| |||||||||||||
|
| |||||||||||||
Security Innovation's Microsoft/Linux web server security studySecurity Innovation's Microsoft/Linux web server security studyPosted Mar 23, 2005 15:33 UTC (Wed) by wilreichert (subscriber, #17680)Parent article: Security Innovation's Microsoft/Linux web server security study
Baahhhh, any system is as secure as the user / administrator makes it, regardless of the operating system. Silly wabbits.
(Log in to post comments)
Security Innovation's Microsoft/Linux web server security study Posted Mar 23, 2005 17:14 UTC (Wed) by dan_ (guest, #28710) [Link] I suspect lots of OS distributors provide regular security patches and bydefault switch off most risky and non-essential features and services. Some are now using Security Enhanced Linux to bolt things down further. Can you give me some examples of what else a system administrator should do to make a system more secure?
List of tasks and checks for a new server Posted Mar 23, 2005 18:07 UTC (Wed) by dmarti (subscriber, #11625) [Link] Here's a list of things to do and check on a new server before putting it up. Suggestions welcome.
List of tasks and checks for a new server Posted Mar 23, 2005 19:17 UTC (Wed) by jwb (guest, #15467) [Link] That's a great list, Don. Why can't we get default installs that meet all these criteria? I just installed Debian on a bunch of old PCs for compute nodes, so allow me to run down your list with a fresh perspective:
1: whatever
So it seems that at least Debian has a long way to go before the default install is ideal and perfect. I would add one thing to your list, and that is: the administrator's ssh private key should really be on a smart card. SSH supports generation of the key on-card, and uses the key to establish the connection, so the private key is never in core or on disk of any computer. Alas, Debian's ssh does not support smartcards. If you want this functionality you need to rebuild the package locally.
What does all this have to do with the original article? Well not much I guess. As we all know you are pretty well screwed when installing a Windows machine, and frankly I fail to see how a mysql bug is a Linux problem. Do not people use mysql on Windows, as well?
List of tasks and checks for a new server Posted Mar 24, 2005 16:36 UTC (Thu) by deepfire (guest, #26138) [Link] > 11: no default iptables rules in Debian, and also discards your firewall> rules every time you reboot.
/etc/init.d/iptables save active
will make the day -- the `active' ruleset is the one activated during bootup
Security Innovation's Microsoft/Linux web server security study Posted Mar 25, 2005 23:38 UTC (Fri) by job (subscriber, #670) [Link] That is just not true. In many cases the operating system may exposeextra attack vectors. For example, in Microsoft Windows a process that has access to the GUI system automatically has access to elevated privileges, by design. This can't be fixed without breaking a lot of old applications. How do you stop the NetBIOS-over-IP processes in Windows? The answer is you don't, not in a controlled way that update and repair tools won't restore for you again. You block the ports in your firewall and cross your fingers there is no unprivileged exploit on the local subnet. But of course, these and many others well known peculiarities with Windows will never be "fixed" and has no "report date". So you'll never find them in Microsoft sponsored studies. But the facts speak for themselves: security is much harder to attain with a poorly thought out operating system.
|
|
||||||||||||