Red Hat Linux Gets Top Govt. Security Rating 128
zakeria writes "Red Hat Linux has received a new level of security certification that should make the software more appealing to some government agencies.
Earlier this month IBM was able to achieve EAL4 Augmented with ALC_FLR.3 certification for Red Hat Enterprise Linux, putting it on a par with Sun Microsystems Inc.'s Trusted Solaris operating system, said Dan Frye, vice president of open systems with IBM."
CentOS too? (Score:3, Interesting)
Re:CentOS too? (Score:5, Informative)
No. CentOS (i.e., the actual binaries built by the CentOS team on the particular set of hardware used by the CentOS team) needs to go through the exact same evaluation process, with documentation and all.
Re:CentOS too? (Score:4, Informative)
Re: (Score:3, Informative)
Why is it hardware-specific? (Score:2)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
For people who don't grok EAL4 and ALC_FLR.3 (Score:5, Informative)
This is roughly equivalent to "B" in the well-known U.S. "Orange Book" security standard. Previously all commercial off-the-shelf OSs were rated C or below, and had trouble even getting that (NT 4 got C only if the network was physically removed).
The letters correspond with school grades: A is excellent, B is ok, and C is barely adequate.
--dave
Re:For people who don't grok EAL4 and ALC_FLR.3 (Score:5, Interesting)
Re: (Score:3, Interesting)
--dave
Re: (Score:2, Interesting)
Re: (Score:3, Informative)
Here [niap-ccevs.org] is the Windows cert. Here [niap-ccevs.org] is the Redhat one. Notice that under PP identifiers Windows has CAPP, while Redhat has CAPP, LSPP and RBACPP.
Re: (Score:2, Informative)
Re: (Score:2, Informative)
Re: (Score:2)
Their stakes may be slightly higher too.
Re: (Score:2)
Re: (Score:2)
It's more accurate to describe RHEL and CentOS as derivatives of Fedora. Fedora is the upstream for all other distributions that are in the Red Hat family. Red Hat Enterprise Linux is derived from Fedora, and CentOS is in turn derived from Red Hat Enterprise Linux.
SELinux, for example, appeared in Fedora long before it ever appeared in RHEL or CentOS.
Re: (Score:3, Interesting)
Again, please don't treat this as a flame. I'm just curious to know how BSD ranks vis a vis other OSes, especially Linux, and especially in terms of security.
Re:For people who don't grok EAL4 and ALC_FLR.3 (Score:5, Informative)
Re: (Score:3, Insightful)
No, it's not.
"EAL4 with CAPP, LSPP and RBACPP" means that RHEL5 on most all current IBM h/w can be very secure by people who care and know what they are doing.
Re: (Score:1)
Re: (Score:3, Informative)
No, because without the certification, secure/sensitive installations aren't allowed to use those flavours of BSD (or any other uncertified product). If there's no other way of performing a function, it might be justifiable, but it'll be a brave sysadmin that pursue
Re: (Score:2)
I was also interested in knowing how popular BSD and Linux are for these kind of requirements.
Re: (Score:2)
Certifications aren't always required (Score:2)
It's worth pointing out that these kinds of generic certifications aren't always required. They're generally required when you're doing multi-level security -- people with varying levels of trust using the same system. For example, if you need the system to prevent SECRET information from becoming available to a user who is only cleared to CONFIDENTIAL. Th
Re: (Score:3, Insightful)
For certification purposes, it really doesn't matter how secure the system is, but how secure you can show the system is.
I attended a presentation regarding these certifications from a manager at IBM, (I forget his name), that had taken several products through the certification process and he said that it is all about the documentation. For example, how many people working on BSD have the architecture, design and user documentation to prove that something has been designed securely? It might be secure a
Re: (Score:3, Informative)
The confusion here is that this certification has nothing to do with exploits or kernel bugs (the form of security most people talk about on a regular basis). We're talking about CIA/NSA levels security. It's based largely on how finely-grained the system permissions are, so that an exploited application can't access any other files, open any other ports, etc., etc., as
Re: (Score:2)
Actually that's just wrong. Red Hat doesn't really pay for them, the HW vendors like HP and IBM do ... so Trusted*BSD should easily be able to get that certification, if people wanted to buy systems with it.
But in my opinion the real major difference is that Fedora is a usable general purpose OS with MAC capabilities, this is like if FreeBSD shipped all of the code for
Re: (Score:2)
In fact much (most? all?) of the TrustedBSD code has been integrated back into FreeBSD 6.
Re: (Score:2)
Re: (Score:2, Informative)
Good question. I haven't spent much time with any BSD system, but I've spent enough with SELinux (personal pet peeve: it's not `SE Linux', though `SElinux' or 'selinux' are acceptable) to know a bit about the difference. Pardon me if I wax loquacious...
In the computing world, the vast majority of security flaws come from bugs: improper handling of untrusted data leads to buffer overflows time and time again. Fix the bugs, and those security flaws go away. However, what about the ones you didn't catch?
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Why Wikipedia?? WHY?? (Score:2)
What is it with you people and Wikipedia?? Are you really too lazy to find the *real* Orange Book?
NIST is hosting it; I'll even make a link [nist.gov] so no one gets hurt copying+pasting. Yes, it's a PDF.
Re: (Score:2)
Re: (Score:2, Funny)
Just wait until the "No OS Left Behind" program gets passed.
Re: (Score:2)
Stock Unixes with the networking in place passed Orange Book "C" easily, specifically including Solaris 1, which **was** BSD.
The process was and is expensive, so only ritch folks certify their OS security, which explains why we haven't seen it for Linux before...
--dave (assuming, of course, that I'm not replying to a troll) c-b
XP SP2 and Windows Server 2003 has the same rating (Score:3, Informative)
Re:XP SP2 and Windows Server 2003 has the same rat (Score:5, Informative)
Re: (Score:2)
Here are some relevant definitions:
Re: (Score:3, Funny)
Someone want to explain the Common Criteria to me? (Score:2)
Re:Someone want to explain the Common Criteria to (Score:3, Insightful)
If there is a vulnerability that would affect that setup/version in it's configured state, then the rating is supposed to be withdrawn, the problem fixed, and the system resubmitted.
Someone has figured out that perhaps, it might be a good idea to not have the vault door sealed, and a hole drilled in the side of the wall, so they tell you to apply security patches.
For the w
What does "more secure" mean? (Score:2, Informative)
EAL4+ refers to the assurance level applied to the software in question. It measures how well the software is implemented - in some sense what the probability of undiscovered holes is.
EAL4+ is actually a rather low level of assurance. After all, Windows can pass EAL4+.
CAPP. LSPP, and RBAC are protection profiles that refer to the protection policy enforced by the software. CAPP coveres things like access control l
A good start. (Score:1)
It's a BIG first step. But there are others... FIPS for one. I wonder who will be working the ST&E on this OS. DoD? IntCom?
Also the amoeba like reach of DISA will have to be dealt with. They like their Windows(BOO!) and Solaris(Yay!). They are not too receptive to "new" things.
Perhaps it's biggest hurdle is not certifications... it's the in fighting among gov't organizations.
Re: (Score:1)
Linux is already in the DoD world. For Red Hat in particular, this is the fifth NIAP cert in the last 2 years.
>It's a BIG first step. But there are others... FIPS for one.
Which nss meets at level 2.
>Also the amoeba like reach of DISA will have to be dealt with.
Linux is already in the STIGs.
Re: (Score:1)
Just saying linux has been certified is just as silly. Which flavor?
There are STIG's for Debian, RH and few other flavors. But this is a new product. Also any changes to an existing product will require another STIG.
The kind of generalization from you sounds like something I'd hear from DISA.
Mod Parent Informative (Score:2)
easy (Score:2)
Is this the same system that had famous telnet froot [slashdot.org] vulnerability recently?
Re: (Score:1)
No
Re: (Score:2)
Slashdot responses (Score:3, Funny)
Let's compare the comments at the end of the day.
Re:Slashdot responses (Score:5, Informative)
Resource and protection guarantees? (Score:2)
So, my question is: Is there similar functionality in the works for Linux?
Re: (Score:3, Informative)
Re: (Score:2)
Linux is also a widely used RTOS platform. Integrity is optimized for realtime embedded use, but provides all the facilities of a "general purpose" OS. It's also possible to run Linux inside an Integrity partition.
One aspect of security is that no user should be able to affect the availability of the system through various forms of DOS attack, like the venerable forkbomb.
I'll look into Xen a bit more, does it allow the partitioning of CPU, memory
Re: (Score:2)
Only as secure as its least secure member... (Score:4, Interesting)
Yeah yeah. But what does it /mean/? (Score:4, Interesting)
What's more interesting is does the resulting system do anything useful? Web server? Mail server? DNS? File server?
Do you lose certification as soon as any extra services are running? In which case, it's fairly meaningless because the certification only applies if the system is broadly useless.
Re: (Score:2)
Re: (Score:2)
Right! It was possible to get a C2 security rating with NT4, but you had to remove the floppy drive entirely (not just disable it) and both disable networking and disconnect the networking cable. Great, now you've got a standalone box that does nothing useful, but it's secure! Why not just turn it off?
Re: (Score:2)
Anyone demands a secure system, I would be inclined to point out "I can give you a 100% guaranteed secure system. But I will have to bury it in reinforced concrete."
On a side note, has anyone attempted to get a system buried in concrete certified as secure?
Re: (Score:2)
Re: (Score:2)
Not the highest rating available (Score:3, Informative)
XTS-400 (Wikipedia entry) [wikipedia.org]
XTS-400 [baesystems.com]
That particular system is rated at EAL 5. IBM's only achieved EAL 4.
XTS-400 is good except... (Score:2)
Am I wrong in thinking this is another overly broad patent good only to intimidate others who want to innovate in the realm of secure computing with Linux interop?
Regards.
it isn't the OS that is EAL4 certified .. (Score:2)
Re: (Score:2)
Most important government systems are on their own networks, and sit inside datacenters where only a small subset of authorized staff have physical access.
Re: (Score:2)
http://www.microsoft.com/technet/archive/security
"Windows NT 4.0 evaluation included servers and workstations in six different roles, operating in both TCP/IP networked and stand-alone modes."
"Get the Facts" (Score:2, Interesting)
EAL-6 is the highest possible security rating (Score:3, Informative)
Nor is EAL-4 the highest rating an OS product has achieved.
EAL-5 has been achieved by only one complex product in the world last I looked (BAE's STOP OS, a Linux look-alike in API/ABI running on an Intel CPUed platform) and it doesn't lose its security rating when connected to a network.
The value of the rating system is that it lets everyone see the criteria under which you were judged and the degree of excellence against those criteria determined by independent judges. But the person selecting the product has to know a lot about security to be able to understand the value provided. For example, it is easy to configure most EAL-4 rated OSs in such a way that they void their rating.
Having been the Product Manager during the STOP evaluation, let me congratulate Red Hat as achieving EAL 4 is a great achievement for their team (and was required of us before we could even submit for an EAL-5). May they now go on and undergo additional time, expense and pain in striving for a higher rating.
Re: (Score:1, Insightful)
Re: (Score:2, Interesting)
Re: (Score:2, Funny)
Re: (Score:2)
Always good for a laugh.
Re:Hrmm. Not good enough for the average user (Score:4, Informative)
They're never on topic, they just show up in random Linux articles.
Re: (Score:2)
It can be used as a desktop system. If it weren't meant to, they would hardly include Compiz in the distro.
Re: (Score:2)
Re: (Score:2)
Ehrm, what? Every operating system and application need to be compiled to run. I guess that you mean compiling yourself, but that would still be wrong, as applications does not automatically become smoother just because you compile them yourself.
Re: (Score:1)
Re:Hrmm. Not good enough for the average user (Score:4, Interesting)
Ignoring for the the moment I agree with *some* of your points, Linux on the desktop has nothing to do with this post, it is entirely about Linux as an enterprise grade server OS.
Re: (Score:2)
None of your points are valid (Score:5, Informative)
A)Many different versions of Linux have various binary packaging systems so you don't have to compile things, Debian and Redhat being the two most popular (yum and synaptic/
B)The vast majority of mission critical infrastructure systems that the internet and all high level computing systems run from the command line. Switches, routers, cores, these are the bread and butter of what makes the internet work, and nobody says that a developer has failed when they produce one of these that works. Frankly, you are just being hyperbolic, failure as a developer means that your application does not work. These devices and applications do work, and as anyone familiar with a command line interface knows, it is usually far simpler to troubleshoot a problem in an environment that you have complete control over (like the command line) than it is in some hairbrained GUI that is made to pander to people like yourself who consider themselves technical users but think that command line interfaces are bad.
C)Linux documentation is far superior to that of Windows, because the API's and sourcecode are all available. Learn how to program, don't blame the difficulty of programming on inferior documentation and instructions. There are people who do what they want in linux, just because you can't, doesn't mean that there is something wrong with linux. Rather, it probably means you are not that smart. The entire notion that linux is an alien environment presupposes a fetish for windows.
Your conclusion is complete bunk, because your arguments don't hold any water. Basically, what you've just done is ranted. Linux does not suck in the regards you listed. Nothing is perfect, and everything can be improved, but you simply don't make a nuanced point like this.
Besides which, this thread was about Security!
Re: (Score:2)
Linux documentation is far superior to that of Windows, because the API's and sourcecode are all available. Learn how to program
Oh, that's wonderful. So if I want to, say, mount a network drive, which is generally almost impossible on linux (except for SUSE with yast2), I have to look through tons and tons of code. And of course there is no feasible way to figure out how to do it like that.
Compare that to the Windows/Mac way, where you either use the "help" feature, or are easily able to figure it out.
There are people who do what they want in linux, just because you can't, doesn't mean that there is something wrong with linux. Rather, it probably means you are not that smart.
Uh....
These devices and applications do work, and as anyone familiar with a command line interface knows, it is usually far simpler to troubleshoot a problem in an environment that you have complete control over (like the command line) than it is in some hairbrained GUI that is made to pander to people like yourself who consider themselves technical users but think that command line interfaces are bad.
Nonsense. I can use a unix CLI easily, but that does not mean it is always easier than doing things from a GUI. Some things
Re: (Score:3, Informative)
This is not desktops, but huge servers. I have many many times tried to get such organizations to even apply one of our patchsets to their servers due to them hitting known bugs and it may take a couple of m
Re: (Score:3, Informative)
A) You don't have to compile anything. But you can if you want to. And you can forget about all those dependency DLL-hell issues too that you get in Windows, if you use a modern distro with good package management. Then you just fire up the GUI, put a "tick" in the box for the software you want, and it gets it for you and installs it. It's easier than having to trawl through someone's web site for the right installer, manually download it, manually run the setup. And then find t
Re: (Score:2)
This is a recurring troll (Score:2)
Re: (Score:2)
Re:Hrmm. Not good enough for the average user (Score:5, Insightful)
That said, as much as I like the concept of Windows NT, I simply will not try it any longer until I hear that a number of problems have been solved.
A) Having to manually download software/worrying that nonstandard installation routines might scatter junk all over the file system and not remove it upon deinstallation. For that matter, I don't want to have to manually download and install anything, ever. Just to make this clear, never. Come up with either something akin to Ubuntu where I run Synaptic to install everything I need, or (if you absolutely have to) make it like Mac OS X where I just drag and drop the folder.
B) Any time I'm forced to to edit the Registry by hand (without documentation, to boot), you as a developer have failed. Back 10 years ago, this may have been acceptable. In this day and age, it isn't. Furthermore, while once in a blue moon I may have to change a system-breaking internal file in Linux, in Windows it's a constant occurrence. Again, you have failed.
C) A troubleshooting guide instead of proper OS documentation does not cut it. Neither does a message board where half the time I'll be told to reinstall, 25% of the time I'll be told to run random diagnosis apps, and the other 25% of the time I'll get genuinely helpful people giving me contradictory answers. If I'm expected to jump to an alien computing environment you'd best make sure your documentation is up to snuff. Most Windows apps suck in this regard.
I'm an advanced user who's in favor of feature-rich OSes, but the bizarre, arcane, and technical details I have to jump through to achieve the same things that are comparatively simple in Mac OS X or Linux make Windows a deal breaker. You will never, ever, become successful on the server until idiocy like this is exorcised from the OS.
Re: (Score:2)
A) You haven't used desktop Linux in a long time. I'm using Linux Mint right now and don't need to drop to the command line for anything other than rare extreme troubleshooting issues, or when its just plain easier (disclaimer, I find going to command line, and copying files from my desktop to a distant directory much easier than clicking through 5-10 folders).
B) You haven't done any systems administration on a Windows machine, probably ever. You don't have to recompile the Window
Re: (Score:3, Funny)
Did I miss something? Is it "Asshat Monday" and I didn't mark it on my calendar?
Re: (Score:3, Insightful)
Why, pray tell, would any 'average' user wish to dick around with vi and text-editting config files? Hint: They wouldn't.
True, but I also think that most average users would take a text-based configuration file, especially one with instructive comments, over the Windows Registry any day of the week.
I'm not saying that registry editing is a usual occurrence, but sometimes it needs to be done, and I would prefer clear text files every time. Especially those parts of the registry indexed on class GUID are really opaque.
Re: (Score:2)
I suggest the Perl man pages then, they have a good number of examples. I'd say most Perl functions I have looked up in the man pages have at least one but often several examples of its use.
Re: (Score:2, Informative)
Australians... (Score:2)
Re: (Score:2)
If you need to supply computer equipment to a government agency then you better start reading. If not, then don't bother.
Re: (Score:2)
Re: (Score:3, Interesting)
Of course it hasn't. Certification costs a lot of money (tens- if not hundreds-of-thousands of dollars), and there're no organisations with that kind of money that have a major interest in OpenBSD. Could it pass? No, because it lacks RBAC/MAC and other necessary security systems. Has it even been tested? Certainly not, because nobody's put it up for certification, and also because the team that produces it haven't built in subsystems for RBAC/MAC.