

Tinfoil hat Linux

[Anonymous Coward]

What, no mention of Tinfoil Hat Linux? :)

I disagree (with your disagreement...)

[jabbo]

and I am a professional sysadmin. I get paid a lot to do my job and I don't feel like there is anything mystical about it (that sort of nonsense is for university admins that have to deal with incompetent bosses -- more power to 'em, but I don't). What I feel adds value is not mere understanding of the protocols (relatively easy) but rather, the ability to choose the correct tool (protocol, framing, hardware, software) for the job, and make it work so that the rest of the people involved can do their jobs without noticing (or if they do, saying, "hey, that's really cool and easier than before!"). Needless to say I do a good deal of development to make this happen, and again, that is more challenging than administering boxes (IF you start with a sane rollout and upkeep process -- yes, RPM/apt/pkg_add is your friend; yes, CVS/CVSup/Rsync is your friend; no, ad-hoc changes are not the Better Way to proceed).

When you rattle off NNTP and crap like NIS/LDAP as if they were equivalent in complexity to full BGP4/MBGP routing, I think you belie a superficial understanding of the situation. Even something as nastily complicated as BGP route maps is not nearly as challenging as dealing with people, professionally and personally, in a fast-paced environment that values results over process or the latest fad technologies. In that respect I do not believe it is significantly harder to earn one's keep as a sysadmin than to do so as a VP Sales or a Comptroller. It's just a totally different set of technical skills used to do the job.

I don't doubt that you meant well, but really, choosing the right tool for the job (and then using it well) is not so difficult in most cases. 'Tis a poor craftsman who blames his tools!

Re:I disagree (with your disagreement...)

[npsimons]

'Tis a poor craftsman who blames his tools!

Yes, but even a master carpenter can't build a house out of rotten wood.

This has been my mantra over the past couple of weeks as I've been forced to try to get low level hardware and software working with Windows.

Re:I disagree (with your disagreement...)

[jabbo]

Yes, but even a master carpenter can't build a house out of rotten wood.

This has been my mantra over the past couple of weeks as I've been forced to try to get low level hardware and software working with Windows.


Fair enough. I've been in that exact situation with Windoze before (trapped into it, in fact) and you just have to trudge through as best you can. I hate Microsoft server OSes (and attempts to use their client OSes, or more pointedly, crippled versions of the same thing they sell as server OSes, to do anything reliably).

The upside to this (IMHO again) is that most shops which run everything on Windows are such amateurs that they won't notice downtime until it is on the order of "one nine" (eg. vs. "five nines") :-)

Doing anything interesting with Windows and hardware that needs to run reliably... well, best wishes, my heart goes out to you. ;-)

If it helps you debug the whole get-up (eg. if you need it to run in lock-step across multiple sites) there is one piece of good news -- NTP runs on Windows and is documented (both in an O'Reilly book and elsewhere on the Web). Just something that came to mind after an earlier poster brought up NTP. Good luck.

Downloads

[NewbieSpaz]

The i386 (i486 and i586) version
i386 "Bonus" Package
The i686 version
i686 "Bonus" Package

Securing Redhat, and Linux in general

[Raedwald]

Yep, got my home box r00ted six weeks ago. All because I hadn't taken all the usual basic precautions. (insert your sarcastic insult here). Being an ex sysadmin, I should have known better. Tightening up the security didn't take too long.

The hardest part was setting up ipchains to do packet filtering. Lord help a newbie doing this; you have to know a fair amount about TCP/IP. The various security HOWTOs make a brave effort of trying to explain it all, but I really wonder how many novices will understand it. I don't see how any Linux distribution can make this easy: there are too many variables about the intended use of the computer. The rules for a DMZ computer, a LAN computer, a lone dial-up computer and a firewall are completely different.

Re:Securing Redhat, and Linux in general

[Raedwald]

packeteer asks

how DO you setup ipchains to do packet filteringt?

The information you need is in various Linux HOWTO documents. These should have come with your distribution. You can fetch updated versions of the documents from The Linux Documentation Project. You should study the following HOWTOs:

1. Security-Quickstart-Redhat-HOWTO (worth reading even if you don't have Redhat)
2. Security-Quickstart-HOWTO
3. Security-HOWTO
4. IPCHAINS-HOWTO

I asume you simply have a home box which you connect to the Internet using a ppp dial-up connection. If you have something more sophisticated, you will have to learn more. I'd say the most important thing to do is to block connections to the privileged ports via your ppp interfaces, for the following reasons.

• You shouldn't be providing any services to the Internet unless you really know what you are doing.
• If you have a dial-up ppp connection without a static IP adress and your own domain name, there is no legitimate reason for anyone to ever try and connect to those ports.
• Security exploits of privileged services will immediately given an intruder a root shell, and thus complete control of your computer.

The following rule will do the trick (warning, untested--myipchains rules are more complex than this): ipchains -A input -i ppp+ -p TCP -y -d 0.0.0.0/0 0:1023 -j DENY -l

Re:The winner

[Cally]

"Score:0, Insightful"

Freeeowww! it was a joke!! Tchuh!

"Organic lifeforms have *no* sense of /fun/."

That's because...

[jabbo]

Most federal agencies seem to evaluate Windows against proprietary Unix solutions and (duh) find that Windows is cheaper. If they *really* care about security they almost always have their own solution (often in hardware) that you will be asked to code to / talk with / work in conjunction with. Short of that, offering to use NSA SELinux (because of the NSA's "approved" cachet) really seems to open a lot of doors for Linux.

En Garde may be better, for all I know. But I'll be using SELinux for gov't clients wanting high security, and OpenBSD for my need-to-be-hardened services, because I know they are excellent tools for those applications. (sorry folks...)

The above are just my experiences. For all I know it could be a vast conspiracy to provide disinformation :-). But, the odds are against it.

Re:Great!

[xtremex]

I don't use Redhat on my desktop. I use debian. I've used EnGarde, and it is a might darn secure distro. It's redhat w/o NO services running.

Debian-based?

[leandrod]

It’s just me or other people also noted EnGarde’s installer looks just like the Debian one? Would it be Debian-based?

I haven’t seen them at Debian’s derived distributions list, so maybe I’m mistaken.

Re:Debian-based?

[leandrod]

I just use Debian, nothing else. Perhaps it’s Anaconda, but then please enlighten me as to what Anaconda is.

OpenBSD, Pitbull, SE Linux *all* mentioned

[hal9000(jr)]

http://www.networkcomputing.com/1312/1312f33.html# filter

try reading the article before making false claims.

Gentoo??

[hardave]

A week ago I probablly would have answered Slackware, being a die-hard Slackware geek for my entire Linux life. But last week I found out about Gentoo, and I have to say I like it. Especially for security. After you're done the install you're left with a VERY minimal system, there are ZERO services running, hell there are no services installed on the box. You have to explititly install any services that you wish, which is nice because you don't have any weird weird stuff installed on your system without your knowledge. Yes, this isn't for newbies who can't spell ls, but for the long-time unix geek who does everything manually already, this is the way to go.

KRUD

[the_rev_matt]

I'm disappointed that they didn't include Kevin's Red Hat Uber Distribution. Kevin Fenzi is the author of the Linux Security HOW-TO, and the hardened version of Red Hat that they produce has served me quite well for over a year.

Re:Great!

[jpegNY]

It's sad how Redhat bashing has become another "in" thing to do like bashing MS. I've been using several distros of Linux at work and at home. Redhat distros are no more or less secure than other distros. 99.9% of the vulnerabilities in rh linux are also present in other distros. What, do you think redhat makes wu_ftpd or sendmail? The only diff. I see is that Redhat has no shame in admiting to the vulnerabilities and making the patches avail in an easy to find and download site. This is one of the reasons why people think redhat is unsecure etc etc, they see bug reports or the patch list from Redhat and say "omg look at all the bugs!" As far as running services by default Redhat has stopped running all services except ssh. by default.

NTP is a great protocol

[jabbo]

It is complicated as hell because the whole issue of clock synchronization across a medium with varying latencies (differing both along the axes of time and location, though without any linear dependence across those two axes) is horrifically complex.

Still, a working NTP infrastructure is a requirement not just for NDS, but (IMHO) for ANY scalable deployment of service that is meant to be reliable. How can you get anything interesting from your logfiles (on a correlation-across-the-site basis) without a standardized meaning for the timestamp?

Complicated, yes, but also valuable. I have had the misfortune of trying to read the RFC. I even read the source for ntpd and xntpd (v4). The complexity arises (and damned if this isn't going to sound familiar) as a result of multiple people in multiple locations trying to coordinate their metrics for timekeeping. LDAP and NIS complexity also arises from social interactions (upkeep) and scaling (emergent behavior of a system). NTP is a great tool for minimizing the chaos created by bugs in authentication schemes like LDAP, btw.

Aside:
If you want to get really sick, try running a Coda or AFS deployment (with IPSec or SSH tunnels to link nodes) across multiple timezones. Woo Hah!

All of my servers run NTP, from the routers, which in turn pull from tick and tock at the Naval Academy (or NRC, can't remember offhand which).

SELinux cachet does not come from any NSA approval

[jabbo]

I did not mean to imply that SELinux actually offers a greater level of security than the alternatives, nor to imply that it was blessed by the NSA (or for use in NSA projects, for that matter).

Rather, my experience has been that other three-letter agencies find it helpful in the decision-making process if a solution based on Linux also has the imprimatur of the NSA (eg., "we can do this on NSA SELinux if it suits you better") so that it need not be seen as a rogue deployment of something outside the norm.

I am sorry if anyone got the idea that SELinux is Orange Book or NSA approved or in any other way superior to a properly-implemented kernel MAC implementation. What I was commenting on is the "aura", if you will, of offering a product that is Linux-based, but NSA-Linux-based. It makes life easier. I had trouble the first time I explained this to my boss, so clearly I need to work on my presentation of the issues some more ;-).

YMMV...

OK, I'll call you (a little bit) ignorant.

[jabbo]

You ARE off base. Not every line of source code in (for example) the ports and packages can be audited by the development team, let alone all by Theo himself. The OpenBSD developers do a terrific job, and I trust it above any other OSes for my "hardened" public servers, but it simply is not possible for the degree of hardening and auditing you describe to be done by such a small group. The auditing is done to the kernel, the base utilities, and other aspects of the default install. Outside of that, you're on your own.

Furthermore, several of the services that run by default on a raw install of OpenBSD have been shown over time to have local root exploits possible. Not remote root, mind you, and not without a swift and comprehensive patch being released, but the moral is, No One Is Perfect.

That said, I have never had a compromise of any sort on my OpenBSD systems. I buy each and every release on CD direct from them to support the project, and have donated a little bit, too. If anyone who just runs Linux says "so what, it doesn't affect us" I request that you look at what version of SSH you're running. OpenSSH? Hmm, guess which dev team wrote that? Yeah, that's right. *BSD will be dead around the same time we see the paperless office (and the paperless restroom, and flying pigs, and...). OpenBSD is good stuff when you just can't take chances!

So what?

[p3d0]

Everyone knows that. The interesting question is this: assuming you have a good admin, which distro is most secure?

Re:The MOST secure OS is already deployed on serve

[commodoresloat]

1 - My server box is headless (no monitor/keyboard). That's because I am never PHYSICALLY there. Yet, I update web pages, email services, add new forms, etc. I can even update the OS remotely. Can you do this on the Mac? Serious question, I'd like to know the answer (I SUSPECT its NO, but I do want to know).

You can do most of the above using a tool like Timbuktu, which allows remote use of a mac using the GUI; you can do most of what you want through that. A better way is to use the Remote Admin Extension, which allows you to administer MacOS (pre-X of course) through a telnet client. Most Mac webservers also have remote administration capabilities built in. I administered a headless Mac webserver for about 5 years using these tools (The OS was 7.1 and I was running Webstar 1.1; this stuff worked faithfully (though slowly) for a long time.

Of course, the real reason Macs are perceived as more secure is because fewer people have spent time hacking them, because there are fewer Macs. Every service you offer can be coded for the Mac, and many have been, but every service opens the potential for security risks. You can stay up to date on Mac security issues at http://securemac.com, among other sites.

Finally, you can always install linux on the Mac and do what you want, but that really doesn't answer your question.

Re:The MOST secure OS is already deployed on serve

[Phroggy]

1) yes, if you open up some potential security holes such as the AppleShare IP server (which is probably far more secure than SMB/CIFS).

2) no, unless you run extra software which may not be secure, such as VNC.

3) Jobs demonstrated a diskless netbooting iMac on stage a couple years ago; the client ran Mac OS 9 but the server was Mac OS X. Of course the same can be done with OSX clients. I'm not sure what all this allows you to do; it's not something I've played with at all. Of course, you should be able to netboot a *nix OS on Mac hardware, but the hardware is a bit pricey for that sort of thing.

Re:The most secure OS is the one I use. Unhackable

[Phroggy]

Mac OS 9 does not have any security.

Umm... it ships out of the box with all ports closed. If the web server you install on top is actually secure (as you say), then how can the OS be compromised remotely?

I'm not questioning that there is no local security, but if you've got physical access to the box anyway, most systems aren't very secure.

Re:Ready to go out of the box is a BIG selling poi

[Malcontent]

I don't mean to be flip but you sould consider buying a book or two. For example Postgres is a wonderful free database, with the ten thousand dollars you saved you could spend $100.00 on a couple of good books.

Re:Ready to go out of the box is a BIG selling poi

[Eric Damron]

Oh, I do buy books. But even so, I don't have time to read them all. It takes a lot of effort even with books to setup EVERY system that I use.

I really love Linux. It's power, flexibility and open source philosophy is wonderful. But really, business people just don't have the time to read all of the books that it takes to configure all of the various parts of a Linux server. And small businesses can't afford to hire an expert every time that they need something done.

The answer, I feel, is to have configuration tools for the complete idiots. I know I would use them! :)

Re:Ready to go out of the box is a BIG selling poi

[Malcontent]

Most business people I know (and I know a ton) know nothing, read nothing, configure nothing, install nothing. They hire people to do that for them. Most businesses with more then two or three employees rely on local consultants to manage their IT work. Bigger ones employ bigger companies.

And you know what manually configuring things is no longer required. With programs like linuxconf and webmin (especially webmin) any body can configure just about anything. Install webmin you won't be sorry.