![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Debian Debian](http://a.fsdn.com/sd/topics/debian_64.png)
![Software Software](http://a.fsdn.com/sd/topics/software_64.png)
![Linux Linux](http://a.fsdn.com/sd/topics/linux_64.png)
Debian Hardened Aims For Security 167
larryg writes "Debian Hardened is a new project that wants be an official Debian sub-project. It aims to provide a complete tree of hardened kernel and software packages for a standard Debian distribution, without changing to another like Adamantix and making easy the hardening of any machine running Debian GNU/Linux. The hardened kernels use the grSecurity patch and some of the Adamantix kernel patches; also, its packages are compiled with the ProPolice/SSP gcc extension and some libraries to prevent and trace buffer overflow attacks. Also, and as a second project, we are working on some enhacements against the Linux Entropy Pool engine, using an external TRNG (True Random Numbers Generator) device which uses thermal noise and also the atomic decay from a Geiger counter, making true unpredictable random numbers."
Cool (Score:5, Funny)
Re:Cool (Score:1)
Do these feature a Geiger counter?
Hardened Gentoo (Score:5, Interesting)
(not to mention the very similar name)
http://hardened.gentoo.org
Re:Hardened Gentoo (Score:5, Insightful)
Doesn't provide as many choices or the technological /security understanding of Hardened Gentoo
While I confess to being a hard-core Gentoo nut, isn't choice often the mother of all fuck ups? What's wrong with doing one thing and doing it right?
Re:Hardened Gentoo (Score:5, Insightful)
HOW? (Score:2)
That's what makes growth. And more people every day are choosing Linux over Windows. Face it, Windows is NO picnic either, especially when you consider the quality of Microsoft's software!
>[...] it just generate more competition, [...] it's the consumers who are getting shafted.
Consumers do not get shafted by having choice, that is illogical. Choice is to the consumer
Re:HOW? (Score:4, Insightful)
Re:Hardened Gentoo (Score:5, Insightful)
I read this in of the
Re:Hardened Gentoo (Score:4, Informative)
Re:Hardened Gentoo (Score:1)
(ugg waiting for the trolls to pick up on that..)
Re:Hardened Gentoo (Score:2)
Re:Hardened Gentoo (Score:2)
Now, in my mind, there's little that can help security along than the ability to see when a problem occurred, and view it from several different angles. Perhaps syslog can say something? Maybe userlog tells a diffe
Re:Hardened Gentoo (Score:5, Insightful)
gentoo is nice and all, but it certainl doesn't make it's users magically understand the underlying system. btw, just because you can copy and 'discuss' compiler flags on a forum doesn't make yourself an expert on building fast software or make you understand what kind of speed ups are even technically possible and of all things it doesn't make you magically understand how software is executed at run time or the operating system built so you could see that saying stuff like "my mozilla has no ps/2 support" doesn't really show you in good light.
one choice in reducing possible user fuckups is reducing easy user choices("do you want to have a theoretical speedup by disabling using shadow file y/n?").
Re:Hardened Gentoo (Score:4, Informative)
Comment removed (Score:4, Funny)
Re:Hardened Gentoo (Score:5, Insightful)
Re:Hardened Gentoo (Score:3, Interesting)
Re:Hardened Gentoo (Score:3, Interesting)
D:SbD [debian.org] has only been active about as long, and is in beta (almost production) stage. Of course, we're just supplying information about the systems that are out there; what impact they have; why they're good; and how to use them. In essence, D:SbD is just "this is what you do to implement a secure system without pissing the user off with tons of extra crap and breakage."
It's done the way it is because I can't myself implement these things; and I'm not forking Debian. It'd be easy enough to rebuild the
Re:Hardened Gentoo (Score:2)
Re:Hardened Gentoo (Score:2)
besides, documentation doesn't seem to make people understand the use flags and things like if theres any difference in -O3 and -O666 so how it will help here? the people will read them? as if.
a pre-hardened system needs to be that, hardened. most of use it is to people who don't entirely know what they're doing(otherwise they could just harden up a distro of their choosing).
(disclaimer: gentoo is a great distro but it doesn't grant magical insight about the kernel or g
Re:Hardened Gentoo (Score:2)
Re:Hardened Gentoo (Score:3, Interesting)
You have to admit that reading the N-thousand-word Gentoo Handbook (heh, I remember when it was just the install guide) teaches you a bit more than the "next, next, next, done!" of Red Hat or Mandrake. I know I certainly didn't know what the hell was going on when I used Mandrake (let alone Corel Linux
Re:Hardened Gentoo (Score:2)
Use the source, Luke!
That certainly would give Hardened Debian users a greater understanding...
Re:Hardened Gentoo (Score:2)
http://www.debian.org/doc/manuals/securing-debi
Re:Hardened Gentoo (Score:1)
Re:Hardened Gentoo (Score:2)
Debian Hardened is a new project that wants be an official Debian sub-project.
It's been going a whopping 2 weeks. What the hell do expect?
It's good for both, actually; (Score:5, Interesting)
The goal is not a religious war, the goal is for you and I to get ahead.
Second project (Score:2)
sourceforge is designed so that authors of software can find resources easily. I've never been able to figure out their interface without getting a migraine, however...
Hardened debain is meh to me. However, TRNG hacking is something I'd love to see! Where's the linkage at???
www.lids.org (Score:4, Interesting)
How is this going to be different than just installing Woody and applying the lids kernel patch to your particular kernel and locking the system down that way?
Re:www.lids.org (Score:3, Informative)
why need a distro for that? (Score:4, Insightful)
Re:why need a distro for that? (Score:2, Insightful)
Re:why need a distro for that? (Score:2, Insightful)
Not everyone has time to be a security expert. And not everyone likes for instance, the OpenBSD way of doing things(Not that OpenBSD is the only secures OS). Maybe I like Debian. Maybe I worry about Sercurity but I don't have all this time to recompile everything with bounds-checking etc.
Its for the same reason we have distributions period. Why doesn't everyone do LFS and assemble their own userland and tools?
Of course I did just notice your smiley, so I don't think you were completely serious ;)
Re:why need a distro for that? (Score:2, Interesting)
Some things have to be done at compile time, or need extra administrative work. Sometimes though, that work is a one-time cost, and so can be handled by the distribution. These types of things are possible with Hardened Gentoo, and are focused on with D:SbD [debian.org].
You should realize that adding Stack Smash Protection or real PT_PAX_FLAGS (as opposed to utilizing the non-standard abuse of the standard EI_PAX field), or producing ET_DYN executables that can be freely moved around by PaX can't just be done by
What about Windows? (Score:2, Funny)
Debian could use that as a spam headline! (Score:5, Funny)
wtf? Hey moderators.... (Score:3, Funny)
Hard3n y0ur Debian/w0ody t0day!
That was funny. C'mon, laugh.
Re:wtf? Hey moderators.... (Score:1)
Re:Debian could use that as a spam headline! (Score:3, Funny)
A giant corperation is tracking your every click!.
We can solve all your problems with compatibility, heck you don't even need x86 anymore and what's more it's free FREE FREE!
Linux advocates sound like really crazy late night sales people.
Interesting....... (Score:3, Interesting)
I still think the less you have the more secure it is.... as long as what you have isnt bloated. Thats why in my opinion slackware is great on security.
So if this thing is more than one iso image ill be rather skeptical since debian tends to be a very large distro...
Re:Interesting....... (Score:5, Informative)
Re:Interesting....... (Score:2)
If I remember correctly, a base installation of woody enables various debug services plus SMTP service through exim and allows access to them from anywhere through any interface. I don't feel like doing an installation now just to check that though.
This could be a good thing in the future (Score:2, Insightful)
For example, if you are setting up a single user box to access the internet with a modem (something that GNU/Linux should shine at) you often run into problems related to pppd requiring all sorts of obnoxious nonsense to get it to run as a regular user.
Policies such as new accounts having their own group by default, and not b
Enhacements against the Linux Entropy Pool engine? (Score:5, Interesting)
Would the time not be better spent looking for the next OpenSSH/SSL hole?
I'm not trolling, most security flaws come from everyday apps rather than esoteric problems.
Re:Enhacements against the Linux Entropy Pool engi (Score:4, Informative)
Re:Enhacements against the Linux Entropy Pool engi (Score:4, Informative)
The problem was not the quality of the random number generation.
Re:Enhacements against the Linux Entropy Pool engi (Score:4, Informative)
Now consider this example - random number generators are anything but secure.
Re:Enhacements against the Linux Entropy Pool engi (Score:3, Informative)
New pickup line for geeks... (Score:5, Funny)
Re:New pickup line for geeks... (Score:5, Funny)
Re:New pickup line for geeks... (Score:1)
Just in time for the new Stable release(...soon!) (Score:1)
TRNG (Score:1)
Re:TRNG (Score:2)
Question: Stability? (Score:2)
I have no first-hand experience, so... Anyone?
Re:Question: Stability? (Score:1, Funny)
I swear some people just make it too easy
Not that this is like Fark or anything, but (Score:2)
Re:Not that this is like Fark or anything, but (Score:1)
Re:Not that this is like Fark or anything, but (Score:1)
Re:Not that this is like Fark or anything, but (Score:2, Funny)
I call mine "Sarge".
My distro, I mean.
good trend (Score:3, Informative)
personally I'm really interested in the Security-Enhanced Linux [nsa.gov] that the NSA is working on. To have something that complete is really intriquing. Now if they don't have something like apt to keep it steady I dunno...but you have to admit it's got 'wow' factor written all over it!
BCDFY^&D&S^F
Re:good trend (Score:5, Insightful)
Re:good trend (Score:5, Insightful)
Re:good trend (Score:2)
Re:good trend (Score:2)
Since your computer most likely contains parts made in China, I suppose you're a strong supporter of the communist regime there?
Re:good trend (Score:5, Interesting)
If you look at the SElinux download page [nsa.gov] you can read the following tidbit:
In other words, SElinux comes with the kernel.
They'd need more drastic changes (Score:5, Interesting)
At any rate, these people don't understand that they'll need more drastic changes. Why not bring attention to http://d-sbd.alioth.debian.org/ while you're at it? This is my project, just a demonstrational effort to bring these things to the attention of the Debian maintainers.
The idea isn't to have a hardened "Enhancement," but rather to incorporate anything you can put in that won't hurt. For example, you can compile glibc, gnome, and bash with SSP/ProPolice, and nothing else will use ProPolice but those. Those programs also won't be hurt by ProPolice. We can extend this to, "Compile any program or library that won't break with it with SSP." The user will never notice; but it'll stop a range of attacks.
My point is that you need to aim low. A hardened system like Hardened Gentoo or Adamantix will supply you with *everything* -- PaX, SSP, ET_DYN binaries, rediculously complicated MAC systems, firewalling maybe, network sniffers, etc. A non-hardened distribution should look at each of these, determine which don't change the end user's experience (administrator included), and implement them. This is "Do what's easy" rather than "Do EVERYTHING we possibly can," but it's still better than just being lame in the area of security.
Re:They'd need more drastic changes (Score:1, Funny)
Securing Debian Manual (Score:1)
Securing Debian Manual (Score:2, Informative)
Who are these people? (Score:5, Informative)
Debian already has a security project, a few of them actually.
I looked at google for either of these guys names and unless I am mistaken, this is what I got: developer one [google.com] and developer two [google.com].
Interesting that anyone else that they haven't ever used those names to contribute to say at least a single debian security mailing list, or say ANY debian lists?
Even more interesting is that they don't seem to have much but a slashdot plug and they are accepting donations.
I am not impressed. Working with the debian security team is the way to go.
Steve Kemp [steve.org.uk] is one of the main guys heading up the debian audit project, these guys should be working with him. Not for some other project.
The official debian project for this is the debian audit project [debian.org].
Hell advertising that they use SSP enabled GCC! Steve makes those packages for use with debian already!
Re:Who are these people? (Score:2, Informative)
Debian by default does not ship with an SSP enabled GCC.
I've made packages available [debian.org], and others have too - but by default the patch isn't applied to Debian's compiler.
Please see bugs 233208 [debian.org] and 213994 [debian.org] for details.
TRNG (Score:4, Informative)
Rate of what? (Score:1)
selinux? (Score:4, Interesting)
One issue with selinux I (think) I understand is that in order for applications to run properly you need to have predefined rules which allow them to do what they need to do (the nature of MAC is they can't do anything except what is explicitly allowed, as I understand it). This is possible for servers, which do only a few jobs repeatedly, but for a desktop machine with hundreds of potential applications to fire up and more being developed such a burden becomes huge. A normal user would end up turning off MAC in order to use the computer the way they want to, unless each application they want or may want to use already has a default ruleset present. I would be really happy to see this happen - various distributions collaborate on default rules for large numbers of applications, so end users could actually use systems that are seriously hardened. I know it's probably overkill, but given what casual Windows users on the network have done over the years (as well as unsecured Linux boxes and other OSes, for that matter) I think if some combination of projects could deliver a usable desktop machine with mandatory access control and any other features which might defend their box while letting it be useful would be a Very Good Thing. One thing is for sure - too little security does more harm to the internet community than having more protection than you need.
Re:selinux? (Score:3, Insightful)
No, the solution for SELinux is for the application developers themselves to write policy.
Last time I discus
http://packages.debian.org/harden (Score:4, Interesting)
how is Hardened Debian going to be different from installing the harden* packages?
Re:http://packages.debian.org/harden (Score:3, Informative)
Not exactly correct.
It pulls in a documentation called harden-doc which goes through all the actions local admin should take to make the system secure. I think Javi is always putting good efforts to update it. This SGML source of this doc package is a part of the source tree creating dependency if I r
awesome ... good job (Score:2)
such as providing a
a openswan package that works directly from a dialog script.
not to mention a basic iptables front end like redhat has, where is the 'low, medium, high' trusted interface prompt upon install for debian?
Itch scratching, and audit (Score:3, Interesting)
Several posts thus far, have questioned the viability of establishing yet another secure-debian project, similar to other existing projects, and have indicated that there would be a better use of available resources if everyone would just get along and work together (or at least, form under a single project). Fair enough.
However, there are a whole range of reasons why diversity and natural selection w.r.t many competing projects can provide benefits over and above a single large project - organisational inertia, effective and efficient communication, and development priority differences, for example.
'Organisational inertia' in particular, whereby the larger a organisation/project gets, the slower it can react to changing requirements, is a good reason why this effort-amalgamation can potentially be a bad thing.
Each of these projects probably has a slightly different 'itch' to 'scratch'. There's no reason why, later on down the track, that the best elements of each of these projects cannot be merged into something cohesive.
A good example is the current situation in Linux Auditing (as in C2/CAPP style auditing and event logging, not code verification) and host-based audit-related intrusion detection. Over time, we've had Snare (http://www.intersectalliance.com), SLES (http://www.suse.com), and Riks Audit Daemon (http://www.redhat.com). Each project had a slightly different focus, and each development team have come up with some great solutions to the problems of auditing / event logging.
The developers of each of these projects are now communicating and collaborating, with a view to bringing a effective audit subsystem to Linux that incorporates the best ideas from each approach.
BTW: How about auditing in this project? Here's a starting point:
http://www.gweep.net/~malk/snare_debian.s
Red. (Snare Developer)
what's wrong with /dev/urandom (Score:4, Insightful)
I would think that there exists a limited number of people in the world who could exploit a diffie-helman exchange between systems using the usual sources of randomness on an x86 machine.
Heh... (Score:2, Funny)
as *if*! (Score:5, Funny)
but seriously... as a debian user, i fully condone harder, faster, and stronger debians.
If you need a secure system... (Score:3, Insightful)
It might surprise some linux fanbois, but other OSs are better suited than their beloved linux for certain tasks.
Re:If you need a secure system... (Score:2, Informative)
I agree entirely with this. Before jumping on the bandwagon, read here [openbsd.org] for a synopsis of what a secure *nix operating system is about.
Too much security (Score:3, Interesting)
Sometimes I get a feeling saying that people spend too much time thinking about security in the OSS world. Security is important, but as mentioned earlier, has a system's security for example ever been compromised because of insecure random number generation?
It's just like the VPN softwares around. Take for example IPsec/FreeSWAN and OpenVPN. OpenVPN offers great security using SSL and TLS. Both those protocols are in the present time considered secure and it's fairly simple to setup.
IPsec on the other hand, takes the concept of security to a whole new level. This affects the overall software, turning it into a pain to set up and understand. And in order to make full use of the security you have to understand how it works.
I bet many security issues arises out of misconfiguration due to unnecessary complexity in the software. Keep it simple stupid is the way to go.
My point is: isn't secure security enough? Does it have to be better?
Re:Too much security (Score:2)
However, sometimes security is more important than even availability; perhaps you are storing information on your computer that is the blueprints for some massive new technology that will revolutionize some industry. Obviously, you don't want someone breaking in on a bet, and leaving with something that might just destroy you financially.
Or perhaps you're in one of two companies in a hotly contested industry; the last thing you need is the comp
Re:Why the fuss? (Score:1, Redundant)
Re:Why the fuss? (Score:2)
But redundant... come on, do you really believe that someone else has already made that joke? With maybe only 5 non-troll posts?
Re:Why the fuss? (Score:1)
Is (-1, Unfunny) eqaul to (+1, Funny)???
PS- I would have modded you (+1,funny, wears crash helmet on short bus).
Re:Why the fuss? (Score:2)
I'm thinking you must have a vindictive mod or some such. You didn't piss off the anti-slash folks did ya?
Re:Deban could use it (Score:4, Informative)
Take for example the fact that I can remotely shutdown a debiaTake for example the fact that I can remotely shutdown a debian machine over ssh with the "halt" command. A RedHat distro had that little feature blocked
Why exactly is this a bad thing? Have you never had to shutdown or reboot a remote server? I know I've had to do both at least a few times... Although rebooting would be much more common, and it would probably be safer as well :p.
On my Debian machines you seem to need to be root to do it. If someone I don't know is logged in over ssh as root on one of my boxes the last thing I am worried about is his ability to shut it down :p.
Re:Deban could use it (Score:2, Insightful)
Actually, if someone I don't know is logged into my system as root, I'd prefer they simply shut the machine down. Then they can't do any (more) damage...
Re:Deban could use it (Score:2)
If you are afraid ssh will be compromised, then don't use ssh.
Re:Deban could use it (Score:4, Informative)
But I guess to each their own
Re:True random numbers are impossible! (Score:3, Interesting)
It rather reminds me of St. Thomas Aquinas' proof of the existance of God using the logic of the unmoved mover (that as all things have cause, there must exist one seed without cause to begin the chain, and that seed is God). This mostly seems like bunk, today, what with the fact that cause can follow effect, Quantum Me
Re:harden what?? (Score:4, Funny)
Re:Sarge... (Score:3, Informative)
Re:Sarge... (Score:2, Informative)
Which is the default in Debian.
Re:Sarge... (Score:2)
Not necessarily [sorry.vse.cz]