Re: [gentoo-hardened] A few thoughts

[Aaron Held]

My thoughts:
    Gentoo is about choice and Gentoo Hardened is about adding the 
advanced security features that are available in the linux/open source 
world to the stock gentoo distro.

    I think that the problem going forward is that a 'secure' distro 
means different things to different people.
    I run a Gentoo based firewall / gateway server.  On this box my idea 
of security is mainly shutting off (or not installing) unecessary 
services and a good IPTables / firewall config.  Maybe some IDS and 
every now and then I run etheral for a while.  
    On this box I think about things like caching dns and squid.

    On another box I host multiple domains and run a bunch of differnent 
services for different companies.  On this server I am interested in the 
ACL's, chroot jails, and the things that I am hearing about on Gentoo 
Hardened.

    As far as the qmail issue - I like qmail, but also dislike djb's 
complete "do it my way" attitude. Personally I run qmail from xinit 
rather then tcpwappers, making qmail 'fit' into my distro better.

    I would like to see two levels of gentoo hardened
1) Integration of the secure software into Gentoo
    How to install things like ACL's, kernal patches....
2)  How to use these packages:
    How to use ACL's to protect files..
3)   Best practices
    How to audit logsfiles

So rather then how to replace sendmail w/ qmail lets document how to use 
ACL's and chroot to protect your MTA, and then maybe give a specific 
qmail example.

I installed shorewall, but even after the install there were a number of 
items I had to manually finish off, things like editing 
/etc/ssmtp/ssmpt.conf so the sendmail stub can work when an event it 
fired from metalog based on a log entry generated by shorewall.
I will try to document that for the list, but Gentoo specific 
instructions like emergeing the kernel source for netfilter and updating 
the ebuild to look for metalog rather then syslog.

Thanks,
-Aaron Held

Joshua Brindle wrote:

>I think that there are very many distributions build on that premise, however this
>is not really a goal of gentoo-hardened for this reason: Gentoo is based
>on availability of choice. We will provide applications considered secure (those
>listed are all in portage) but we won't restrict users to anything.
>
>The gentoo-hardened project is to build a security hardened distribution using
>known security mechanisms and tools available. That includes ACL's MACS,
>auditing, chrooting, stack protection, adding security patches wherever possible
>et al. in theory once an installation is complete one could give out their root
>password and not worry about any problems (russell coker provides the root
>password to his selinux play machine to demonstrate the security provided
>by selinux, this machine hasn't been compromised at all.
>
>We will be handling documentation, and we can certainly give our opinions
>or widely thought beliefs about the security impacts of certain applications.
>
>Also, I am a fairly security aware person, but i do not share your sentiment about
>djb's work so I find it hard to recomment his software to users. This is not
>an opinion formed about the security of his products, the opinion is based
>on his treatment of the opensource world, and the non-rfc compliance of his
>applications. This IS a personal opinion so i don't want a flamewar on this list,
>if you wish to flame me come to irc and scream all you want :)
>
>Joshua Brindle
>
>
>
>>>><dscott@×××××××××××.com> 03/19/03 04:14PM >>>
>>>>
>>>>
>Hello All,
>
>My thought:
>I would like to see a secure distribution that would strongly encourage users to use proven audited applications and daemons.
>ie: qmail, djbdns, pure-ftpd, etc etc.
>
>D.
>
>



--
gentoo-hardened@g.o mailing list