Distributions [LWN.net]

News and Editorials

EnGarde and Trustix - Distributions for the Paranoid

March 17, 2004

This article was contributed by Ladislav Bodnar

New recent releases from EnGarde and Trustix should be of interest to the more paranoid users among us, as both of them include the word "secure" in their product names. The latest version of EnGarde Secure Linux (1.3) was announced early last month, while the new release of Trustix Secure Linux (version 2.1) was released just over two weeks ago. Despite the presence of a common word in the their respective product names, the two distributions take very different approaches towards security: the EnGarde developers concentrate their efforts on various kernel patches preventing common exploits, as well strict mandatory access control policies, while the developers of Trustix prefer simplicity and sensible defaults as their product's main features.

EnGarde Secure Linux

EnGarde Secure Linux has consistently managed to impress reviewers, especially when compared to other secure solutions. It is a product of Guardian Digital, Inc, an open source security company based in Allendale, New Jersey. The latest release is essentially a security update of EnGarde Secure Linux 1.3, originally released in April 2003. Users who are running the original release with updates are not required to upgrade.

How does EnGarde ensure a high level of security? Firstly, the distribution uses a hardened kernel provided by the Openwall project, together with Linux Intrusion Detection System (LIDS) to enforce strict mandatory access control. Secondly, it provides a host of preconfigured tools to monitor suspicious activity on the server, such as Tripwire and Snort. And thirdly, detailed attention is paid to simple, but effective security measures, such as preventing normal users from accessing system-wide configuration and log files, forcing users to explicitly enable services they need, or disallowing boot into a single user mode and logging in as root altogether.

All system configuration in EnGarde Secure Linux is done remotely via GD WebTool, a Webmin-like interface developed by Guardian Digital (see screenshots). This is an impressive utility that allows even non-expert administrators to configure various aspects of their server, such as managing users and services, setting up individual server components, viewing logs and monitoring system activity. Needless to say, it also provides an easy way to keep the system up-to-date with the latest security updates. To experience the features of GD WebTool, you can register for a demo account on the distribution's web site.

EnGarde Secure Linux comes in two editions: Professional and Community. The pricing for the Professional edition ranges from $729 to $1629 depending on the level of required support, while the Community edition is available for free download (registration is required to obtain details about activating the product). Besides the price, the two products differ in the number of available features: the Community edition excludes Engarde's Secure Suites (although they can be purchased separately), and its web, mail and DNS services are limited to 10 domains.

Trustix Secure Linux

In contrast to the wealth of features found in the EnGarde distribution, Trustix Secure Linux is a lot less ambitions when it comes to preventing buffer overflows. Instead, the developers have focused on creating a product that can be deployed with minimum of effort on servers in a variety of common scenarios, and on providing security updates in record-breaking time. The installation program lists several classes depending on the purpose of the server, including web server with PHP, mail server with either Courier or Cyrus imapd, FTP server with vsftpd, firewall, DNS server, MySQL/PostgreSQL database servers and other classes. Applications not required for a particular installation class are not installed. Once the system is installed, it is up to the users to enable all required services, as none of them, not even networking, is brought up automatically. This is one way to ensure that no unnecessary service is active.

One of the most interesting feature of Trustix is SwUp, the secure SoftWare UPdater for Trustix. Written in Python, SwUp is a command line utility designed to keep a Trustix installation up-to-date of security and bug fixes with minimal effort. In fact, installing and configuring a package called "swupcron" ensures that the system is kept up-to-date without any human interference. SwUp provides for automatic resolution of dependencies, poll-only functionality (without any actual package installation), strong authentication with GnuPG, filter and search capabilities, caching of downloads and use of HTTP proxies.

The development of Trustix Secure Linux has now entered a period of stability after the turmoil last year when the distribution's commercial entity, Trustix AS, declared bankruptcy. At first, the developers continued their work under the name of Tawie Server Linux, before the distribution, and the right to use the product's original name, was acquired by a UK-based Internet security company Comodo. The next version, Trustix Secure Linux 2.2, is scheduled for release in September 2004.

Comments (1 posted)

Distribution News

Debian GNU/Linux

The Debian Weekly News for March 16, 2004 covers a proposed task for Ada development, a bug closed by spam, a new proposal to distribute non-free, and more.

The Debian popularity contest: As the Debian project drifts slowly toward its next stable release, it has a bit of a problem: this release looks like it will include over 13,000 packages on 13 binary CDs. The project is hoping to optimize downloads and installations by putting the most popular packages together on the low-numbered CDs. To make that happen, they must find out which packages are installed most often. So the call has gone out for Debian users to install the "popularity-contest" package and allow it to phone home with information on what they have installed. The results end up on the Debian Popularity Contest page.

The second call for votes is out, for the general resolution concerning non-free. Votes must be received by Sunday, March 21 23:59:59 UTC 2004.

The platforms for the candidates for the project leader are available on the on the web. There will be no IRC debate this year as the debian-vote mailing list has been extremely active with both election and non-free issues.

There will be a Bug Squashing Party this weekend, March 19 - 21, to help fix the release critical bugs in sarge.

The third beta release of the Debian sarge installer is now available for testing.