Some security notes

This has not been the greatest week for Linux from the security point of view. A new, remotely-exploitable hole in Samba threatens a great many servers worldwide (though one can only hope that there aren't that many Samba servers directly exposed to the Internet); this vulnerability is covered on this week's security page. There is also the ptrace vulnerability in 2.2 and 2.4 kernels. A local user, by attaching to a kernel thread, can obtain root access. Most distributors have patches out for both of these problems, and applying them would be a good idea.

Given the distinctly unpleasant state of world affairs at the moment, now is probably a good time for most of us to take a look at the state of our security patches. The number of attacks can only increase over the next few weeks, and some attackers may be even less discriminating than usual in their choice of targets. Some time spent checking systems now could be saved many times over in the near future.

Meanwhile, every so often, some company which is making good money selling antivirus software to Windows users decides to try to convince people running Linux that they, too, need that company's help. The latest entrant is this press release from Central Command. Their angle is that the increase in desktop Linux deployments will translate into Virus problems: "A vast majority of these new Linux users are unaware of the existence of Linux-based viruses and security risks associated with Linux..." OpenOffice is singled out for mention as a possible means by which a Linux system could be infected.

Of course, a Linux-based virus is not an impossible thing. But a virus running in the wild which bothers more than a very small number of people remains quite unlikely. All of the usual reasons for this apply, but there is one that stands out: Linux developers do not like the idea of strangers running arbitrary code on their systems. So they tend not to write code which provides that capability, and, when somebody figures out how to run something anyway, the problem gets fixed. Quickly. If the original developer won't fix the problem, somebody else will. Quickly. Linux users need not wait until their vendor figures out that letting others run code on their computers is a bad idea.

So, while we need to pay careful attention to the security of our systems, we need not accept the claims of companies trying to sell us antivirus products. Keeping systems secure is a matter of careful administration and staying on top of patches; there is no time, or need, to be distracted by companies selling solutions for problems we do not have.

---

(Log in to post comments)