Skip to Content.
Sympa Menu

baslinux - Re: [BL] BL and security?

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: qwms-avib AT dea.spamcon.org
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] BL and security?
  • Date: Thu, 18 Sep 2003 07:41:05 +1200

James Miller wrote:
>
> I see recently in the Linux news that some sorts of
> security holes have been found in openssh.

I think the security hole is in the ssh server, not the client.

> I have openssh on one of my BL machines:

Client?

> how should I deal with the potential security risk

If you are running Linux (or anything else) in a sensitive
environment, then you should use the latest version and keep
up-to-date with security fixes. BasicLinux is not suitable
for running serious servers exposed to the internet.

> Is running these applications only as user (non-root) the
> answer to whatever security risks might be posed?

Running non-root is beneficial. That reduces the damage from
trojans and the like. However, most of the Linux security
exploits involve getting remote access to an exposed server.
The surest way to avoid these is not to run the server
(or not to expose the server to external access).

> And, in general, what are your indications for security in BL

It works fine as a client. Connect to the internet and browse
non-root and you should be OK. Although, if you execute a
trojan (javascript?) targeted at Linux, you might get a little
damage. But that's pretty unlikely.

Keep in mind that the stripped-down nature of BasicLinux makes
it harder for a trojan to succeed. Even foundation Slackware
scripts (eg. pcmcia) can fail because things are missing. A
trojan targetting RedHat (the most popular Linux) is likely to
fail when run on BasicLinux (unless the trojan is self-contained
and relies on no other files being present).

I browse (non-root) with BasicLinux and I've got no worries
about security.

Cheers,
Steven




Archive powered by MHonArc 2.6.24.

Top of Page