[Wolves] Nsa using linux

Simon Morris sm at beerandspeech.org
Fri Aug 25 18:00:54 BST 2006


On 25/08/06, Peter Cannon <peter at cannon-linux.co.uk> wrote:

> For the 'home user' both solutions can be a pain in the arse (I always disable
> mine) if you have a good firewall and the relevant ports locked down the home
> user really has no need for it after all 'ITS YOU USING IT" so surely you
> trust yourself??
>
> However I'm sure there are those who will now demonstrate why its good.
>

and here I am! Trust you all to have an interesting conversation on a
day where I'm away from my computer. I've been reading this all on my
mobile device thingy and been itching to jump in.

Both solutions have practical applications in home user and business
situations. It isn't so much a case of trusting yourself but more of a
case of trusting that the applications that you run (and normally we
are thinking about network enabled applications such as IM, web and
mail clients) don't have any nasty vulnerabilities in that can be
exploited.

Say you are running Gaim version 2.3.4.5 which has an vulnerability.
You are running it as a non-privileged user (I hope!) so if the
attacker can exploit the vulnerability it can't do system wide damage
but it can do some fairly annoying stuff.

Like read your addressbook, install a spambot, a backdoor and so on.
AppArmor and SELinux define a set of rules to contain gaim to a
defined set of actions. It can only read/write and execute parts of
the OS that you define.

It isn't designed to defeat all vulnerabilites that might exist but it
will limit what the application can do if it were compromised.


> I'm not convinced it has a place in the business world either as a good
> sysadmin should be able to control what users are allowed to install/run.

And this is the next thing. The problem with workstation/desktop type
machines is that they process huge amounts of different types of data
(Email, Web, FTP, BitTorrent etc). The problem with servers is that
they sit there as a target to be attacked.

If you run services you can limit the amount of damage that can be
caused if one service is compromised because AppArmor/SELinux won't
let that application work outside of its ruleset.

This means that if an attacker compromises a PHP script it can't go
installing new pieces of software on the server and getting a toehold
in your server.

-- 
~sm
Jabber: sm at jabber.fsfe.org
www: http://beerandspeech.org



More information about the Wolves mailing list