Slashdot Mirror
Would You Use SELinux?
silent_tyr asks: "I am going to re-install my Linux box and being security conscious I am looking for a secure distribution. After a couple of Google searches I found a version called Secure Linux, which sounded ideal. So I followed this link, which turned out to be what I assume is a genuine NSA web-site. All in all, it looks like a good idea and I can play around with it as I wish, but eventually I will be using this machine as my base-system. So before I start I want to ask two questions:
1) Do you think that it is a good idea to trust the NSA not to put in back-door/spy-ware type code to enable them to snoop my personal information? 2) What other security-patched distro's can people recommend? I don't want to open up the floor for generic NSA-bashing, but I also don't want to have to work my way through every line of code before I install." There was a similar question that was asked a while ago, but there wasn't much to the discussion. For those of you who are running SELinux, what have your experiences been, so far?
Just install Windows XP like everyone else. Stick the free version of ZoneAlarm on there, and you will be as secure as any box out there!
Slashdotter are stupid and biased.
Check out EnGarde Linux.
Also, LinuxSecurity.com is a very helpful and informative site.
Co-founder and designer at Music Nearby: http://musicnearby.com
GPL'd source guarantees that nothing lives in your kernel that you cannot examine as much as you like for backdoors. Yet this examination has to be done somebody else, by larger group of people who have great amount of knowledge and experience on these matters. It is simply not "possible" to this guy/girl to examine the kernel. Besides it is not not a easy task look for backdoors etc. Does anybody know that this kind of examination has been taken place by independent group?
grsecurity
LIDS
As far as the NSA planting a back door into SELinux, I really doubt it. A backdoor in open source code would be discovered eventually, and the NSA would have a very hard time denying it.
It seems much more likely that they would put back doors into closed source products, which do not receive as much scrunity.
IIRC, it's a series of kernel patches and some modified basic utilities. I wouldn't be surprised if there was more to it than when I first looked at it a couple of years ago.
;) amount of work?
But as to NSA backdoors, honestly, how much intel would they gather from the handful of people who would install SELinux? Wouldn't it make way more sense to crack into Microsoft's source code (if a Russian hacker could do it, well, I'm sure they can) and do it in a closed-source, widely adopted OS?
Hey, I'm as much a conspiracy theorist as the next mildly-intelligent person who sees strings pulling the marionettes in our government. But it ultimately comes down to a resource allocation issue. Why bother when there's so much more to be gained with the same (or less, if you consider the need to somehow disguise the backdoor in open code!
Now about those microwave towers...
Amateurs discuss tactics. Professionals discuss logistics.
IMO, the bigger question is: "will the extra security measures get in the way of doing what you need to do?" And probably the corollary: "If you're going to have to disable any of those features, is it still worth using this distribution?"
Check out my eclectic infosec blog at InfoSecPotpou
Hum, so you ask us, who you don't know, which developers, who - in most cases - you nor we know either -, to trust? Maybe you are an NSA agent in search of backdoor-free distributions? Why should we trust you, sir?
Seriously, short of a full code audit, you can never be sure. Security is a process, and not something you can install. I thought that was commonplace around here.
--
"Just believe everything I tell you, and it will all be very, very simple."
Does it -have- to be Linux?!?
SDF (the free shell-provider) switched -from-
Linux... after a security breech...
OpenBSD is claiming to have had:
"Only one remote hole in the default install,
in more than 7 years!"
That's not too bad IMO.
And... if you -really- itch for Linux...
you can always put it on a box -this-
side of an OpenBSD box (ie away from
the Internet...)
% man diff
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
After exaustive code riview of the LSM patches I have discovered a backdoor in the PAM module re-write lin...
excuse me, there's some at the door. brb.....
thers no suh thig as backdoor in seLinux, he was joking.
In teh event of an actual emergency this space might provide useful information.
Yes, but having the source of SELinux and the vanilla kernel sources means you can diff the two trees and get a very good idea of what has been changed. Viewing the changes in this manner should make a code inspection managable.
Spencer Ogden
you could spend weeks browsing through the source by yourself (and probably not find any backdoors even if they do exist).
Me (an average good C programmer) and hundreds of others (that are average good C programmers with good networking experience) would stand a reasonable chance of finding something.
In fact, if you are in the computer security business, uncovering a backdoor like this would be a real feather in your cap, look good on your resume, and help you drum up more business, so there's definitely motivation for people to look closely at the NSA code, not just for backdoors, but for any kind of flaw that could potentially compromise security.
Critical (almost hostile!) code review like that is going to do a lot better job than a more friendly limited internal review at Company X, where Marketing wants to ship the product yesterday.
check MD5sums at the original point of distribution
You bring up a good precaution, checking the MD5 sums, especially in light of the trojan distribution problem that happenned with (SSH?,SSL?) last year.
But I've always thought it was silly to check MD5 sums for tarballs from the same point of origin.
If I were a trojan writer, I'd change the webpage so that the MD5 sum displayed was in sync with my malware.
Getting independent verification of the MD5 sum from a different source is better; checking a PGP signature is better still.
Finally, from a political perspective, it would Look Bad if someone managed to hack into nsa.gov and replace chunks of their site. I'd expect NSA sysadmins to pay closer attention to securing their site than average sites.
"Provided by the management for your protection."