Re: [gentoo-hardened] New Server, considering hardened, need pointers to tfm...

[Kevin Chadwick]

On Sun, 11 Dec 2011 18:00:19 -0500
Matthew Finkel <matthew.finkel@×××××.com> wrote:

> > Another thing that I try to do as a better method of TPE which is a
> > breeze on OpenBSD and sometimes I find myself working against Linux
> > developers¹ is to make it so that any writeable area of the filesystem
> > is mounted noexec and mounts have the least priviledges required.
> >
>
> If don't mind my asking, what is it that OpenBSD does differently than the
> Linux distros that make it so much easier? Do they actually follow the
> security practices you mentioned in the bug report?
>
>
>
> >
> > ¹ "https://bugs.launchpad.net/ubuntu/+source/udisks/+bug/880965"
> > set as won't fix and also e.g. apt-get expecting /tmp exec.
> >
> >
> Thanks,
> Matt

Starting with the actual bug, on OpenBSD everything is off untill you
enable it like arch linux but their hotplugd allows you to easily edit
the commands and so mount options. Of course their are things like
devmon for Linux but the real issue was if a security policy tried to
stop introduction of executable code by users and then someone used the
install scripts and set up say ubuntu with udev by default then a user
could make a directory owned by root on an ext2 usb possibly name
it .exe and then execute their program violating the security policy
and possibly without the admins realising, it's that not caring about
security while developing that OpenBSD for obvious reasons (being it's
main goal) has. I guess it's akin to gentoo hardened fixing/preferring
their glibc and mozilla not making their binaries pax compatible

Also OpenBSD includes some userland which they audit
extensively. Packages use /usr/local and so you almost never need to
write to / or /usr, though package exploits and lack of developers may
force a move to current but for servers stable ports are generally kept
up to date. To get the best of both worlds (gentoo hardened too), you
could couple that ro mountability with grsecs in-kernel mount logging
and a secure logging facility but the linux kernel would make you
remount it a lot more often.

Generally they just think about these things, they won't for example
suddenly add an /opt and put insecure and often updated adobe-reader
into it, it would be /usr/local/opt if anything. Less rc scripts and in
one place. If someone tried to introduce xml to base OpenBSD they'd get
laughed at for trying to introduce an insecure technology. On Linux I
bet the people poking fun at xml would get laughed at for being absurd
even if xml isn't the best choice.

It's great and I love OpenBSD on my servers and especially firewalls
but it can be a bit much keeping firefox upto date on my desktops
(following current for firefox can mean no need to update for 9 months
or twice in two weeks, that would be fine if I had >100 desktops to
make a golden system worthwhile but I don't), and the firefox updates
can be quite late. It may? stop exploits affecting cross-boot but it's
a bit pointless having a secure desktop OS when firefox spends a week
out of date. RBAC also has more use for desktops with higher
exploitability. I looked to gentoo-hardened but unfortunately I can't
spend the build time or have the spare machines so I'm currently
looking at a grsec enabled arch possibly with a patched glibc as a
compromise with the aim of reducing maintenance time. I sure hope it
doesn't increase due to problems, it should reduce in theory atleast if
I stop writing this email ;-). As a bonus users will get sandboxed
flash.

Woah this is a long post and sorry if I'm relating debianisms too much,
I don't know gentoo-hardened that well and any insights/corrections
would be appreciated.

Kc