Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Linux Software

NSA Releases High Security Version Of Linux 257

Posted by Hemos
from the making-things-secure-=-good dept.
We had an extremely interesting submission from Ted T'so,, Linux kernel developer, who also has an obvious interest in security, given his work with Kerberos [?] . He wrote in concerning the release by the NSA (Yes, that NSA) of a high security version of Linux. I've included his comments below.

tytso writes: "I recently attended a DARPA workshop which focused on high security open source operating systems. It turns out that parts of the U.S. government are really interested this topic; having an operating system with the necessary high-security features which they need, and for which source code is available, would be a really good thing for them. Among other things, for example, it would mean that they wouldn't have to live in terror about what might happen if Sun, IBM, SGI, et. al decided to pull the plug on Trusted Solaris, Trusted AIX, or Trusted IRIX. And they're serious enough that DARPA's willing to throw money at the problem.

While I was at this workshop, I met some folks from the NSA and they told me about a really neat project that they've been working on, called Security-enhanced Linux. One of the cool things about it is that it separates enforcement and policy. So selinux can easily support many different security policies, from the old (some would say outdated/silly) Multi-Level Secure/Bell-LaPadula model, to Domain-Type enforcement and Rule-Based Access Control models. So if you think that high-security features means the old silly, Secret / Top Secret / CMW bullshit, and needing to make sure that Secret windows don't get expose events from Top Secret windows, think again. A number of folks have found Domain Type Enforcement and Rule-Based Access Control systems very useful for securing Web servers and other real world systems.

The NSA folks just recently got permission to make their stuff available on the Web. It's just a proof of concept, and no doubt a lot of changes will need to made before people will accept integrating it into the kernel, but they have released a working system (both kernel and userspace patches --- RPM's aren't quite ready yet) based on Linux 2.2 and RedHat 6.1. So it's definitely worth a look, and in fact some folks with specialized needs might find it useful, even though it's a prototype.

Of course, the source code is all there, and we're encouraged to look at and audit the code. So paranoiacs who think that the NSA is trying to infiltrate trap doors into the Linux kernels needn't worry. (Besides, it's a different part of the government who's interested in spying on U.S. citizens, and it's much more efficient for them to break into your house, and insert a wiretapping device between your computer and your keyboard as part of a black bag job. :-)

The Web site is http://www.nsa.gov/selinux. I think it's really great that some folks at NSA's Information Assurance Research Office (IARO) have made this contribution to the Linux community. They're really nice folks (even if they can't talk about a lot of what they do at work :-).

P.S. Apparently it's not easy to get stuff published by the NSA, since their entire culture, not surprisingly, is based around not letting stuff out. This Web page went up a few days ago, and then some bureaucrats made the folks in the IARO take it down temporarily, much to their disappointment. At the moment it looks like they've finally crossed all of the bureaucratic t's and dotted all of the bureaucratic i's. But just in case, it might not be a bad idea if someone mirrored the entire tree just in case some flack in some other part of the agency tells them to take it down again....

"
This discussion has been archived. No new comments can be posted.

NSA Releases High Security Version of Linux

Comments Filter:
  • IIRC, GPL says that you do not have to release stuff you created based on GPLed software. It says that you have to release the source code whenever releasing your stuff to public.
  • You need to educate yourself about punch card. Sometimes one person's chad ends up in another person's hole. The second person, through no fault of her own, is thus denied her right to vote.

    Voter error? Supervisor of Voters error in my opinion for having such junk. Just because a system is automated doesn't make it reliable. If Florida had used paper ballots then every valid vote would have been counted, and Al Gore would have been president.

    Admit it. The voting machine companies are palming off junk on the public. What if Microsoft sold you MS-DOS 2.0 and claimed it was state-of-the-art. That is what the voting machine companies are doing when they sell these horrid, unreliabel machines that steal people's votes. And install an imposter as President.

  • "Are you implying that slackware 7.1 is a secure system? Have you audited the entire distribution yourself? Can you honestly say that you trust your distribution to be 100% secure?"

    Have you? And it's true, *in general*, more secure systems are more difficult to use. Try jacking up the kernel security level in any BSD and see how much stuff you would use normally breaks. There are lots of things you can do in most unices that you can't do in OpenBSD, due to them not being the most secure practices in the world - this makes the system more secure, and less usable.

    There is a tradeoff, and you need to find the balance that is appropriate for your needs - developers also need to work on making their OSes security features more useable. Argus Pitbull is one of the most usable AND secure TOS add-ons I've seen, but it's still more difficult to use than your average everyday UNIX.

    -lx
  • Hey, the whole effort is only in prototype stage. They've probably been working on it for a while, and released what they had. You can probably be sure they will integrate their changes into a more current kernel.


    ...phil
  • You might want to just stop by the State Dept., they "lose" them all the time, as in: "Would anyone who's found a laptop with top-secret information please return it to the security desk as soon as possible?"

    Or, if you're a Brit apparently MI5 does the same thing.
  • Disclaimer: I'm just guessing here, I have no inside knowledge, no fly-on-the-wall stuff & if I did I sure as heck wouldn't be posting to /.!

    Perhaps Linux over BSD et al 'cause they had it handy? Nothing more sinister, nothing more simple?

    There's two sorts of projects: Those that start out with a committee, a budget, a goal & a process. Then there's a couple of hackers playing around with some tech that came in the door, making a tweak here, making a tweak there, realizing they might have something then writing it up & getting official approval to go ahead with whatever.

    It may have been been by plan that Linux got used, or it may have been just what they were playing with the clouds parted in just the right day, things clicked & they got a go-ahead.

    There's a lot of bright folks who "work in Maryland" (as in don't-ask-me-details) and their internal culture, while security-obsessed, is also supposed to be pretty free & open to new ideas. Since they've got lots of spare IQ points floating around, budgets aren't a terribly over-riding concern & their mandate is to know all about lots of things (especially stuff like OS's) it's hardly suprising they've been playing with Linux. Heck, it was likely a directive from some (not so) pointy-haired-boss.

    The interesting thing is that they're releasing this to the outside world. That means that either the institution thinks doing so would improve the US's security in some way or there's a bunch of geeks in there who *really* want to contribute.

  • Oops--I was careless with my wording.

    I meant, of course, that Apache doesn't deserve much credit if any for the 'opening' of NSA. They deserve tons of credit for creating a stable, robust, cross-platform (!), and free app which runs the majority of the world's web sites; and successfully flies in the face of Microsoft. Kudos to them for that!

  • by tytso (63275) on Friday December 22, 2000 @07:56AM (#543704) Homepage

    Actually, they CAN'T release it under GPL! Huh? It's worse (better?) than that - It's public domain! We PAID for it.

    Yes, to the extent that the work is done by government employees, this is true --- however, since it is based on GPL'ed code, only the changes to the code are in the public domain. The overall piece of work is still covered by the GPL. This is part of the "infectious nature" of the GPL.

    Also, there's an absolutely trivial way to get around the "work done by government workers must be in the public domain". You just simply hire government contractors to do the work for you, in which case the rule doesn't apply any more. This is a really nasty loophole, especially since many senior government employees get tired of getting paid sh*t wages, and simply resign, and start working for a government contractors, who (after taking a cut, of course) resells that persons time back to the government at a much higher rate. It's a 100% lose all around for the taxpayer. We end up paying more for the same person's work, with a percentage cut being paid to the a third party as sheer overhead, and the work doesn't get have to get released into the public domain any more (the government contractor can resell code developed at government expense as some propietary, commercial product.) Lovely, eh? All because the idiots in Congress aren't willing to pay government workers --- especially in a hot field like software engineering --- what they're worth.

    If you'll note on the NSA SE Linux web page, you'll see that some of the work was indeed done by contractors. Fortunately, thanks to the GPL, the overall work still has to be released under the GPL, if it's going to be released at all.

  • I'm sure including these was to provide a backdoor in case the product got into the hands of the enemies.

    "Sir, Saddam has Secure Linux running, what should we do?"
    "Does he still have rsh running and wu-ftpd?"
    "Sir, let me say that you are a true genius."
  • The only thing they could do is license the diffs as public domain. They can't relicense the kernel as public domain since it's already licensed under the GNU GPL and they have no authorization to relicense it under different terms. Government agencies have to play by the same rules as everyone else -- the GPL grants no special permissions to military agencies.
  • I'm not the most trusting person of the US Government, but, of course, it was the founder father who said don't trust the government. However, I respect the NSA and known people who work inside of NSA, one guy was friends with a top sysadmin in the NSA NOC. These guys were highly respected, highly trust worlthy people who stricly kept to thier outh.

    I don't adgree with all of the NSA ops, but this one I do. I see highly unlikey that the NSA would "plant" bugs in open sourced code. That would be stupid. Even though we belive the NSA, CIA, FBI is sometime above the law, they have to follow laws (I'm about to go to court fighting unlawful action of a police officer). So why would they do such a thing. Everybody know this code will be audited, I know I will audit it myself, so why put bugs or backdoors into the code? Somebody will find it. If there is back doors in the code, that would be one of the dumpest thing the NSA has ever done.
  • My (albeit limited) understanding of the GPL is that the NSA would NOT have to release source code for modifications they make to Linux, as long as they didn't release the binaries they make either.

    In other words if they modified Linux for internal security, everyone in the NSA could get a copy with out the NSA needing to release the sources to the world.

  • Contributions from government agencies have benefitted the Linux community as a whole in the past - NASA contributed some great work on the Linux ethernet drivers I use at work. I am sure everyone will benefit: the NSA gains the advantage of peer review of their security tweaks and the community receives the source code to incorporate if they so choose.
  • I'm not entirly sure why our friends to the north are treated differently, it may have something to do with having a "free" boarder between us. (Some people also therorize that it is because Canada is the "51st state" ;-)

    I don't think the Queen of England (or a Canadian for that matter) would have much luck being hired by the NSA, but the Canadian would have much greater luck, being "trusted". Looking on their web page, any and all positions avaliable with the NSA, require you to be a US citizen (http://www.nsa.gov/programs/employ/index.html [nsa.gov]) as well as get a background check.

  • Phil's right on target. Microsoft is in over it's head, with the anti-trust case and all. But this is going to kill them! Plus, the so-called Senator from Microsoft (Slade Gorton of Washington) is gone, except he's replaced by Maria Cantwell, a Real Networks Exec!
  • Oh it just gets way too complicated because then you have to add mods like:

    Score +1 Optimistic
    Score -1 Naive
    Score -3 AOL user level of naivety
    Score -5 I believe the government really cares about my needs naivety

    You see, it just gets too wierd when you try to bring balance to the force, (or farce(or schwartz))...

  • by F452 (97091)
    Yeah. So?
  • geez. will this not end? We have a very simple system. a machine looks at the votes. the machine is not biased. the machine counts only votes that are absolutely a positive vote. there is no question about this fact. Unfortunately, some people are unable to read directions, and then bitch about thier own incompetence. It amazes me that these people are able to drive cars, but can't seem to puch out the right hole.
    .e.
    www.perceive.net [perceive.net]
  • by bmongar (230600) on Friday December 22, 2000 @05:58AM (#543715)

    First sign: Courts finding Microsoft guilty of leveraging a monopoly

    Second Sign : NSA releasing information to the public about security

    Third sign : Rivers turn to blood

    The end is coming just one more sign

  • I found this block of code in stdio.h:

    #ifndef SECRETBACKDOOR
    #define SECRETBACKDOOR 23
    #endif

    I may be paranoid, but that seems a little suspicious...


    I'd rather be a unix freak than a freaky eunuch
  • This seems counterproductive, in my opinion. They could have just as easily contributed to the TrustedBSD [trustedbsd.org] project. If they had done that, then their code could have actually been used in more than just one operating system, instead of just Linux, due to the incompatibilities between the GPL and the BSD license.

  • Whoops... I should actually review my posts, before hitting submit.

    What I meant to say was that you claim is that it is necessary for a vote to be properly prepared for the machine to count it, while the Gore camp claims it is not sufficient for a vote to be properly prepared for the machine to count it. I meant to add the most important point: these two statements do not contradict each other.

  • Oh yes, how can I forget that? Laziness is, of course, the father of invention.

    But there's a good laziness and there's a bad laziness. :)

    When laziness prompts you to find a better, more efficient, and often ingenious way to tackle the problem, it's grand. But when you don't implement a specific sanity check, or a buffer length check because of laziness, then it's a bad thing (tm).

    Mike

    "I would kill everyone in this room for a drop of sweet beer."
  • by PxT (26449) on Friday December 22, 2000 @06:00AM (#543721)
    Mirror being built Here [droflet.net].
  • > Maybe he got more votes, maybe he didn't.

    Actualy, the media are already doing a recount under Florida's extraordinary liberal "Sunshine Laws".

    There's a big blustery effort including multiple news publishers and a conservative "research" group, and they're inching along at about 450 ballots a day.

    However, The Miami Herald is going it solo, and using their brains. They have already done a whole county using an optical scanner, which not only helps with speed, but also reduces subjectivity.

    Guess what? That single county turned up 130 more votes for Gore. Stay tuned for more. At least until the Republicans get Scalia to order it stopped and the ballots destroyed.

    --
  • But you don't have to worry about hidden trojans in binaries that aren't released. That kind of makes it a moot point.

    Either they release it, and have to release the code, or the don't release it, and you dont' have to worry.
  • by G-Man (79561) on Friday December 22, 2000 @06:01AM (#543725)
    ...just be sure to comment out "backdoor.h" before compiling anything...
  • by WNight (23683)
    The problem with the electoral college isn't the idea of breaking the country into small ridings, many of which a party/person must win to be elected. That makes sense, that's what keeps politicians visiting small states even though they could win with only bigger states if all votes were pooled.

    But, the system is broken when it comes to the application of these state votes.

    The electoral college voters aren't required to vote the way the voters in their state voted. If the EC wanted, they could reverse a 99% popular vote.

    That's the part that should be thrown out, an EC voter who doesn't vote the popular vote should be considered to have committed an offense on the level of vote tampering.

    But then, with those votes guaranteed to go for the popular vote, we could ditch the whole EC step and just put all of the state's votes directly towards the winner of the popular election.

    I know that's not what happened in Florida, but it's the biggest problem in the electoral part of USA politics.

    (The other biggest problem, imho, is that campaign contributions are considered bribery, and taking them isn't considered treason.)

    I think the USA (and Canada) would both benefit from a better system of actually casting votes, as have been outlined on /. recently, but that's a minor problem next to corruption and the EC not being mandated to follow the wishes of the people.
  • Have you?

    No, I haven't. I place a specific amount of trust in the systems I set up and a specific amount of faith in my abilities as a sysad. If anything looks peculiar or out of place, I place faith in my abilities to find any security issues in my setup and/or responsible code.

    And it's true, *in general*, more secure systems are more difficult to use.

    Yes, I'll agree with you, in general, they are. My point is that they don't *have* to be and just because a majority of them *are*, doesn't mean a well-designed secure system neccessarily be user unfriendly.

    Try jacking up the kernel security level in any BSD and see how much stuff you would use normally breaks.

    Oh I have. Case in point: trying to run X under FreeBSD with the default kernel security level. It confused me the first time I tried it, but after mucking around in the system, I found out why the X server was dying at the point it tried to open the console. I adjusted my kernel.securelevel to compensate.

    There are lots of things you can do in most unices that you can't do in OpenBSD, due to them not being the most secure practices in the world - this makes the system more secure, and less usable

    Very valid point. We don't have to keep the scope to UNIX though. I'm talking about the security of any computerized system, really. But, perhaps we've gotten away from the security controls the UNIX model provides. Whatever happened to the principle of least privilege anyway?

    If you ask me, vendors nowadays are placing too much trust in the programmers.

    Mike

    "I would kill everyone in this room for a drop of sweet beer."
  • by Dahan (130247) <khym@azeotrope.org> on Friday December 22, 2000 @08:07AM (#543734)
    Really [slashdot.org]. "At this time, we are not working on SMP. It's a lot of work, and not considered the most interesting thing to our developers."

    The OpenBSD SMP branch is probably just waiting for code from NetBSD (where SMP is being worked on.)

  • by tytso (63275) on Friday December 22, 2000 @08:09AM (#543738) Homepage

    Whatever your opinion of the NSA might be, this is going to be a real boost to fighting the argument that "an open source operating system can't be secure."

    While I agree with you, it's important to make the distinction between an operating system which is secure, and an operating system which has high-security features. After all, this is based on Red Hat 6.2, and if the version of WU-FTPD they used happens to have some stack overruns, you can still break into the darned thing. Of course, the fact mandatory access controls are in place means that the attacker can't do as much damage, but letting someone have shell access even on a trusted OS is still a bad thing.

    Having a high-security operating systems means that you both have to have the right set of features, *and* you still have to worry about fixing all of those little annoying stack overruns and format string bugs. Both parts of the story are very important.

  • by Anonymous Coward on Friday December 22, 2000 @05:41AM (#543739)
    Just go to the bars in Georgetown where the younger NSA members hang out, but them a few brews, and in an hour or two they're giving you their lifestory, and handing out floppies of classified algorithms.

    All they really want is a little human warmth.
  • by phil reed (626) on Friday December 22, 2000 @05:43AM (#543742) Homepage
    The only thing I can think of at the moment is how bad this is going to piss off Microsoft. Doesn't Microsoft have a web page someplace dedicated to dissing Linux? Isn't security one of Microsoft's hot buttons?


    ...phil
  • Does the USsian goverment think that Canada belongs to them

    Yes. Oh, it's more nunanced than that, but Canada is a military and economic appendage of the United States, and English-speaking Canada isn't any more culturally distinct from the U.S. than Texans, Californians, Rhode Islanders, and Michiganians are from each other. While Canada isn't states 51 through 60, it might as well be.
  • by Erasmus Darwin (183180) on Friday December 22, 2000 @06:06AM (#543756)
    Second Sign : NSA releasing information to the public about security

    Err, ever hear of the rainbow books? They're a series of standards for classifying trusted computer systems. They were published by the DoD, which is the parent organization for the NSA; the odds are good that there was NSA involvement in the project.

  • The NSA actually contribute a surprising amount to our open knowledge. They're not exactly a University department, but there are several examples.
    --
  • This one being from the NSA, I have no doubt in my mind that people are going to go over this with the finest-toothed comb there ever was, simply because of paranoia and that special NSA mistique.

    That's a good thing, by the way. That review alone could improve Linux security to possibly surpass that secure BSD distro (netbsd?)


    -------
  • Oops, sorry, I hit submit too soon. SE Linux is based on Red Hat 6.1, not 6.2.

    And furthermore, the important thing to remember is that this is a prototype. Hopefully it will spark discussions about adding some or all of these features into Linux 2.5, and how to do so in a clean way. I've talked with the folks at the NSA, and that's one of their main goals behind doing this release.


  • The [BSD] licensing is such that they would never have to release their modified code, right?

    They don't HAVE to release any changes they make to GPL software, like Linux, unless they're selling it to someone.

    Right?


    D.

  • Not to mention that a large part of the cold war mission of the intelligence community is to prevent foreign industrial espionage, in which case a (more) secure operating system is directly in line with their goals.

    --

  • Well is East America still in place? Aren't you seeing cracks on the walls. Hasn't your roof flyed away? Isn't you car laying inside a crack?

    Because that is a MOVE. NSA publishing a security system? Think, that's first the setting of a standard. NSA is entering as a player of the security market. A big one. Second it is a risk. NSA is showing its strenghts and weaknesses to everyone. Third NSA is a security arbitrer. Someone will get up and others get real burned on this move. And fourth, NSA makes the security wars more intricted and complex than before. Right now it is not only NSA vs MI*/MOSSAD/FAPSI. This goes farther than old government pitty fights. NSA may be giving a weapon to mobs and terrorists. Or maybe be giving a weapon organisations to figth these rough groups. What will come from this, only the Future will know.

    Anyway NSA made a huge move into the pedestal. It is putting itself as one of the biggest security players in the world. From now on we will have to look at NSA when talking about security. Its governmental status was already heavy-weight. Now it starts getting earthquake.
  • by sanemind (155251) on Friday December 22, 2000 @08:25AM (#543776) Homepage
    I have noticed several posts which have expressed some concern with the idea of NSA produced/approved code getting into the kernel, and therefore concievably providing a covert insurgence of back doors.

    ...Uhm, have you ever read the source for the D. Beckers networking drivers [and derived code]?
    Go to /usr/src/linux/drivers/net and run "grep "National Security Agency" *"
    Oh NO! All of those unaudited strcpy's in kernel space! IEEE! And I thought linux was safe! hehe.

    Moderators::Note(humor)


    ---
    man sig
  • No, you lunix idiot. It has nothing to do with the relative merits of the code. If it did, Linux would be the perennial last choice on every professional's list. It has everything to do with the license. The GPL forces the initial code and all its derivatives to remain open. This effectively makes it impossible for a private company to take the NSA code, make unknown modifications to it and sell it as their own. If you stop to think for a moment, you would quickly understand why the NSA cant have that happen.

    --

  • by CharlieG (34950) on Friday December 22, 2000 @07:18AM (#543806) Homepage
    Actually, they CAN'T release it under GPL! Huh? It's worse (better?) than that - It's public domain! We PAID for it.

    There are other government groups that talk about this. There is a Linux probram called EMC (Enhanced Machine Controler) that has been let out by the government, and there was a whole discussion of the GPL issue, and they said "We can't GPL it, we MUST Public domain it"

    Go to www.linuxcnc.org for more details!
  • I hope someone out in slashdot land, with the requsite graphics skills, does a spoof of a "NSA Linux" distro.
    A penguin with a black trench coat, shades, and a handgun. Sort of a penguin "Neo". Or even better, two penguins: "Neo" and "Trinity", both lookin' real cool, with the logo:

    "Linux and the NSA. We know where you want to go today."

    or, "Linux and the NSA. Partners against crime".

    tigert, where are you? I want T-shirts! I want bumper-stickers!


    Torrey Hoffman (Azog)
  • The Code Book doesn't talk about modern crypto much; it's mainly confined to the last chapter, which is mostly about RSA.

    I'd like evidence for what you assert. Everyone thought that the DES S-boxes were "cooked" to give the NSA a back door into the cipher, until we discovered differential cryptanalysis and found that the S-boxes had been arranged to lend resistance to it. I think what they have contributed is as strong as they claim it to be.

    I'm no fan of the NSA, quite the opposite, but I'd just like to do my bit to resist the spread of crypto-paranoia.
    --
  • What the stupid default password in Pirahna "proved" was that system security is an active pursuit, not a passive one. The flaw in the fish only bit people who never changed the password, even when instructed to during installation, never mind on a regular basis as many standard system security practices recommend.

    Yes, by all means, do "your own damn auditing", but don't waste your time by doing so before you have an actual policy of secure practices in place to audit.

    And be really careful about calling in an outside auditor. You won't get your money's worth if you and your system aren't ready, and you might wind up paying contractor rates to fix really stupid things - anyone who needed an outside auditor to find and fix the Pirahna flaw shouldn't be trusted to carry their own money, let alone their company's.

  • by dsplat (73054) on Friday December 22, 2000 @06:16AM (#543827)
    The NSA has a mandate to protect the information security of our government. I believe they would interpret that to include protection of the information security of the industrial base that supports our country. I would love to see a group within the NSA charged with working with the open source community to enhance the security of open source software. I would never trust software solely because it comes with a security seal of approval only from an agency which also has other priorities which may be at odds with my privacy. However, I would consider their assurance to be a valuable addition.

    I applaud the effort that these people within the NSA who brought this project to light went to. The fact that they have released this work at all is surprising. But they have demonstrated their good faith by honoring the GPL. Bravo.
  • I'm a big Linux guy, but I have to wonder why the NSA decided to do this at all when they could have just as easily played around with one or all of the BSDs. The licensing is such that they would never have to release their modified code, right?
    --
  • I was not aware of a "Trusted Irix".

    Even if it exists, AFAIK SGI is switching over to Linux "soon" anyway, so a "Trusted Linux" is a natural progression.

    This is great news for Linux...we've had a hard time getting Linux taken seriously where I work because there has been little "solid" government interest outside of clusters.

    But being able to use "NSA" and "Linux" in the same sentence (and in print) will ease a lot of fears 'round these parts.

    I hope someone out in slashdot land, with the requsite graphics skills, does a spoof of a "NSA Linux" distro.

    Maybe a spoof of Austin Powers or something? Yeah Baby! Trusted Linux!

  • That would be the CIA, NSA is for number crunchers, not spies
  • > The NSA has a mandate to protect the information security of our government. I believe they would interpret that to include protection of the information security of the industrial base that supports our country.

    I'd go so far as to say that this release shows they have interpreted protection of our industrial base as a national security interest.

    Remember the spate of DDOS's we had last year, and the subsequent (almost continual) stream of press releases about how "we must protect ourselves from cyberwarfare"? Looks like the intelligence community really woke up and smelled the coffee.

    But this is far beyond press releases - this is amazing stuff.

    Our taxpayer dollars - not only at work, but the citizens actually personally getting the benefits.

    Mad, mad, mad props to those at NSA who were part of this decision. Keep up the good work.

  • We already have a BSD whose primary development focus is on security - so why doesn't the NSA concentrate on that, build on that effort that's been going on for years, instead of working with this new and far less mature OS (just because it's popular? Madonna is popular).
  • by jafac (1449)
    believe it or not, Microsoft has a whole TEAM of people dedicated to dissing Linux.
  • > Come on, an ultra-secure system with rsh and WU-FTPd?

    Nobody said you had to use those packages.

    What's new is the underlying security model. If the end-user of the distro is so clueless as to put holes in the system, he deserves what he gets.

    Remember - security isn't just software. It's also the guy at the root prompt.

  • If they pull the site again, would that be a violation of the GPL? And could the NSA be sued over it?

    IANAL, but my understanding is that:

    You only have to release changes that you re-distribute. This does not include changes that you keep entirely within your own organization, company, or whatever.

    The GPL would forbid the NSA from releasing a binary-only distribution without making the source code available, but it wouldn't have any effect on whether they can make their own in-house distribution.

  • Naw, the NSA cares about Linux because Linux does not yet have an NSAKey like Windows does. If people start adopting Linux, then they'll have no way to watch them. . .
  • if they can "dissapear" unruly congressmen, they can "dissapear" an unruly Canadian. :)
  • Am I the only one that finds great mirth in the NSA being slashdotted? :-)
  • and here [esitcom.org]
  • by mrzaph0d (25646) <zaph0d&curztech,com> on Friday December 22, 2000 @06:19AM (#543859) Homepage
    "...and in an hour or two they're giving you their lifestory..."

    since they're the NSA, shouldn't that read "...and in an hour or two they're giving you your lifestory..."?

    "Leave the gun, take the canoli."
  • by pete-classic (75983) <hutnick@gmail.com> on Friday December 22, 2000 @06:31AM (#543864) Homepage Journal
    According to the package list [nsa.gov] it includes rsh and WU-FTPd.

    Come on, an ultra-secure system with rsh and WU-FTPd?

    Okay, so it says WU-FTPd is untested, but there is no excuse for using rsh.

    This makes me skeptical of the whole thing.

  • by Devi0us (21988) on Friday December 22, 2000 @06:21AM (#543866) Homepage
    There's also other simple reasons besides "Linux is the in thing". OpenBSD would probably have been a good place for them to start, except for some serious factors against it. OpenBSD isn't scalable. At all. It's great for small corporate networks, or home firewalls and such, but wiht no plans for SMP in the future, it can't compete as a server environment. OpenBSD is great for IDS sensors, and specific appliance type hardened boxes, but it's not well rounded enough to put into a big multi user production environment. Have you ever heard of any major e-commerce site using OBSD as their primary server software? Then there's the whole problem with Theo not playing well with others. And being Canadian. Because Theo wholly manages the project himself, it would cause issues. I believe the NSA folks are looking to put together something that can go into general release, possibly as an option on any distribution. OBSD can't do this, because a) the NSA would have to pay Theo to audit their code [see how OBSD architecture ports end up getting made.. its interesting], or he wouldn't let them integrate it into his source tree, and B) there's all kinds of weird issues with the project maintainer not being a US national. I'm not knocking OpenBSD. I'm a big supporter. I run it on a lot of appliance type boxes, rnuning security centric tasks. However, don't believe for a second its secure. It requires the same amount of tweaking as any other operating system to get it into shape. I've had OBSD machines get owned before, where there were serious user errors in judgement. Just because there aren't any *remote* exploits, doesn't mean your users aren't going to get drunk and give away their account. Trusted OSes are a little more forgiving when this kind of thing happens. My $.02 . Take it for what its worth. Or ask for change back.
  • "We're from the Government - the National Security Agency"

    "Oh - so you're the guys I hear breathing on all my telephone converstions?"

    "No. That's the FBI"

    "So you just set up foreign dictatorships and finance black ops"

    "No. That's the CIA. We're the good guys Marty."

    Two spooks + Marty (Robert Redford) - Sneakers.
  • by phil reed (626) on Friday December 22, 2000 @05:45AM (#543875) Homepage
    Yeah, right. I'll trust a high security version of Linux from the NSA. No fucking way. I wonder how much spyware is in that one, considering the NSA key in Windows story in the past.

    Maybe you missed the part of the article where they will be releasing source code?


    ...phil

  • by AJWM (19027) on Friday December 22, 2000 @09:21AM (#543879) Homepage
    Why are Canadians always treated differently from other NATO members (e.g. with the encryption ban)?


    Because Canada is also part of NORAD (NORth American [Air?] Defense). I don't recall all the details of the arrangment, but it goes back to the early cold war days with the setting up of the DEW (Distant Early Warning) line across northern Alaska and Canada, and various other arrangements that had to do mainly with protecting the US from Russian bombers (and later missiles) that might take the direct route over the North Pole and Canada.


    There are even a few Canadian officers routinely posted to the NORAD facility in Cheyenne Mountain, although I don't recall seeing any US military in the "Diefenbunker" underground facility north of Ottawa when I was posted there.


    All that said, however, there are plenty of US secrets that Canadians don't have access to.


    There's also the recognition that the border between the US and Canada is pretty open both to people and information, and that strong encryption can benefit the many companies that do business and have offices in both countries.

  • the machine counts only votes that are absolutely a positive vote.

    Perhaps you should look at the definitions of "necessary" and "sufficient". Your claim is that it is necessary for a vote to be properly prepared for the machine to count it.

    The claim made by the Gore camp is that it wasn't sufficient for a vote to be properly prepared for the machine to count it.

    Even your claim is in dispute (by the by the manufacturers of the machine, no less), but that doesn't matter -- no-one provided any evidence to discard Gore's claim. Bush's lawyers didn't dispute it, and every court semed to assume it was true. The decisions always came down to other matters of law and fact.

    But if you actually believe that the problem in Florida was with people who are "unable to read directions," then you've manged to shove your head very deep in the sand. Think about what actually happened some more, please.
  • by CaptJay (126575) on Friday December 22, 2000 @05:47AM (#543883) Homepage
    Like it or not, NSA is an organization that really cares about tough and efficient security in computer systems. They also have alot of experts in that domain, and the fact that they make all of their modifications public is great for the open source software.

    Even without taking all their modifications directly and integrating them, they might just show developpers innovative ways to secure Linux, which can lead to better security for everyone and alot of other software in which security is critical.

    So in short, I think they're contributing to open source as a whole, not only to Linux. I also think their contribution is a BIG one. This sounds great!

  • I agree in general but have some other points.

    Security through obscurity does work when the obscurity covers _only_ the specific security plan at a site. This forces attackers waste time attempting exploits you have blocked, and may cause them to give up, fail, or get caught when otherwise they would root you. Simple military tactics, always keep your enemy guessing as to what you have and don't have.

    However, when applied to security tools it does not work. Imagine security software like a wall. Why do walls work so well? Because the construction of a wall was open to all those who benefited from them. Other people could contribute to a better, more secure wall. Walls could provide the security you needed and the access you needed all at the same time. Security software must be open to the public so we can review and enhance the new "wall" of the 21st century.
  • Ritchie's classic essay, "Reflections on Trusting Trust", is available from the ACM [acm.org].

    While I agree with your point completely, are you sure that your non-NSA Linux box doesn't have any gcc backdoors? Have you gone over it with a hex editor, or even gdb? Are you sure that your current system is any safer than anything the NSA may put out?

    I haven't done any of that either; I'm as guilty as the next person of trusting the upstream sources. I'm just saying that I don't think that the NSA is the only party that would be susceptible to making stealthy changes to your system.

  • You are, of course, right. Only the government employees part of the work is public domain.

    Sigh

    Charlie
  • by Tin Weasil (246885) on Friday December 22, 2000 @05:48AM (#543890) Homepage Journal
    Whatever your opinion of the NSA might be, this is going to be a real boost to fighting the argument that "an open source operating system can't be secure." What I am looking forward to, though, is the incorporation of some of the NSA's code into some of the existing major Linux Distributions. Most of us would have a problem running the NSA's software right out of the box because we are so well trained to mistrust authority. Still... very cool.
  • Here's a good (slightly paranoid) scenario for you: They do BOTH! Publicly they release the Linux version with source code, and internally they use *BSD.

    Realistically, they're not using any of the above internally for truly secure computing.

  • by bmongar (230600) on Friday December 22, 2000 @05:48AM (#543895)

    Wow the government is waking up to the fact that security through obscurity is not security at all.

    Plus think of all the money they save with all us crypto geeks hacking at their code testing for bugs, coming up with new additions just because it would be cool to say you helped write part of the NSA's security system

  • by Ranten_N_Raven (220310) <ranten,n,raven&sbcglobal,net> on Friday December 22, 2000 @07:44AM (#543896) Journal
    If you check the "background" page, you'll see the work is actually done by Secure Computing Corporation (SCC). SCC (http://www.securecomputing.com/) has a STRONG background in making "Trusted Systems." They invented Type Enforcement for the "LoCK" program, which is the basis of the LOCK Secure Server. They really know the business. LOCK is designed to be used to connect classified networks to the internet. You gotta really trust the OS to make the right decisions for the right reasons. It's now old and slow, but it remains trustworthy.

    An offshoot of LOCK is the Sidewinder firewall, which the AF picked as the standard firewall to protect all AF bases. (I don't, and haven't worked for SCC, but I did spend a year installing Sidewinders at AF bases.) While some hate it for its relatively slow throughput, I've *never* heard anyone say it was insecure. "Type Domain" security is a series of serious brick walls for an attacker to breach.

    Yes, NSA is usually reticent about most things, but not about Computer Security. When I worked at the National Computer Security Center (part of NSA), other NSA entities shunned us because we were so open. Ever heard of the old "Orange Book" and the rest of the "Rainbow Series?" All NSA stuff!

    History: NSA had an earlier project to secure Tannebaum's Minix in a similar way. It was targeted at the C2 level. I was saddened when they abandoned that effort.

    Now, I look eagerly forward to checking out SCC/NSA's "Secure Linux!"
  • by simpleguy (5686) on Friday December 22, 2000 @05:49AM (#543897) Homepage
    As we saw in the Red Hat pirahna saga, you should not assume that because something is open source, it must be secure. People assumed that because pirahna was open sourced, someone would have noticed the obvious password flaw within hours or just a few days after it was released. But NO, it took longer than that.

    Do not rely only on peer review. If you want to be sure about what you are using, especially in environments needing ultimate security, do your own damn auditing and testing or pay someone to do it.

    Oh, and Merry Christmas.

  • Blah blah BLAH blah blah!

    You post the same thing every single time someone mentions *BSD. Don't you get tired of being so repetitive?

    Here's a fact for you: Market share doesn't matter for anything but profitability. If a product is free and distributable, it's going to continue to be used regardless of what the companies behind it do. (including go out of business)

    In short, who CARES that FreeBSD went out of business? It's still available, and it's as good now as it was before. Marketing surveys are all pretty much shite.

  • by dizee (143832) on Friday December 22, 2000 @07:46AM (#543901) Homepage
    The more secure a computer is, the less useable it is.

    This statement is opinion and is fundamentally flawed. Of course it is possible to have a completely secure and completely usable multi-user system. Where did you get the idea that a secure system is less usable than an unsecure one?

    It is true that many vulnerabilities are discovered on a daily basis. These vulnerabilities are the result of only ONE thing: programmer error.

    Eliminate programmer error and, assuming we're not introducing vendor/admin error into the equation, you have a secure system. The largest causes of programmer error are:

    ignorance

    carelessness

    laziness

    Unfortunately, even the best coders in the world are still human, and that leaves the possibility for error. The larger and more complex the project, the larger the chance for error. So what's the answer? Collaboration. Peer review. Open source is the best method for peer review.

    You could also set it so you have NO ports open, but then you can't get on most irc networks because of no ident...

    This is a moot point. IRC is not something you would be running on a mission-critical must-be-secure box. You must also understand that just because a box has no ports open doesn't mean it's secure.

    so just stick with slak 7.1 with a chmod'd suid perl

    Are you implying that slackware 7.1 is a secure system? Have you audited the entire distribution yourself? Can you honestly say that you trust your distribution to be 100% secure?

    If you do, one of these days, you're going to be in for a rude awakening. Unfortunately, that's a problem with admins these days. They blindly trust their systems. I don't care if a specific OS wasn't vulnerable to ANY bugs disclosed in the last 3 years, that doesn't mean that that OS is secure. You should ALWAYS assume all systems to be insecure and untrusted.

    It's not really a question of secure/insecure, because no system is completely secure; it's more a question of faith and trust.

    Mike

    "I would kill everyone in this room for a drop of sweet beer."

  • by John Sullivan (234934) on Friday December 22, 2000 @06:21AM (#543902)
    People assumed that because pirahna was open sourced, someone would have noticed the obvious password flaw within hours or just a few days after it was released. But NO, it took longer than that.

    Of course it did, that's the point. Security isn't something you achieve overnight, the status of any particular system is very much the result of consensus building which takes time. It's down to how many eyeballs have looked at the system, how deep they've looked at it, and how long they've looked at it.

    Opening up the source results, eventually, in a more secure system because those people who do so can look deeper, and also because the skills to analyse source code are more widespread than the skills required to analyse a running binary, so hopefully more people will do so. But anyone who takes a newly released system and immediately relies on it for security has to be insane.

    Do not rely only on peer review. If you want to be sure about what you are using, especially in environments needing ultimate security, do your own damn auditing and testing or pay someone to do it.

    And while doing your own audit is good advice, the most valuable result will be a new data point to add to the global consensus. Relying on your own analysis isn't much better than relying on no analysis at all, but if 100 people have looked at the system over 5 years or so and not found it wanting, then we start to feel some level of confidence in it.

    Of course this is if you want to do security properly, but for most people, for most applications, this level of care is just not necessary.

  • Actually, MS does care about linux. I saw a notice about linux being the biggest threat to MS dominence of server markets in the next ten years.......(I work for the evil empire, but am part of the rebel alliance):P
  • Probably not, these guys (Sun, IBM, etc.) want to sell lots and lots of high dollar hardware. Their interest in software is to protect their hardware sales. The NSA has to run their software on something and I for one hope that my government is using something other than 80x86 PCs to do the work that the NSA does.
  • I think we need to add a few new options for the mods...
    Score +1 Cautious
    Score -1 Paranoid
    Score -5 Written from a Y2K Bunker
  • From their web page:

    Security-enhanced Linux is being released under the conditions of the GNU General Public License (GPL). The release includes documentation and source code for both the system and some system utilities that were modified to make use of the new features. Participation with comments, constructive criticism, and/or improvements is welcome.

    This is unbelievably cool! For ANY government agency to release GPL code is huge, but for the NSA to do it is a stunning precedent. I just wonder if this action will survive the change of administration.

    I recommend that people write their Congressmen and express support for this.

  • First off, for about 2 seconds, I thought your sig was part of your comment. I thought you were ripping on my sig, hehe. ;)

    Anyhow, yes, I suppose not running IRC makes it less usable. But you have the *option* of using it. You're just taking a chance. And you most certainly should run IRC as root. It's a shame that some people do.

    My stance on everything vulnerability-related is that it is most always the programmer's fault, and we are placing a lot of trust in the author's ability to write decent, secure code. If protocols were designed flawlessly and apps were written flawlessly, then there is absolutely no reason why any "secure" system would be less usable than an insecure one. In this situation, the only way a system could become insecure is by fault of the admin.

    By secure, I mean a system that can't be cracked, has no way to leak information, has no holes anywhere. It's a hypothetical system. Nobody knows for sure whether a system is secure. It's a concept.

    My core point is there is absolutely no reason that a secure system should be less usable than an insecure one. It's because we will never know whether a system is secure or not that we have to place a certain amount of trust into it.

    You can never prove a system to be secure, but you sure as hell can prove it to be insecure.

    Mike

    "I would kill everyone in this room for a drop of sweet beer."
  • by astrashe (7452) on Friday December 22, 2000 @05:49AM (#543915) Journal
    Does anyone want to speculate why the NSA chose linux instead of OpenBSD, or some other BSD?

  • I've put a mirror up of this release as of 23/12/00 at planetmirror.com:

    ftp://ftp.planetmirror.com/pub/selinux/
    http://ftp.planetmirror.com/pub/selinux/

    cheers,

    -jason
  • FAPSI is the old communications security directorate of the KGB. They are responsible for setting the security standards that are applied to government and commercial computer systems in the Russian Federation.

    There has been a lot of interest in open systems in the Russian Federation because you can legally have the source code. This isn't the old days and they are not supposed to be sitting on the VSS archives of NT.

    Strangely enough, the Russian federation has a similar probem to the US. How to do electronic commerce securely. The Russian Federation is a lot bigger (9 hours time difference from St. Pete to Vladivostok) thus making non-electronic commerce a major problem.

    If the Russians decide they also like SE Linux, it will be a big plus. At the moment, on the commercial side, they use a mixture of OpenBSD and Mandrake Linux.

    If you want to do anything security-wise, FAPSI want to know about it so I'm pretty sure we'll get to hear their opinion soon. The general Russian opinion on standard Linux was not that high for security, although they liked the price and the uptime.

  • What you're saying is good enough but your example is flawed.

    The piranha security hole was "found" and delt with in just two or three weeks after the initial release.

    I use quotes around "found" because there were people who knew about it before but didn't think it was a big deal. (Which it was).

  • by bmongar (230600) on Friday December 22, 2000 @05:52AM (#543924)

    Actually they aren't forced to make it public, they are only forced to give the source code to who the os is distributed. They could just distribute internally and make it avaliable to anyone who uses their systems. This release is really a decision they made based on the need for security or publicity. Which one doesn't matter, what matters is they were not forced to do this.

  • Ironically, the NSA is getting slashdotted.
  • by Black Parrot (19622) on Friday December 22, 2000 @05:52AM (#543928)
    > Considering their history, they will have to show us the code.

    I'm not one to read the articles either, but in this case I made a special exception, and yes, there is a download link [nsa.gov].

    You may also find this note at the bottom of the main site interesting:
    Security-enhanced Linux is being released under the conditions of the GNU General Public License (GPL). The release includes documentation and source code for both the system and some system utilities that were modified to make use of the new features. Participation with comments, constructive criticism, and/or improvements is welcome.

    --
  • Then there's the whole problem with Theo not playing well with others. And being Canadian. Because Theo wholly manages the project himself, it would cause issues. I believe the NSA folks are looking to put together something that can go into general release, possibly as an option on any distribution. OBSD can't do this, because a) the NSA would have to pay Theo to audit their code [see how OBSD architecture ports end up getting made.. its interesting], or he wouldn't let them integrate it into his source tree, and B) there's all kinds of weird issues with the project maintainer not being a US national.

    If Theo is really such a problem, there's one solution that will still let them do it: fork.


    ---
  • I would probably have to say luser. Check out his email addy.

    Mike

    "I would kill everyone in this room for a drop of sweet beer."
  • by Animats (122034) on Friday December 22, 2000 @07:49AM (#543936) Homepage
    NSA isn't claiming this system has been tested for security. It just has mandatory access controls, as the security community defines that term.

    The key concept of mandatory access controls is that ordinary users are prevented from leaking information even if they want to. Discretionary access controls, all standard UNIX has, allow any user to change their own file modes to 777 and allow access by anybody.

    Once you have mandatory access controls, you have to figure out new ways to do many administration tasks. Logging in as root isn't an option. Getting the Linux community thinking about how that can work is a major step forward.

    If Linux system administration and applications get worked around to where they can live with mandatory security, that's a big win. Then a kernel with mandatory security can become widely used.

  • ive known a few people who coded things for the NSA and they're normal people. Not devious sneaky people who wear black all the time and want to circumvent your rights. This sounds like someone's interesting pet project...
  • Good thoughts, except that Apache doesn't deserve much credit, if any.

    The NSA has been using 'sort of open' code since several decades before the www even existed, let alone apache. Try looking at the long view, and you'll realise that the NSA has owned more computing power than just about anyone for most of the history of computers, and the very idea of proprietary software hasn't been around for very much of that time.

    Open source as a concept is as old as computing. Open Source as an evangelical movement is the only thing that's new. (and usually quite annoying :-)

  • That review alone could improve Linux security to possibly surpass that secure BSD distro (netbsd?)

    I think you're thinking about OpenBSD [openbsd.org].

    [TMB]

  • by Black Parrot (19622) on Friday December 22, 2000 @05:54AM (#543947)
    Just think, soon you'll be hearing "Hi, I'm Bob and I run NSALinux."

    Wonder when they're going to have their IPO.

    --
  • ....it doesn't matter if M$ diss Linux, because we have conclusive proof that Linux is better! [bbspot.com]

    ----------------------------
  • I think you mean Silicon Valley - Silicone Valley is quite a ways further south along Hollywood Boulevard.

Nothing succeeds like excess. -- Oscar Wilde

Working...