Skip to Content.
Sympa Menu

baslinux - Re: [BL] network security concerns (only root user) with BL3

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: 3aoo-cvfd AT dea.spamcon.org
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] network security concerns (only root user) with BL3
  • Date: Tue, 16 May 2006 10:33:29 +1200

James Miller wrote:
>
> It was advised at that time to create a non-root user for
> things like browsing the web.

Yes, that is a sensible precaution.

> Under BL3, however, the possibility of creating non-root
> users has been removed.

That is correct, the default BL3 does not have non-root users.
However, it is possible to add them.

> First question regarding BL3, then, is whether there are
> justifiable security concerns with being on the web while
> running as root?

The key issue is whether you are running any servers.
The only way an attacker can get remote access to your
system is for his connection to be accepted by a process
running in your system. telnetd is a prime target, but
other servers are vulnerable too.

> Do you have any solutions for this

Minimize the use of servers, limit the assets exposed to
the internet, run from ramdisk and/or read-only filesystem.

> Have you looked at sudo and considered whether it might
> offer any solution?

Not a solution, but every little bit helps. However, I don't
see "root vs user" a key issue. Once the attacker has user
access he is only a short step away from root access. It is
better to deny the attacker any access.

> I'm faced with a situation of needing to set up a computer
> at the U library. It would be on the U LAN, having a real
> internet IP among the range of those owned by the U and could
> remain on continuously. I don't think I'd want a machine with
> a public IP and root user logged in to be running unattended
> for long periods.

The main question, I think, is what damage an attacker could
do (assuming he got access somehow). Erase valuable files?
That is easily avoided by coping those files somewhere else.
Foul up your filesystem? That is avoided by running from
a ramdisk or from a loop (with a new copy of the loop unzipped
when needed). Using your system as a zombie to send spam or
attack other systems? That can be avoided by deleting the
tools he needs to make you a zombie.

As you can see, a minimalistic installation like BL3 is not
an easy target for an attacker. The lack of servers, the lack
of up-do-date libraries, the minimalistic binaries -- all make
it difficult for an attacker to do much. There are certainly
much better targets out there and I don't think an attacker
would waste his time trying to get into BL3 (and even if he
did and he managed to get inside, he would find few of the
resources he was expecting to find).

> I might want to set up an ssh server

Now we have some issues. The ssh server provides remote access.
To secure that access, you need the latest versions of everything
(with the latest security fixes).

> Is BL3 the wrong OS to put on this machine?

If you are going to run an ssh server on the internet, and
want it to be as secure, then do not use BL3.

Cheers,
Steven




Archive powered by MHonArc 2.6.24.

Top of Page