Slashdot Mirror
Open Source For Perimeter Security
An anonymous reader writes "IT Observer has a look at some of the perceived problems with an OpenSource approach to security and what could be done to improve the situation. From the article: 'There is a widespread and wholly inaccurate impression that open source development is somehow haphazard and undisciplined, a free-for-all among brilliant but uncoordinated individuals. In fact, most major open source projects are very tightly managed highly disciplined teams. This article gives examples of very successful Open Source security projects -- netfilter and Snort -- and also describes some weaknesses that need to be addressed by IT organizations or vendors.'"
We use OpenBSD and pf for our dept firewall. They tried to shove (read: sell us) those Nokia Firewalls down our throats awhile back and we told them to buzz off.
"From the article: 'There is a widespread and wholly inaccurate impression that open source development is somehow haphazard and undisciplined, a free-for-all among brilliant but uncoordinated individuals. In fact, most major open source projects are very tightly managed highly disciplined teams. "
So in a nutshell, only use OSS from the majour projects.
When it comes to Linux versus Windows it is almost a matter of philosophy.
"The unexamined [code] is not worth [coding]." -- Socrates (Apology 38a)
__
Elephant Essays - Custom-created essays and research papers.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
I think that the main issue here is discipline, be it exibited by a team or an individual.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Since I've been dabbling in some home automation stuff a bit recently, I was hoping for a good article on some wireless home security to secure my house - open source stuff. The title was not what I had hoped...anyone know of some good "Open Source Perimeter" hardware and software that works with misterhouse http://misterhouse.sourceforge.net/, or other open source projects.
"By Walter Schumann, VP Sales and Marketing, Astaro"
You Slashdotters may make fun of marketing people, but I think Walter just showed you how YOU need to make your pitch for your favorite open source project at your company.
> Finally, support options are limited for most open source software.
But if the author has written a book about the product - or even anything vaguely related - then buy it! For example, DenyHosts is an excellent tool, and the online documentation is good enough that I can use it without any more docs. But if the author were to put together a book, I would certainly pick it up in appreciation for his time spent in developing and supporting that fine utility. In the meantime, I PayPal'd him a few bucks.
Of course, I'm biased...
The Army reading list
With netfilter, you can do the following: What can I do with netfilter/iptables? * build internet firewalls based on stateless and stateful packet filtering * use NAT and masquerading for sharing internet access if you don't have enough public IP addresses * use NAT to implement transparent proxies * aid the tc and iproute2 systems used to build sophisticated QoS and policy routers * do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header
Which is one of the reasons they became major open source projects in the first place. Of course, that tightly managed highly disciplined team ALSO needs to be working on something we all want, and the end result needs to do the job, and do it well.
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
perceived problems with an OpenSource approach to security and what could be done to improve the situation.
Could it possibly have something to do with the fact that some people just don't like having the words 'Open Source' attached to their computer security? Maybe rename it to something like 'Closed Fortress OS' or 'Locked Down OS' to give a more positive ring to it?
Maybe I am just thinking about it too much.
He who knows best knows how little he knows. - Thomas Jefferson
I'm sorry, but I find the constant argument that open source is less secure because everyone can see the source to be a silly waste of effort, usually promoted by the commercial security software vendors.
They ignore that the driving principle in open source development is quality software, so everyone who works with it is always looking to find the flaws and remove them.
Neither is inherently more secure, open source has the benefit of more people actively working to improve the code base than any commercial software company can afford to pay. That includes Microsoft. Yes, Microsoft cannot afford to pay the same number of programmers as are actively donating code improvements to open source software solutions.
Those of us that use open source software are more likely to learn the code to improve software we like than those using proprietary products are likely to do anything to help improve the software, including submitting the automatic crash reports that most software has implemented.
[ I personally don't use that even with open source software, running gdb against the core, then seeing what caused the crash and submitting a patch is more usefull. ]
J. Henager: If the average user can put a CD in and boot the system and follow the prompts, he can install and use Linux
For real (tm) security, try a (true) layer-7 firewall (in case anyone knows a product that matches up to this, cisco's pix does NOT, pf does not, and checkpoint does not either, they just have some checks that can be easily fucked up by playing with tcp window size (setting it very low for example))
http://www.balabit.com/products/zorp/
Check it out.
I don't think it's that widespread, except amongst Open Source fans. :-)
The impression I usually see is that Open Source projects are done by guys who were laid off and need something to fill in the time between gaming sessions.
Written by Hungarians. Prolly almost as trustworthy as those Israelis and their ChokePoint firewall.
I think I'll pass and just stay with iptables myself.
Security by Default! Support OpenBSD buy CD/T-shirt or donate. And remember to donate to OpenSSH.
http://www.openbsd.org/donations.html
http://www.openssh.org/donations.html
Apologies for the Arnie quote. But I agree, discipline has alot to do with how good Open Source products can be. There is dedication to the code, less politics and less money floating around than lets says a MSFT operation... that combined results in a superior product.
http://www.google.com/search?q=%22It+features+rule s+based+logging+and+can+perform+content%22
Way to shameless rip off other people's work.
Causation can cause correlation
OSS is real software for people who know what they are doing. If you don't know anything about security and you want some, hire a professional (who may implement OSS for you) or buy a commercial closed product. The commercial product is likely to be more secure than an OSS product selected and implemented by someone who doesn't know anything about security. It's too easy to make a secure program very vulnerable by doing something stupid.
Ever since I've discovered the magic of Open Source (Linux, BSD) I have implemented the rule with every network I've run...No Windows box will ever talk to the Internet without going through a Unix/Linux box.
m l<li/>
Since then (7 years now) I have had ZERO worms, ZERO security breaches, have cut the Windows server reboots by 80%.
These 2 projects have saved me countless hours of time...
<li>http://www.squid-cache.org/<li/>
and
<li>http://vlsi.cornell.edu/~rajit/fbsd/bridge.ht
The idea that open source "amateurs" are inferior to professionals with professional project managers is the second stupidest idea to be so widely taken for granted. I work for a HUGE multi-national company, based primarily in Germany and the U.S., and my experience is the opposite. In the past I've mostly worked for much much smaller companies (micro-businesses, sometimes) so I've been shocked to see how incredibly inefficient and sloppy work can be in a highly "professional" highly managed workplace, with project managers up the yin-yang.
The fact is that people here are *incredibly* inefficient. We have offshore developers who take weeks to do what I could do in a day or two, and a day or so to do what I could do in ten minutes. (Everything requires "analysis", which basically means they don't know what they're doing, and have to figure it out.) But enough about offshore developers. The onsite developers work slowly too, partly because they are burdened with all sorts of documentation which no one reads and which mostly consists of useless information. Also, why should we knock ourselves out when the offshore people produce sloppy work and take forever to do it? Why should we care when we're working for bosses who don't have a clue about what we're doing and refuse to give us the tools we need to do our jobs well?
Although documentation is a major source of our pain, I'm not suggesting that documentation is necessarily useless, so don't argue with me on that point. If you do, you're ENTIRELY missing the point. The point is much closer to this: why wouldn't a highly professional group have some clue about how to produce useful documentation in an efficient manner?
ince I care about producing good work, all of this (the work conditions) are a hindrance, and the net effect is to sap me of my desire to produce anything worthwhile. If I don't care, then all the project managers in the world won't help.
On the other hand, open source developers who don't care won't work. This simple fact gives open source developers a huge advantage of corporate wage-slaves who work for a pointy haired boss. The idea that they are sloppy contradicts both the evidence of many successful major projects, but also the logic of the situation.