Re: Secure Linux From Scratch

On Mon, Dec 01, 2003 at 10:14:32AM -0500, ashes wrote:
> take two simutainious LFS builds to construct a trusted system (trusted by 
           ^^^^^^^^^^^^
I take it you mean sequential, not simultaneous? i.e. one after the
other, like in Greg's early pure-lfs analysis? Possibly looking at 
the way they tested how compiled code changed in that analysis would
help in a future analysis of how to proceed with SLFS build procedures?

> I would also like to note there are countless "secure" linux implementations, 
> and if we are to start a new one it better be good or its not worth doing. In 
> most, if not all, distributions, security is sacrificed for marketing and 
> user friendlyness. I dont mean this as a rant, but more as the truth, systems 
> like debain, gentoo, redhat, and even openbsd, care more about the money in 
> their pocket then the quality of the system they ship. I hope this is where 
> LFS is different since its not marketed for the masses.
> Security starts with the toolchain, and no software is exempt from audit.

I know that I would be contributing my time/efforts solely to learn about 
these security issues myself, as I find it extremely interesting. 
Additionally, in the form set by previous LFS/BLFS books, the main focus
of the book I would guess would be at education, with the end result
being a hardened system. As it is an additional step past LFS, there
would be even fewer people attempting it who may be new to linux (most 
probably would have completed at least one LFS system first), and so
should hopefully not be scared by a decrease in user friendly-ness that
this procedure would result in. For the majority of users who may not
need to run publicly accessable services, they may not wish to attempt
to make LFS more secure- but for those who plan to deploy their custom
system(s) in the wild, I believe it would be a valuable tool and
knowledge base.

//Andrew

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page