Re: AW: Secure Linux From Scratch

On Fri, Dec 19, 2003 at 05:59:52AM -0500, Robert Day wrote:
> On Fri, 2003-12-19 at 05:56, quinte wrote:
> > 
> > anathor questions wich could upcome at a later point:
> > how do we ensure quality? (stress tests, security tests like "hacking" into
> > the machine?)
> 
> All of the above.  Of course, we cannot guarantee any system built on
> LFS is secure...  No matter how much work we as a team put into it... 
> The end user ultimately decides what to follow and where to deviate. And
> even with a "followed the book to the letter" install..  By the time the
> user gets it installed, an exploit may have been found that exploits a
> package the user installed from the book, that was not there when that
> user downloaded the book.

Agreed 100%. We cannot guarantee anything other than having done some
minimal testing. Links on how to hack yourself for security purposes
would be a good start.

> ensuring the kernel, libraries and all applications are secured
> against all known threats,

> and that a sufficient firewall is in place at the local level,

> that there is no room for privelage escalation via buffer oferflows,
> stack manipulation,

>testing the machine with as many tools as we can get our greedy paws on

Sounds like a good plan of attack. Perhaps someone out there has
knowledge about what testing tools are available, and can write up a
hint on how to test packages for flaky code. Then many people could
easily begin the processing-intensive chore of testing the base LFS
code. Searching for security patches is another time-consuming, and much
needed task. Gentoo and Debian are good sources for security patches
that apply to more-or-less stock code.

Any volunteers?

-- 
Archaic

All governments are more or less combinations against the people. . .and
as rulers have no more virtue than the ruled. . .  the power of
government can only be kept within its constituted bounds by the display
of a power equal to itself, the collected sentiment of the people.

- Benjamin Franklin Bache, in a Phildelphia Aurora editorial 1794

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page