Baslinux mailing list

[qwms-avib AT dea.spamcon.org]

James Miller wrote:
>
> I see recently in the Linux news that some sorts of 
> security holes have been found in openssh.  

I think the security hole is in the ssh server, not the client.

> I have openssh on one of my BL machines: 

Client?

> how should I deal with the potential security risk 

If you are running Linux (or anything else) in a sensitive
environment, then you should use the latest version and keep
up-to-date with security fixes.  BasicLinux is not suitable
for running serious servers exposed to the internet.

> Is running these applications only as user (non-root) the 
> answer to whatever security risks might be posed?

Running non-root is beneficial.  That reduces the damage from
trojans and the like.  However, most of the Linux security 
exploits involve getting remote access to an exposed server.
The surest way to avoid these is not to run the server
(or not to expose the server to external access).

> And, in general, what are your indications for security in BL

It works fine as a client.  Connect to the internet and browse
non-root and you should be OK.  Although, if you execute a
trojan (javascript?) targeted at Linux, you might get a little
damage.  But that's pretty unlikely.  

Keep in mind that the stripped-down nature of BasicLinux makes
it harder for a trojan to succeed.  Even foundation Slackware 
scripts (eg. pcmcia) can fail because things are missing.  A
trojan targetting RedHat (the most popular Linux) is likely to 
fail when run on BasicLinux (unless the trojan is self-contained 
and relies on no other files being present).

I browse (non-root) with BasicLinux and I've got no worries 
about security.

Cheers,
Steven