Slashdot Log In
Red Hat Linux Gets Top Govt. Security Rating
Posted by
CmdrTaco
on Mon Jun 18, 2007 08:03 AM
from the take-that-to-yer-boss-and-shove-it dept.
from the take-that-to-yer-boss-and-shove-it dept.
zakeria writes "Red Hat Linux has received a new level of security certification that should make the software more appealing to some government agencies.
Earlier this month IBM was able to achieve EAL4 Augmented with ALC_FLR.3 certification for Red Hat Enterprise Linux, putting it on a par with Sun Microsystems Inc.'s Trusted Solaris operating system, said Dan Frye, vice president of open systems with IBM."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
CentOS too? (Score:3, Interesting)
Re:CentOS too? (Score:5, Informative)
No. CentOS (i.e., the actual binaries built by the CentOS team on the particular set of hardware used by the CentOS team) needs to go through the exact same evaluation process, with documentation and all.
Parent
Re:CentOS too? (Score:4, Informative)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
For people who don't grok EAL4 and ALC_FLR.3 (Score:5, Informative)
This is roughly equivalent to "B" in the well-known U.S. "Orange Book" security standard. Previously all commercial off-the-shelf OSs were rated C or below, and had trouble even getting that (NT 4 got C only if the network was physically removed).
The letters correspond with school grades: A is excellent, B is ok, and C is barely adequate.
--dave
Re:For people who don't grok EAL4 and ALC_FLR.3 (Score:5, Interesting)
Parent
Re: (Score:3, Interesting)
--dave
Re: (Score:2, Interesting)
Re: (Score:3, Informative)
Here [niap-ccevs.org] is the Windows cert. Here [niap-ccevs.org] is the Redhat one. Notice that under PP identifiers Windows has CAPP, while Redhat has CAPP, LSPP and RBACPP.
Re: (Score:2)
It's more accurate to describe RHEL and CentOS as derivatives of Fedora. Fedora is the upstream for all other distributions that are in the Red Hat family. Red Hat Enterprise Linux is derived from Fedora, and CentOS is in turn derived from Red Hat Enterprise Linux.
SELinux, for example, appeared in Fedora long before it ever appeared in RHEL or CentOS.
Re: (Score:3, Interesting)
Again, please don't treat this as a flame. I'm just curious to know how BSD ranks vis a vis other OSes, especially Linux, and especially in terms of security.
Re:For people who don't grok EAL4 and ALC_FLR.3 (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
No, it's not.
"EAL4 with CAPP, LSPP and RBACPP" means that RHEL5 on most all current IBM h/w can be very secure by people who care and know what they are doing.
Re: (Score:3, Informative)
No, because without the certification, secure/sensitive installations aren't allowed to use those flavours of BSD (or any other uncertified product). If there's no other way of performing a function, it might be justifiable, but it'll be a brave sysadmin that pursue
Re: (Score:3, Insightful)
For certification purposes, it really doesn't matter how secure the system is, but how secure you can show the system is.
I attended a presentation regarding these certifications from a manager at IBM, (I forget his name), that had taken several products through the certification process and he said that it is all about the documentation. For example, how many people working on BSD have the architecture, design and user documentation to prove that something has been designed securely? It might be secure a
Re: (Score:3, Informative)
The confusion here is that this certification has nothing to do with exploits or kernel bugs (the form of security most people talk about on a regular basis). We're talking about CIA/NSA levels security. It's based largely on how finely-grained the system permissions are, so that an exploited application can't access any other files, open any other ports, etc., etc., as
Re: (Score:2, Funny)
Just wait until the "No OS Left Behind" program gets passed.
XP SP2 and Windows Server 2003 has the same rating (Score:3, Informative)
Re:XP SP2 and Windows Server 2003 has the same rat (Score:5, Informative)
Parent
Re: (Score:2)
Here are some relevant definitions:
Re: (Score:3, Funny)
Re:Someone want to explain the Common Criteria to (Score:3, Insightful)
If there is a vulnerability that would affect that setup/version in it's configured state, then the rating is supposed to be withdrawn, the problem fixed, and the system resubmitted.
Someone has figured out that perhaps, it might be a good idea to not have the vault door sealed, and a hole drilled in the side of the wall, so they tell you to apply security patches.
For the w
easy (Score:2)
Is this the same system that had famous telnet froot [slashdot.org] vulnerability recently?
Slashdot responses (Score:3, Funny)
Let's compare the comments at the end of the day.
Re:Slashdot responses (Score:5, Informative)
Parent
Resource and protection guarantees? (Score:2)
So, my question is: Is there similar functionality in the works for Linux?
Re: (Score:3, Informative)
Only as secure as its least secure member... (Score:4, Interesting)
Yeah yeah. But what does it /mean/? (Score:4, Interesting)
What's more interesting is does the resulting system do anything useful? Web server? Mail server? DNS? File server?
Do you lose certification as soon as any extra services are running? In which case, it's fairly meaningless because the certification only applies if the system is broadly useless.
Not the highest rating available (Score:3, Informative)
XTS-400 (Wikipedia entry) [wikipedia.org]
XTS-400 [baesystems.com]
That particular system is rated at EAL 5. IBM's only achieved EAL 4.
EAL-6 is the highest possible security rating (Score:3, Informative)
Nor is EAL-4 the highest rating an OS product has achieved.
EAL-5 has been achieved by only one complex product in the world last I looked (BAE's STOP OS, a Linux look-alike in API/ABI running on an Intel CPUed platform) and it doesn't lose its security rating when connected to a network.
The value of the rating system is that it lets everyone see the criteria under which you were judged and the degree of excellence against those criteria determined by independent judges. But the person selecting the product has to know a lot about security to be able to understand the value provided. For example, it is easy to configure most EAL-4 rated OSs in such a way that they void their rating.
Having been the Product Manager during the STOP evaluation, let me congratulate Red Hat as achieving EAL 4 is a great achievement for their team (and was required of us before we could even submit for an EAL-5). May they now go on and undergo additional time, expense and pain in striving for a higher rating.
Re: (Score:2, Interesting)
Re: (Score:2, Funny)
Re: (Score:2)
Always good for a laugh.
Re:Hrmm. Not good enough for the average user (Score:4, Informative)
They're never on topic, they just show up in random Linux articles.
Parent
Re: (Score:2)
Re:Hrmm. Not good enough for the average user (Score:4, Interesting)
Ignoring for the the moment I agree with *some* of your points, Linux on the desktop has nothing to do with this post, it is entirely about Linux as an enterprise grade server OS.
Parent
Re: (Score:2)
None of your points are valid (Score:5, Informative)
A)Many different versions of Linux have various binary packaging systems so you don't have to compile things, Debian and Redhat being the two most popular (yum and synaptic/
B)The vast majority of mission critical infrastructure systems that the internet and all high level computing systems run from the command line. Switches, routers, cores, these are the bread and butter of what makes the internet work, and nobody says that a developer has failed when they produce one of these that works. Frankly, you are just being hyperbolic, failure as a developer means that your application does not work. These devices and applications do work, and as anyone familiar with a command line interface knows, it is usually far simpler to troubleshoot a problem in an environment that you have complete control over (like the command line) than it is in some hairbrained GUI that is made to pander to people like yourself who consider themselves technical users but think that command line interfaces are bad.
C)Linux documentation is far superior to that of Windows, because the API's and sourcecode are all available. Learn how to program, don't blame the difficulty of programming on inferior documentation and instructions. There are people who do what they want in linux, just because you can't, doesn't mean that there is something wrong with linux. Rather, it probably means you are not that smart. The entire notion that linux is an alien environment presupposes a fetish for windows.
Your conclusion is complete bunk, because your arguments don't hold any water. Basically, what you've just done is ranted. Linux does not suck in the regards you listed. Nothing is perfect, and everything can be improved, but you simply don't make a nuanced point like this.
Besides which, this thread was about Security!
Parent
Re: (Score:3, Informative)
This is not desktops, but huge servers. I have many many times tried to get such organizations to even apply one of our patchsets to their servers due to them hitting known bugs and it may take a couple of m
Re: (Score:3, Informative)
A) You don't have to compile anything. But you can if you want to. And you can forget about all those dependency DLL-hell issues too that you get in Windows, if you use a modern distro with good package management. Then you just fire up the GUI, put a "tick" in the box for the software you want, and it gets it for you and installs it. It's easier than having to trawl through someone's web site for the right installer, manually download it, manually run the setup. And then find t
Re:Hrmm. Not good enough for the average user (Score:5, Insightful)
That said, as much as I like the concept of Windows NT, I simply will not try it any longer until I hear that a number of problems have been solved.
A) Having to manually download software/worrying that nonstandard installation routines might scatter junk all over the file system and not remove it upon deinstallation. For that matter, I don't want to have to manually download and install anything, ever. Just to make this clear, never. Come up with either something akin to Ubuntu where I run Synaptic to install everything I need, or (if you absolutely have to) make it like Mac OS X where I just drag and drop the folder.
B) Any time I'm forced to to edit the Registry by hand (without documentation, to boot), you as a developer have failed. Back 10 years ago, this may have been acceptable. In this day and age, it isn't. Furthermore, while once in a blue moon I may have to change a system-breaking internal file in Linux, in Windows it's a constant occurrence. Again, you have failed.
C) A troubleshooting guide instead of proper OS documentation does not cut it. Neither does a message board where half the time I'll be told to reinstall, 25% of the time I'll be told to run random diagnosis apps, and the other 25% of the time I'll get genuinely helpful people giving me contradictory answers. If I'm expected to jump to an alien computing environment you'd best make sure your documentation is up to snuff. Most Windows apps suck in this regard.
I'm an advanced user who's in favor of feature-rich OSes, but the bizarre, arcane, and technical details I have to jump through to achieve the same things that are comparatively simple in Mac OS X or Linux make Windows a deal breaker. You will never, ever, become successful on the server until idiocy like this is exorcised from the OS.
Parent
Re: (Score:3, Funny)
Did I miss something? Is it "Asshat Monday" and I didn't mark it on my calendar?
Re: (Score:3, Insightful)
Why, pray tell, would any 'average' user wish to dick around with vi and text-editting config files? Hint: They wouldn't.
True, but I also think that most average users would take a text-based configuration file, especially one with instructive comments, over the Windows Registry any day of the week.
I'm not saying that registry editing is a usual occurrence, but sometimes it needs to be done, and I would prefer clear text files every time. Especially those parts of the registry indexed on class GUID are really opaque.
Australians... (Score:2)
Re: (Score:2)
Mod Parent Informative (Score:2)
Re: (Score:3, Interesting)
Of course it hasn't. Certification costs a lot of money (tens- if not hundreds-of-thousands of dollars), and there're no organisations with that kind of money that have a major interest in OpenBSD. Could it pass? No, because it lacks RBAC/MAC and other necessary security systems. Has it even been tested? Certainly not, because nobody's put it up for certification, and also because the team that produces it haven't built in subsystems for RBAC/MAC.