Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Debian Hardened Aims For Security

Posted by timothy on Tue Sep 14, 2004 07:03 PM
from the it's-certainly-safe-from-me dept.
Security Debian Software Linux
larryg writes "Debian Hardened is a new project that wants be an official Debian sub-project. It aims to provide a complete tree of hardened kernel and software packages for a standard Debian distribution, without changing to another like Adamantix and making easy the hardening of any machine running Debian GNU/Linux. The hardened kernels use the grSecurity patch and some of the Adamantix kernel patches; also, its packages are compiled with the ProPolice/SSP gcc extension and some libraries to prevent and trace buffer overflow attacks. Also, and as a second project, we are working on some enhacements against the Linux Entropy Pool engine, using an external TRNG (True Random Numbers Generator) device which uses thermal noise and also the atomic decay from a Geiger counter, making true unpredictable random numbers."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Debian Hardened Aims For Security 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Cool (Score:5, Funny)

    by Anonymous Coward on Tuesday September 14 2004, @07:08PM (#10251503)
    Cant wait to use it with my Lexar JumpDrive loaded with security sofware against hackers.

  • Hardened Gentoo (Score:5, Interesting)

    by Anonymous Coward on Tuesday September 14 2004, @07:08PM (#10251504)
    Doesn't provide as many choices or the technological /security understanding of Hardened Gentoo
    (not to mention the very similar name)
    http://hardened.gentoo.org

    • Re:Hardened Gentoo (Score:5, Insightful)

      by Aardpig (622459) on Tuesday September 14 2004, @07:10PM (#10251512)

      Doesn't provide as many choices or the technological /security understanding of Hardened Gentoo

      While I confess to being a hard-core Gentoo nut, isn't choice often the mother of all fuck ups? What's wrong with doing one thing and doing it right?

      • Re:Hardened Gentoo (Score:5, Insightful)

        by Stevyn (691306) on Tuesday September 14 2004, @07:20PM (#10251577)
        Because people disagree what is the right way of doing it. I share some frustration that the choice offered of using linux makes some things more complicated than on a windows machine. But in the end, it just generate more competition, which is what has been killing the software industry for the past few years. Actually the industry has been fine, it's the consumers who are getting shafted.

          • Re:HOW? (Score:4, Insightful)

            by Stevyn (691306) on Tuesday September 14 2004, @08:11PM (#10251866)
            I think you misunderstood. I meant that users get shafted with there are just a few large companies competing, but it is better to have lots of smaller organizations writing FOSS. For most users, the advances in FOSS haven't affected them in the past few years. OSS projects like firefox and gaim are starting to become popular for the every day folk and that's the advantage to the consumer I was referring too.

      • Re:Hardened Gentoo (Score:5, Insightful)

        by savagedome (742194) on Tuesday September 14 2004, @07:26PM (#10251611)
        isn't choice often the mother of all fuck ups

        I read this in of the /.'s sig: "Freedom of choice is what you have. Freedom from choice is what you want". I think it applies to the general populace and is relevant here.

    • Re:Hardened Gentoo (Score:5, Insightful)

      by gl4ss (559668) on Tuesday September 14 2004, @07:19PM (#10251570) Homepage Journal
      soo.. what you're telling me is that just by using gentoo you gain magical insight into understanding secure systems and how security is built from ground up?

      gentoo is nice and all, but it certainl doesn't make it's users magically understand the underlying system. btw, just because you can copy and 'discuss' compiler flags on a forum doesn't make yourself an expert on building fast software or make you understand what kind of speed ups are even technically possible and of all things it doesn't make you magically understand how software is executed at run time or the operating system built so you could see that saying stuff like "my mozilla has no ps/2 support" doesn't really show you in good light.

      one choice in reducing possible user fuckups is reducing easy user choices("do you want to have a theoretical speedup by disabling using shadow file y/n?").

      • Re:Hardened Gentoo (Score:4, Informative)

        by MadMethod (703012) on Tuesday September 14 2004, @07:23PM (#10251594) Homepage
        Ok, how about this go to http://debianhardened.sourceforge.net/ and read all the documentation they have (hint, there isn't any), then go to http://hardened.gentoo.org and read all the docs we've put there and notice that, indeed there is a difference and one would gain a higher understanding of security

        • Re:Hardened Gentoo (Score:4, Funny)

          by big tex (15917) <torsionality&gmail,com> on Tuesday September 14 2004, @07:37PM (#10251691)
          Ok, how about this go to http://debianhardened.sourceforge.net/ and read all the documentation they have (hint, there isn't any),

          OK, that's what we call 'security through obscurity'. See no evil, hear no evil, all that.

          • Re:Hardened Gentoo (Score:5, Insightful)

            by sirsnork (530512) on Tuesday September 14 2004, @07:52PM (#10251766)
            Or maybe, just maybe the project is a ALPHA status and is very new and has only been active for 2 weeks so no one has had a chance to write any documentation?
            • Damn people always have to go ruin a good flame-war with 'facts' and being 'reasonable'.

            • D:SbD [debian.org] has only been active about as long, and is in beta (almost production) stage. Of course, we're just supplying information about the systems that are out there; what impact they have; why they're good; and how to use them. In essence, D:SbD is just "this is what you do to implement a secure system without pissing the user off with tons of extra crap and breakage."

              It's done the way it is because I can't myself implement these things; and I'm not forking Debian. It'd be easy enough to rebuild the

          • While I agree that Gentoo won't create deep insight and turn you into Stallman himself, the reason people claim this is that you have to have a certain amount of understanding just to install the damn thing.

            You have to admit that reading the N-thousand-word Gentoo Handbook (heh, I remember when it was just the install guide) teaches you a bit more than the "next, next, next, done!" of Red Hat or Mandrake. I know I certainly didn't know what the hell was going on when I used Mandrake (let alone Corel Linux

  • www.lids.org (Score:4, Interesting)

    by hsidhu (184286) on Tuesday September 14 2004, @07:12PM (#10251526) Homepage

    How is this going to be different than just installing Woody and applying the lids kernel patch to your particular kernel and locking the system down that way?

  • why need a distro for that? (Score:4, Insightful)

    by techefnet (634210) on Tuesday September 14 2004, @07:12PM (#10251530) Homepage
    why would you need a distro for securing your machine? you should just secure your favorite distro yourself :)

  • Debian could use that as a spam headline! (Score:5, Funny)

    by Anonymous Coward on Tuesday September 14 2004, @07:17PM (#10251556)
    Hard3n y0ur Debian/w0ody t0day!

  • Interesting....... (Score:3, Interesting)

    by AcidFnTonic (791034) on Tuesday September 14 2004, @07:21PM (#10251582) Homepage
    Being a slackware guy myself, I still would very much like to inspect this branch when released....

    I still think the less you have the more secure it is.... as long as what you have isnt bloated. Thats why in my opinion slackware is great on security.

    So if this thing is more than one iso image ill be rather skeptical since debian tends to be a very large distro...

    • Re:Interesting....... (Score:5, Informative)

      by OmegaBlac (752432) on Tuesday September 14 2004, @07:53PM (#10251774)
      I still think the less you have the more secure it is.... as long as what you have isnt bloated.
      I agree.
      So if this thing is more than one iso image ill be rather skeptical since debian tends to be a very large distro...
      You only need to download 1 Debian ISO to install it. There even is a minimal iso version for network installs. The default Debian install is the bare miniumum. Hardly if any services are running on a default Deb install. Yes Debian has the largest selection of packages, but no one is forcing anyone to download all the ISOs just to install Deb. Just install and apt-get away what you need!

  • Enhacements against the Linux Entropy Pool engine? (Score:5, Interesting)

    by Anonymous Coward on Tuesday September 14 2004, @07:26PM (#10251618)
    Has anyone ever,ever,ever compromised a computer or encrypted document by predicting the output of a random number generator?

    Would the time not be better spent looking for the next OpenSSH/SSL hole?

    I'm not trolling, most security flaws come from everyday apps rather than esoteric problems.

  • New pickup line for geeks... (Score:5, Funny)

    by vettemph (540399) on Tuesday September 14 2004, @07:28PM (#10251625)
    Wanna mount my hardened woody?

  • good trend (Score:3, Informative)

    by Chuck Bucket (142633) on Tuesday September 14 2004, @07:34PM (#10251670) Homepage Journal
    I liked this back when Gentoo did it, and I think this is a great trend; having a completely security minded Linux OS (since BSD has been there forever ;))

    personally I'm really interested in the Security-Enhanced Linux [nsa.gov] that the NSA is working on. To have something that complete is really intriquing. Now if they don't have something like apt to keep it steady I dunno...but you have to admit it's got 'wow' factor written all over it!

    BCDFY^&D&S^F

  • They'd need more drastic changes (Score:5, Interesting)

    by bluefoxlucid (723572) on Tuesday September 14 2004, @07:34PM (#10251675) Journal
    I'm a Hardened Gentoo user; although, I only use a subset of all the hardened herd's efforts :) I actually do understand what I'm doing, though, and am trying to spread that understanding myself. I am in no way affiliated with [Hardened] Gentoo or Debian.

    At any rate, these people don't understand that they'll need more drastic changes. Why not bring attention to http://d-sbd.alioth.debian.org/ while you're at it? This is my project, just a demonstrational effort to bring these things to the attention of the Debian maintainers.

    The idea isn't to have a hardened "Enhancement," but rather to incorporate anything you can put in that won't hurt. For example, you can compile glibc, gnome, and bash with SSP/ProPolice, and nothing else will use ProPolice but those. Those programs also won't be hurt by ProPolice. We can extend this to, "Compile any program or library that won't break with it with SSP." The user will never notice; but it'll stop a range of attacks.

    My point is that you need to aim low. A hardened system like Hardened Gentoo or Adamantix will supply you with *everything* -- PaX, SSP, ET_DYN binaries, rediculously complicated MAC systems, firewalling maybe, network sniffers, etc. A non-hardened distribution should look at each of these, determine which don't change the end user's experience (administrator included), and implement them. This is "Do what's easy" rather than "Do EVERYTHING we possibly can," but it's still better than just being lame in the area of security.

  • Who are these people? (Score:5, Informative)

    by ConsumedByTV (243497) on Tuesday September 14 2004, @07:49PM (#10251753) Homepage
    First off, who are these guys?

    Debian already has a security project, a few of them actually.

    I looked at google for either of these guys names and unless I am mistaken, this is what I got: developer one [google.com] and developer two [google.com].

    Interesting that anyone else that they haven't ever used those names to contribute to say at least a single debian security mailing list, or say ANY debian lists?

    Even more interesting is that they don't seem to have much but a slashdot plug and they are accepting donations.

    I am not impressed. Working with the debian security team is the way to go.

    Steve Kemp [steve.org.uk] is one of the main guys heading up the debian audit project, these guys should be working with him. Not for some other project.

    The official debian project for this is the debian audit project [debian.org].

    Hell advertising that they use SSP enabled GCC! Steve makes those packages for use with debian already!

  • TRNG (Score:4, Informative)

    by dmiller (581) <djm@noSpAM.mindrot.org> on Tuesday September 14 2004, @07:50PM (#10251758) Homepage
    The crap about Geiger counters seems to indicate the author seems more interested in studly buzzwords than actually developing practical solutions. A soundcard with nothing plugged in is a perfectly acceptable source of entropy, the problem is just in accurately estimating the rate. Also, many chipsets and an increasing number of CPUs include hardware random number generators which can be used too.

  • selinux? (Score:4, Interesting)

    by starseeker (141897) on Tuesday September 14 2004, @08:00PM (#10251810) Homepage
    I'm curious as to why they chose the particular tools they did. I don't know too much about these issues, but from what I understand the NSA's selinux patches are a very robust and powerful set of tools. IIRC Redhat has been integrating it into their systems. It may be that this isn't the best choice, but I'd be curious if someone who knows them well could give us a rundown of why some solutions might be better/worse.

    One issue with selinux I (think) I understand is that in order for applications to run properly you need to have predefined rules which allow them to do what they need to do (the nature of MAC is they can't do anything except what is explicitly allowed, as I understand it). This is possible for servers, which do only a few jobs repeatedly, but for a desktop machine with hundreds of potential applications to fire up and more being developed such a burden becomes huge. A normal user would end up turning off MAC in order to use the computer the way they want to, unless each application they want or may want to use already has a default ruleset present. I would be really happy to see this happen - various distributions collaborate on default rules for large numbers of applications, so end users could actually use systems that are seriously hardened. I know it's probably overkill, but given what casual Windows users on the network have done over the years (as well as unsecured Linux boxes and other OSes, for that matter) I think if some combination of projects could deliver a usable desktop machine with mandatory access control and any other features which might defend their box while letting it be useful would be a Very Good Thing. One thing is for sure - too little security does more harm to the internet community than having more protection than you need.
    • This is possible for servers, which do only a few jobs repeatedly, but for a desktop machine with hundreds of potential applications to fire up and more being developed such a burden becomes huge ... I would be really happy to see this happen - various distributions collaborate on default rules for large numbers of applications, so end users could actually use systems that are seriously hardened

      No, the solution for SELinux is for the application developers themselves to write policy.

      Last time I discus

  • http://packages.debian.org/harden (Score:4, Interesting)

    by Anonymous Coward on Tuesday September 14 2004, @08:00PM (#10251813)
    debian packages: harden [debian.org]

    how is Hardened Debian going to be different from installing the harden* packages?

      • The official harden* packages are purely virtual. Their only purpose is to conflict with other packages which are insecure. In contrast Debian hardened wants to change the contents of the insecure packages

        Not exactly correct.

        It pulls in a documentation called harden-doc which goes through all the actions local admin should take to make the system secure. I think Javi is always putting good efforts to update it. This SGML source of this doc package is a part of the source tree creating dependency if I r

  • Itch scratching, and audit (Score:3, Interesting)

    by RedPhoenix (124662) on Tuesday September 14 2004, @08:15PM (#10251879)
    At the risk of the post sounding like a discussion at a head-lice convention, everyone has their own personal itch to scratch.

    Several posts thus far, have questioned the viability of establishing yet another secure-debian project, similar to other existing projects, and have indicated that there would be a better use of available resources if everyone would just get along and work together (or at least, form under a single project). Fair enough.

    However, there are a whole range of reasons why diversity and natural selection w.r.t many competing projects can provide benefits over and above a single large project - organisational inertia, effective and efficient communication, and development priority differences, for example.

    'Organisational inertia' in particular, whereby the larger a organisation/project gets, the slower it can react to changing requirements, is a good reason why this effort-amalgamation can potentially be a bad thing.

    Each of these projects probably has a slightly different 'itch' to 'scratch'. There's no reason why, later on down the track, that the best elements of each of these projects cannot be merged into something cohesive.

    A good example is the current situation in Linux Auditing (as in C2/CAPP style auditing and event logging, not code verification) and host-based audit-related intrusion detection. Over time, we've had Snare (http://www.intersectalliance.com), SLES (http://www.suse.com), and Riks Audit Daemon (http://www.redhat.com). Each project had a slightly different focus, and each development team have come up with some great solutions to the problems of auditing / event logging.

    The developers of each of these projects are now communicating and collaborating, with a view to bringing a effective audit subsystem to Linux that incorporates the best ideas from each approach.

    BTW: How about auditing in this project? Here's a starting point:
    http://www.gweep.net/~malk/snare_debian.sh tml

    Red. (Snare Developer)

  • what's wrong with /dev/urandom (Score:4, Insightful)

    by mo (2873) on Tuesday September 14 2004, @08:40PM (#10251977)
    Does anyone have evidence where a system was cracked due to the lack of entropy from things like interrupt timing?

    I would think that there exists a limited number of people in the world who could exploit a diffie-helman exchange between systems using the usual sources of randomness on an x86 machine.

  • as *if*! (Score:5, Funny)

    by Llewyn (17984) on Tuesday September 14 2004, @08:53PM (#10252076) Homepage Journal
    i suppose 'Debian Hardened' is not referring to the installation process... yegods! it was hard enough already!


    but seriously... as a debian user, i fully condone harder, faster, and stronger debians.

  • If you need a secure system... (Score:3, Insightful)

    by Anonymous Coward on Wednesday September 15 2004, @03:27AM (#10254220)

    ...just use OpenBSD [openbsd.org], where security is not a patch or an afterthought.

    It might surprise some linux fanbois, but other OSs are better suited than their beloved linux for certain tasks.

    • Re:Deban could use it (Score:4, Informative)

      by Wonko (15033) on Tuesday September 14 2004, @07:45PM (#10251732) Homepage Journal

      Take for example the fact that I can remotely shutdown a debiaTake for example the fact that I can remotely shutdown a debian machine over ssh with the "halt" command. A RedHat distro had that little feature blocked

      Why exactly is this a bad thing? Have you never had to shutdown or reboot a remote server? I know I've had to do both at least a few times... Although rebooting would be much more common, and it would probably be safer as well :p.

      On my Debian machines you seem to need to be root to do it. If someone I don't know is logged in over ssh as root on one of my boxes the last thing I am worried about is his ability to shut it down :p.

    • Re:Deban could use it (Score:4, Informative)

      by darkewolf (24563) <draoidh@iinet.net.au> on Tuesday September 14 2004, @08:48PM (#10252024) Homepage Journal
      Being able to remotely shutdown or halt a machine is a godsend. The trick is to restrict SSH access-in from certain 'secure' IP addresses, and firewall the rest of them out. Secondly, I guess only allow root access from a non-root account (ie: no ssh'ing in as root).

      But I guess to each their own :)
    • It seems Quantum Mechanics disagrees with you. Thank goodness, too. If every effect needed a cause, we'd be in a funny conundrum when considering the origins of the Universe, wouldn't we?

      It rather reminds me of St. Thomas Aquinas' proof of the existance of God using the logic of the unmoved mover (that as all things have cause, there must exist one seed without cause to begin the chain, and that seed is God). This mostly seems like bunk, today, what with the fact that cause can follow effect, Quantum Me

    • Re:harden what?? (Score:4, Funny)

      by 808140 (808140) on Tuesday September 14 2004, @10:40PM (#10252795)
      Security is like an erection: it can always be harder and longer lasting. That doesn't necessarily imply impotence (unless it comes from the aptly named Microsoft, haha).

    • Re:Sarge... (Score:3, Informative)

      by julesh (229690)
      Who says you shouldn't run X on a server? Just make sure you have -nolisten tcp in the server setup. And for good measure, block the ports it uses.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.