Re: [gentoo-hardened] Do I need RBAC?

[Guillaume Castagnino]

Le dimanche 29 octobre 2006 13:13, Panagiotis Atmatzidis a écrit :
> Guillaume Castagnino wrote:
> > Hi,
> >
> > hardening is not only to protect against your known users, but only
> > from external attackers !
> > If you have a flaw in one of your servers that can be remotely
> > exploited, hardening your box will help you containing the attacker
> > !
> >
> > Regards,
> >
> > Le dimanche 29 octobre 2006 05:16, bridavis@×××××××.net a écrit :
> >> I have a total of 3 non-root users, 1 is me, the 2 others are
> >> trusted (i.e. family/friend). RBAC looks like it's more complex
> >> that I need and want to deal with, and I'm I'm wondering if I
> >> should bother with this with so few users.
> >>
> >> Thoughts?
> >>
> >> Thanks,
> >> Brian
>
> I replied before with a straight answer. My case is the case of a
> "kid" (24 old) who likes to play with his computer so he applies
> hardened&RSBAC now and then, set ups snort and plays with
> security-wise system configuration (encryption etc) as much as time
> and will permits.
>
> That said, there is no need for someone to set up a box like that
> just for being "secure". The trade off imho is too much. Remember
> that for an expert hacker a misconfiguration is enough to take over
> the system. A hardened system takes time and brainpower to be set up
> correctly.
>
> I see no point to apply orange-book security level on a standard
> systems by default.

It's your opinion...
If Fedora provides SELinux by default, there are good reasons.

It's not because it's a "personal" server that it can be not so secured 
as a professional server. You can be a normal person and have precious 
datas and want a more secured server.

And securing a box is perhaps hard at begining to have a correct set up, 
but when it's configured, you do not have to reconfigure it each 
morning ! It simply works ! (Personnaly, my RBAC rules are up and 
running since 2 years, with very minor modifications).

And I secure my box not against known users, but against potential 
security flaws that could make external hackers make me loose data or 
reinstall my box...
Using RBAC mechanism can incredibly help to reduce the impact of a 
security issue (due to misconfiguration or flaw in the program itself). 
I think you know that, don't you ?

For me it's not "too much", because personal data are as important as 
professional data. So same security mechanisms are relevant.
Of course, it's also my opinion ;)

Regards,

-- 
Guillaume Castagnino
    guilc@×××××××.net / casta@×××××.info
GnuPG/PGP key : 
http://wwwkeys.pgp.net:11371/pks/lookup?op=vindex&search=0x8AF468AF
Fingerprint : CD52 FE40 9592 BA1E E89D 5FB6 820E 4742 8AF4 68AF

-- 
gentoo-hardened@g.o mailing list