Re: Disabling everything

[Bill Cheswick <ches@bell-labs.com>]

>> Truth is, I'm getting a bit worried about the general approach to
>> security, which is becoming "disable everything from the outside."  I
>> think we should focus on making these remote protocols safe, rather
>> than disabling them.

A noble effort, but mostly it has proved nearly impossible.  It is simply
very hard to write bug-free, and therefore secure, code.  Most people fail,
including Very Smart Security people.

We have three choices here:  don't run the server, run the server jailed
in a chroot environment (and, I hope, with other capabilities restricted),
or let the server run without protection, and hope the multiuser system
can defend itself.

I have given up on this last option.  People often write servers running as
root, when the server doesn't need it.  Even if they don't, I've decided that
it is a lost cause keeping a normal user from becoming root.  Most systems
generally have 50-70 programs setuid to root, and that's at least an order
of magnitude too many.

Therefore, I head them off at the network services pass.  My hosts typically
run ssh, ntp, and nothing else.

ches

-
Securedistros: A common list for all secured Linux distributions
Archive:       http://humbolt.nl.linux.org/lists/