Baslinux mailing list

[3aoo-cvfd AT dea.spamcon.org]

James Miller wrote:
>
> It was advised at that time to create a non-root user for 
> things like browsing the web.  

Yes, that is a sensible precaution.

> Under BL3, however, the possibility of creating non-root 
> users has been removed.  

That is correct, the default BL3 does not have non-root users.
However, it is possible to add them.

> First question regarding BL3, then, is whether there are 
> justifiable security concerns with being on the web while 
> running as root?  

The key issue is whether you are running any servers.  
The only way an attacker can get remote access to your 
system is for his connection to be accepted by a process 
running in your system.  telnetd is a prime target, but 
other servers are vulnerable too.

> Do you have any solutions for this

Minimize the use of servers, limit the assets exposed to
the internet, run from ramdisk and/or read-only filesystem.

> Have you looked at sudo and considered whether it might 
> offer any solution?

Not a solution, but every little bit helps.  However, I don't 
see "root vs user" a key issue.  Once the attacker has user 
access he is only a short step away from root access.  It is 
better to deny the attacker any access.

> I'm faced with a situation of needing to set up a computer 
> at the U library.  It  would be on the U LAN, having a real 
> internet IP among the range of those owned by the U and could
> remain on continuously.  I don't think I'd want a machine with 
> a public IP and root user logged in to be running unattended 
> for long periods.  

The main question, I think, is what damage an attacker could
do (assuming he got access somehow).  Erase valuable files?
That is easily avoided by coping those files somewhere else.
Foul up your filesystem?  That is avoided by running from
a ramdisk or from a loop (with a new copy of the loop unzipped
when needed).  Using your system as a zombie to send spam or
attack other systems?  That can be avoided by deleting the
tools he needs to make you a zombie.

As you can see, a minimalistic installation like BL3 is not
an easy target for an attacker.  The lack of servers, the lack
of up-do-date libraries, the minimalistic binaries -- all make 
it difficult for an attacker to do much.  There are certainly 
much better targets out there and I don't think an attacker 
would waste his time trying to get into BL3 (and even if he 
did and he managed to get inside, he would find few of the 
resources he was expecting to find).

> I might want to set up an ssh server 

Now we have some issues.  The ssh server provides remote access.
To secure that access, you need the latest versions of everything
(with the latest security fixes).

> Is BL3 the wrong OS to put on this machine?

If you are going to run an ssh server on the internet, and 
want it to be as secure, then do not use BL3.

Cheers,
Steven