Slashdot Mirror
Debian Hardened Aims For Security
larryg writes "Debian Hardened is a new project that wants be an official Debian sub-project. It aims to provide a complete tree of hardened kernel and software packages for a standard Debian distribution, without changing to another like Adamantix and making easy the hardening of any machine running Debian GNU/Linux. The hardened kernels use the grSecurity patch and some of the Adamantix kernel patches; also, its packages are compiled with the ProPolice/SSP gcc extension and some libraries to prevent and trace buffer overflow attacks. Also, and as a second project, we are working on some enhacements against the Linux Entropy Pool engine, using an external TRNG (True Random Numbers Generator) device which uses thermal noise and also the atomic decay from a Geiger counter, making true unpredictable random numbers."
Cant wait to use it with my Lexar JumpDrive loaded with security sofware against hackers.
Doesn't provide as many choices or the technological /security understanding of Hardened Gentoo
(not to mention the very similar name)
http://hardened.gentoo.org
How is this going to be different than just installing Woody and applying the lids kernel patch to your particular kernel and locking the system down that way?
why would you need a distro for securing your machine? you should just secure your favorite distro yourself :)
Hard3n y0ur Debian/w0ody t0day!
Debian's team can implement it a certain way and whatever amazing thing they cook-up can be re-used by the Gentoo team!
The goal is not a religious war, the goal is for you and I to get ahead.
I don't know the meaning of the word 'don't' - J
Has anyone ever,ever,ever compromised a computer or encrypted document by predicting the output of a random number generator?
Would the time not be better spent looking for the next OpenSSH/SSL hole?
I'm not trolling, most security flaws come from everyday apps rather than esoteric problems.
Wanna mount my hardened woody?
The government which is strong enough to protect you from everything is strong enough to take everything from you.
I'm a Hardened Gentoo user; although, I only use a subset of all the hardened herd's efforts :) I actually do understand what I'm doing, though, and am trying to spread that understanding myself. I am in no way affiliated with [Hardened] Gentoo or Debian.
At any rate, these people don't understand that they'll need more drastic changes. Why not bring attention to http://d-sbd.alioth.debian.org/ while you're at it? This is my project, just a demonstrational effort to bring these things to the attention of the Debian maintainers.
The idea isn't to have a hardened "Enhancement," but rather to incorporate anything you can put in that won't hurt. For example, you can compile glibc, gnome, and bash with SSP/ProPolice, and nothing else will use ProPolice but those. Those programs also won't be hurt by ProPolice. We can extend this to, "Compile any program or library that won't break with it with SSP." The user will never notice; but it'll stop a range of attacks.
My point is that you need to aim low. A hardened system like Hardened Gentoo or Adamantix will supply you with *everything* -- PaX, SSP, ET_DYN binaries, rediculously complicated MAC systems, firewalling maybe, network sniffers, etc. A non-hardened distribution should look at each of these, determine which don't change the end user's experience (administrator included), and implement them. This is "Do what's easy" rather than "Do EVERYTHING we possibly can," but it's still better than just being lame in the area of security.
Support my political activism on Patreon.
Take for example the fact that I can remotely shutdown a debiaTake for example the fact that I can remotely shutdown a debian machine over ssh with the "halt" command. A RedHat distro had that little feature blocked
Why exactly is this a bad thing? Have you never had to shutdown or reboot a remote server? I know I've had to do both at least a few times... Although rebooting would be much more common, and it would probably be safer as well :p.
On my Debian machines you seem to need to be root to do it. If someone I don't know is logged in over ssh as root on one of my boxes the last thing I am worried about is his ability to shut it down :p.
First off, who are these guys?
Debian already has a security project, a few of them actually.
I looked at google for either of these guys names and unless I am mistaken, this is what I got: developer one and developer two.
Interesting that anyone else that they haven't ever used those names to contribute to say at least a single debian security mailing list, or say ANY debian lists?
Even more interesting is that they don't seem to have much but a slashdot plug and they are accepting donations.
I am not impressed. Working with the debian security team is the way to go.
Steve Kemp is one of the main guys heading up the debian audit project, these guys should be working with him. Not for some other project.
The official debian project for this is the debian audit project.
Hell advertising that they use SSP enabled GCC! Steve makes those packages for use with debian already!
"Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
how is Hardened Debian going to be different from installing the harden* packages?
I kind of get a kick out of all of the anti US gov't people on /. using something the NSA developed and gave back to the community.
This guy is way out there
If you look at the SElinux download page you can read the following tidbit:
In other words, SElinux comes with the kernel.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I prefer to discard only the bathwater. Baby can stay. I get a kick of the NSA giving back to the community that hates them...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
but seriously... as a debian user, i fully condone harder, faster, and stronger debians.
No, in that case they did not use any random data (or "salt" as cryptographers call it) in the encoding at all.
The problem was not the quality of the random number generation.