Re: [gentoo-dev] Portage through SSH

[John Nilsson]

Or rather use gentoo to manage a number of lfs-systems. =)

-John

John Nilsson wrote:

> How about the ability to install a gentoo system on a 20MB partition?
> The ability make a profile not containing gcc, glibc and portage would
> be nice.
>
> -John
>
>
> Brian Harring wrote:
>
>>
>> On Monday, September 1, 2003, at 02:04 AM, Steven Elling wrote:
>>
>>> On Sunday 31 August 2003 13:14, John Nilsson wrote:
>>>
>>>> Some requirement thoughts:
>>>> A network of gentoo hosts should have only one portage processing
>>>> server
>>>> and any number of installation leafs.
>>>>
>>>> First of all portage needs to easily handle more than one installation.
>>>> Second the "leaf-installations" should have a very strict minimum
>>>> requiremnts.
>>>> Third redundancy is probably important. The information to restore a
>>>> lost "leaf" should be availible on booth the portage host and on the
>>>> leaf it self.
>>>
>>>
>>>
>>> I think this is something sorely needed.  I'm reading some books on
>>> securing
>>> Linux servers and on a bastion host (or any host in a DMZ for that
>>> matter)
>>> there should not be a compiler or any include files.  The reason why
>>> is if
>>> the system were compromised it would limit the cracker from compiling
>>> and
>>> installing a root kit.
>>
>>
>> It would limit them to having to install a root kit, or install a
>> compiler (and needed headers).  Kind of pointless though, since if
>> they've managed to elevate their rights to the level of installing a
>> root kit, lack of a compiler is merely an annoyance to them at that
>> point.
>> Maybe I'm missing something, but this strikes me as nothing more then
>> an annoyance to someone after they've *already* cracked the box.  To
>> me it's like littering tacks throughout your house, hoping to slow
>> down the robber who has already broke into your house- yeah, it'll
>> likely slow him down, but it's also a makes things a pain in the arse
>> for the home owner...
>> Of course, as I said, perhaps I'm missing something...
>>
>>>   As it stands right now, a Gentoo based system
>>> requires gcc, includes, and all their friends to operate and be
>>> managable
>>> (Note: Gentoo alone does not have this problem. RedHat, Debian, and
>>> every
>>> kitchen sink distro does the same).
>>>
>>> I like Gentoo, but it is not a viable option to the security concious
>>> and
>>> enterprises because it does not support such a feature in addition to
>>> central package management.
>>
>>
>> I'd agree on the central package management aspect- the ability to
>> control and push updates out (after securing the method/control
>> channels in some manner) would be quite nice.  None the less, I'd tend
>> to think (opinion of course) gentoo is quite fine from a security
>> standpoint.  You're reasons for it not being viable?
>>
>>>   Gentoo is no alone however.
>>>
>>> For reference, the book I am reading is "Building Secure Servers with
>>> Linux"
>>> (ISBN: 0-596-00217-3).  The book is written by Michael D. Bauer and
>>> published by O'Reilly.
>>
>>
>> I'll probably end up taking a look at it (got to love safari),
>> specific chapter that this is suggested in?
>> ~bdh
>>
>>>
>>>
>>> --
>>> gentoo-dev@g.o mailing list
>>>
>>
>>
>> --
>> gentoo-dev@g.o mailing list
>>
>
>
>
> --
> gentoo-dev@g.o mailing list
>



--
gentoo-dev@g.o mailing list