[sentinix-list] Announcement regarding upcoming release of SENTINIX

Hi list!

I just wanted to tell everyone what I (and Chris Hammond and Xavier) am 
working on right now.

Major changes in SENTINIX (probably v 0.80):

##KERNELS##

Linux 2.4.21 will still be used, but the do_brk and the do_mremap bugs have 
been patched out.  I have experienced the best result with the 2.4.21 
openMosix kernel, that's why I'll stick with it.  I _might_ try and add 2.6.0 
(but patched against the do_mremap bug) as the "plain" and "smp" kernel. The 
kernel headers would however be 2.4.21.

I will add more kernels in the future, for example openMosix 2.4.22. But 
kernel compilation does take time and I need to get the system working before 
increasing the compilation time. It currently takes about 5 hours to compile 
everything (source tree + initrd sys + kernels) on my AMD XP 1800+ (w/ 
ATA-100 disks).

##THE COMPILER##

gcc 3.3.2 instead of 2.95.3, although 2.95.3 is still in there in order to 
compile the Linux kernels. Only C and C++ are compiled in gcc (perhaps I'll 
add objc too). The libc library is glibc 2.3.2.

##THE INITRD (installation CD)##

The initrd rootfs has been refurnished. uClibc has been thrown out and 
replaced with the approach of simply copying in selected libs from the /lib 
directory and compiling all apps for the installation CD dynamically linked 
against the regular (i.e. the same) libs under /lib.  A couple of bugs have 
also been resolved, boot-loadsize is now 4, not 32 and setup.manualpart is 
using another approach when calling sfdisk.

##WEBINTERFACE##

Next version looks fancier, but most importantly, it's behind strong TLS/SSL 
client authentication (Mozilla supports AES-256 :o). A user would have to 
install a PKCS#12 key file in his/her browser in order to access it 
(basically PKI). The PKCS (.p12) key is not supported by all browsers (even 
if they say so), this might be a problem some users may experience. It does 
work flawlessly with a recent Mozilla (+ Mozilla Firebird) and MSIE.

##SECURITY##

Well, we're still lacking a local IDS (yes, I do know about samhain and 
tripwire), but Xavier is doing a great job working on what's going to be 
SENTINIX's own integrity app.  It'll include file hashing+checking and 
rootkit detection.  I started making what was going to be a syscall and 
anti-LKM-rootkit sec module or a kernel patch, but then I read up on LSM 
(Linux 2.6.0) and now I'm wondering if that's not the way we're going to go.

All network services or apps supporting network services (such as openssh, 
openssl, apache, php, mod_ssl, samba, sendmail, imapd, pure-ftpd, etc.) will 
be compiled with the stack-smashing protector patch for gcc by Hiroaki Etoh 
at IBM http://www.research.ibm.com/trl/projects/security/ssp/. Currently, 
these apps have been successfully compiled with it:

openldap
apache
mod_ssl
php
openssl
openssh
sendmail
pine (imapd, ipop2d, ipop3d, pico, pilot, pine)
lynx
links
cvs
bind
dhcpcd
dhcp (dhcpd)
nessus
samba
nfs-utils
net-snmp
libol
syslog-ng
ntp
portmap
ntop

Buffer overflows... be gone!!!  8^)

I'm working on putting all network services behind TLS/SSL (sendmail 
STARTTLS+AUTH {cyrus-sasl}), imapd, ipop3d, etc.). When e.g. sendmail and 
imapd is started (from an rc.d script), it'll automatically check if 
certificates and keys exist, if not, the rc.d script will auto-generate them, 
so "openssl-illiterates" will get a by-default-secured sendmail, imapd, etc.

Also, I'll add some personal network sec scripts of mine that I've patched 
together from various sources. One will enforce some networking security 
while a couple of others will be iptables templates for more advanced 
firewalling. When I wanted to enforce my router's fw rules, I noticed that it 
can take many hours to write Netfilter rules (with iptables) that do what you 
want. I wanted logging of spoofs and null+xmas+fin scans among other things. 
I'll include that script too.

##CVS##

The "Source Tree" is now in CVS (all tarballs are available through rsync). 
Take a look at http://developer.berlios.de/projects/sentinix/ (you'll find 
more info in the README.CVS file 
http://cvs.berlios.de/cgi-bin/viewcvs.cgi/sentinix/sentinix/README.CVS ).

I'm testing Subversion, I really need changesets, perhaps it'll handle big 
tarballs better than CVS too. Is anyone here familiar with subversion and 
willing to give me some hints???

##BINARY PACKAGES##

As you might have heard, SENTINIX is going modular. All apps will be packaged 
into packages (.sx.tgz) containing binaries.  These packages are being (or 
are about to be -- I'm still working on the generator) auto-generated during 
the compilation process of the Source Tree.  Once done, an admin is going to 
be able to upgrade/remove packages using a simple command line tool (sxpkg).  
I'll also be working on making sentinix installable from http, ftp and sftp 
(although, this feature will not be in the next version of sentinix).

##PACKAGE LIST##

Hang on, here's a list of all the packages in the current (my private) Source 
Tree, generated from "make versions" under the /usr/src directory...

linux-includefiles-2.4.21-i486-1
man-pages-1.60-i486-1
glibc-2.3.2-i486-1
binutils-2.14-i486-1
gcc-3.3.2-i486-1
coreutils-5.0-i486-1
zlib-1.1.4-i486-1
findutils-4.1.20-i486-1
gawk-3.1.3-i486-1
ncurses-5.3-i486-1
vim-6.2-i486-1
libtermcap-1.3.1-i486-1
m4-1.4-i486-1
bison-1.875-i486-1
less-381-i486-1
groff-1.19-i486-1
sed-4.0.8-i486-1
flex-2.5.4a-i486-1
gettext-0.12.1-i486-1
tcpip-slackware-9.1-i486-1
gdbm-1.8.3-i486-1
perl-5.8.2-i486-1
whois-4.6.9-i486-1
texinfo-4.6-i486-1
autoconf-2.57-i486-1
automake-1.7.8-1.4-p6-i486-1
bash-2.05b-i486-1
file-4.06-i486-1
libtool-1.5-i486-1
bin86-0.16.14-i486-1
bzip2-1.0.2-i486-1
diffutils-2.8.1-i486-1
ed-0.2-i486-1
kbd-1.08-i486-1
hdparm-5.4-i486-1
e2fsprogs-1.34-i486-1
reiserfsprogs-3.6.11-i486-1
grep-2.5.1-i486-1
gzip-1.3.5-i486-1
which-2.16-i486-1
man-1.5m2-i486-1
nasm-0.98.38-i486-1
lilo-22.5.8-i486-1
make-3.80-i486-1
modutils-2.4.25-i486-1
patch-2.5.4-i486-1
procinfo-18-i486-1
procps-3.1.14-i486-1
psmisc-21.3-i486-1
shadow-4.0.3-i486-1
sysklogd-1.4.1-i486-1
sysvinit-2.85-i486-1
tar-1.13.25-i486-1
util-linux-2.12-i486-1
gcc-2.95.3-i486-1
linuxmandocs-2.4.21-i486-1
calcpercent-0.1-i486-1
installwatch-0.6.3-i486-1
gdb-6.0-i486-1
strace-4.5.1-i486-1
ksymoops-2.4.9-i486-1
db4-4.1.25-i486-1
mailx-8.1.1-i486-1
traceroute-1.4a12-i486-1
popt-1.7-i486-1
logrotate-3.6.3-i486-1
nano-1.2.2-i486-1
iptables-1.2.9-i486-1
libpng-1.2.5-i486-1
libjpeg-6b-i486-1
freetype-2.1.5-i486-1
glib-1.2.10-i486-1
minicom-2.1-i486-1
mm-1.3.0-i486-1
libpcap-0.7.2-i486-1
tcpdump-3.7.2-i486-1
readline-4.3-i486-1
openssl-0.9.7c-i486-1
wget-1.9-i486-1
curl-7.10.8-i486-1
nail-10.5-i486-1
lynx-2.8.4-i486-1
gmp-4.1.2-i486-1
mysql-4.0.17-i486-1
gd-2.0.15-i486-1
apache-1.3.29-i486-1
portmap-5-i486-1
cyrus-sasl-2.1.15-i486-1
openldap-2.1.23-i486-1
samba-3.0.0-i486-1
eject-2.0.13-i486-1
cron-2.3.3-i486-1
dhcp-3.0pl2-i486-1
dhcpcd-1.3.22-pl4-i486-1
parted-1.6.6-i486-1
debianutils-1.16-i486-1
openssh-3.7.1p2-i486-1
bind-9.2.3-i486-1
bc-1.06-i486-1
ntp-4.2.0-i486-1
biew-550-i486-1
gpm-1.20.1-i486-1
mc-4.6.0-i486-1
pure-ftpd-1.0.17a-i486-1
libnet-1.0.2a-i486-1
libnids-1.18-i486-1
dsniff-2.3-i486-1
nmap-3.48-i486-1
netwox-5.7.0-i486-1
scapy-0.9.16-i486-1
netcat-110-i486-1
lftp-2.6.8-i486-1
raidtools-1.00.3-i486-1
zoneinfo-sentinix-linux-i486-1
links-2.1pre14-i486-1
slocate-2.7-i486-1
cdrtools-2.00.3-i486-1
infozip-2.3-5.30-i486-1
usleep-unknown-i486-1
sendmail-8.12.10-i486-1
procmail-3.22-i486-1
oggvorbis-1.0-i486-1
mad-0.15.0b-i486-1
sox-12.17.4-i486-1
mpg321-0.2.10-i486-1
nfs-utils-1.0.6-i486-1
bchunk-1.1.1-i486-1
gcal-3.01-i486-1
mhash-0.8.18-i486-1
http_fetcher-1.0.3-i486-1
fetch-1.0-i486-1
fping-2.4b2_to-ipv6-i486-1
qstat-25c-i486-1
radiusclient-0.3.2-i486-1
net-snmp-5.0.9-i486-1
nessus-2.0.9-i486-1
nagios-1.1-i486-1
snort+acid-2.0.6-i486-1
bmon-1.2.1-i486-1
replimenu-0.9.1-i486-1
dialog-0.7-i486-1
openmosix-tools-0.3.4-i486-1
rexima-1.4-i486-1
cdparanoia-III-alpha9.8-i486-1
cdp-0.33-13-i486-1
gnupg-1.2.3-i486-1
sharkwrapper-0.3-i486-1
python-2.3.2-i486-1
sysstat-5.0.0-i486-1
fblogo-0.5.2-i486-1
clamav-0.65-i486-1
sentinix-perlmodules-1.0-i486-1
spamassassin-2.60-i486-1
mailscanner-4.25-14-i486-1
pine-4.58-i486-1
ngrep-1.41-i486-1
ansirem-NA-i486-1
announceuptime-0.1-i486-1
ipaudit-0.95-i486-1
tcptrace-6.6.0-i486-1
lsof-4.69-i486-1
makedev-2.3.1-58-i486-1
ipfm-0.11.5-i486-1
iptraf-2.7.0-i486-1
ettercap-0.6.b-i486-1
rsync-2.6.0-i486-1
rcs-5.7-i486-1
cvs-1.11.10-i486-1
libol-0.3.11-i486-1
syslog-ng-1.6.1-i486-1
screen-3.9.9-i486-1
miscrequired-1.0-i486-1
sentinix-rc.d-1.0-i486-1
sentinix-setuputility-1.0-i486-1
cgitoolkit-0.1-i486-1
rrdtool-1.0.45-i486-1
ntop-2.2c-i486-1
cacti-0.8.4-i486-1
snortcenter-1.0beta-i486-1
bandwidthd-1.2.0b-i486-1
sentinix-mysqldatabases-1.0-i486-1

Packages will be named something like e.g. rrdtool-1.0.45-i486-1.sx.tgz.

##FINAL NOTE##

If anyone is interested in helping out with something listed above, let me 
know!

The best way to keep in close contact with me is to join the #sentinix channel 
at server irc.sentinix.org, my nick is "replikan".  I have strange uptimes, 
so people on the american continent will probably find me there during and 
after their working hours. ;)

That's it folks... for now!
Stay tuned!

	Michel