Slashdot Mirror
Open Source For Perimeter Security
An anonymous reader writes "IT Observer has a look at some of the perceived problems with an OpenSource approach to security and what could be done to improve the situation. From the article: 'There is a widespread and wholly inaccurate impression that open source development is somehow haphazard and undisciplined, a free-for-all among brilliant but uncoordinated individuals. In fact, most major open source projects are very tightly managed highly disciplined teams. This article gives examples of very successful Open Source security projects -- netfilter and Snort -- and also describes some weaknesses that need to be addressed by IT organizations or vendors.'"
When it comes to Linux versus Windows it is almost a matter of philosophy.
"The unexamined [code] is not worth [coding]." -- Socrates (Apology 38a)
__
Elephant Essays - Custom-created essays and research papers.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
I think that the main issue here is discipline, be it exibited by a team or an individual.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Since I've been dabbling in some home automation stuff a bit recently, I was hoping for a good article on some wireless home security to secure my house - open source stuff. The title was not what I had hoped...anyone know of some good "Open Source Perimeter" hardware and software that works with misterhouse http://misterhouse.sourceforge.net/, or other open source projects.
"By Walter Schumann, VP Sales and Marketing, Astaro"
You Slashdotters may make fun of marketing people, but I think Walter just showed you how YOU need to make your pitch for your favorite open source project at your company.
> Finally, support options are limited for most open source software.
But if the author has written a book about the product - or even anything vaguely related - then buy it! For example, DenyHosts is an excellent tool, and the online documentation is good enough that I can use it without any more docs. But if the author were to put together a book, I would certainly pick it up in appreciation for his time spent in developing and supporting that fine utility. In the meantime, I PayPal'd him a few bucks.
Of course, I'm biased...
The Army reading list
With netfilter, you can do the following: What can I do with netfilter/iptables? * build internet firewalls based on stateless and stateful packet filtering * use NAT and masquerading for sharing internet access if you don't have enough public IP addresses * use NAT to implement transparent proxies * aid the tc and iproute2 systems used to build sophisticated QoS and policy routers * do further packet manipulation (mangling) like altering the TOS/DSCP/ECN bits of the IP header
Which is one of the reasons they became major open source projects in the first place. Of course, that tightly managed highly disciplined team ALSO needs to be working on something we all want, and the end result needs to do the job, and do it well.
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
perceived problems with an OpenSource approach to security and what could be done to improve the situation.
Could it possibly have something to do with the fact that some people just don't like having the words 'Open Source' attached to their computer security? Maybe rename it to something like 'Closed Fortress OS' or 'Locked Down OS' to give a more positive ring to it?
Maybe I am just thinking about it too much.
He who knows best knows how little he knows. - Thomas Jefferson
I'm sorry, but I find the constant argument that open source is less secure because everyone can see the source to be a silly waste of effort, usually promoted by the commercial security software vendors.
They ignore that the driving principle in open source development is quality software, so everyone who works with it is always looking to find the flaws and remove them.
Neither is inherently more secure, open source has the benefit of more people actively working to improve the code base than any commercial software company can afford to pay. That includes Microsoft. Yes, Microsoft cannot afford to pay the same number of programmers as are actively donating code improvements to open source software solutions.
Those of us that use open source software are more likely to learn the code to improve software we like than those using proprietary products are likely to do anything to help improve the software, including submitting the automatic crash reports that most software has implemented.
[ I personally don't use that even with open source software, running gdb against the core, then seeing what caused the crash and submitting a patch is more usefull. ]
J. Henager: If the average user can put a CD in and boot the system and follow the prompts, he can install and use Linux
For real (tm) security, try a (true) layer-7 firewall (in case anyone knows a product that matches up to this, cisco's pix does NOT, pf does not, and checkpoint does not either, they just have some checks that can be easily fucked up by playing with tcp window size (setting it very low for example))
http://www.balabit.com/products/zorp/
Check it out.
I don't think it's that widespread, except amongst Open Source fans. :-)
The impression I usually see is that Open Source projects are done by guys who were laid off and need something to fill in the time between gaming sessions.
http://www.google.com/search?q=%22It+features+rule s+based+logging+and+can+perform+content%22
Way to shameless rip off other people's work.
Causation can cause correlation
OSS is real software for people who know what they are doing. If you don't know anything about security and you want some, hire a professional (who may implement OSS for you) or buy a commercial closed product. The commercial product is likely to be more secure than an OSS product selected and implemented by someone who doesn't know anything about security. It's too easy to make a secure program very vulnerable by doing something stupid.
Ever since I've discovered the magic of Open Source (Linux, BSD) I have implemented the rule with every network I've run...No Windows box will ever talk to the Internet without going through a Unix/Linux box.
m l<li/>
Since then (7 years now) I have had ZERO worms, ZERO security breaches, have cut the Windows server reboots by 80%.
These 2 projects have saved me countless hours of time...
<li>http://www.squid-cache.org/<li/>
and
<li>http://vlsi.cornell.edu/~rajit/fbsd/bridge.ht