Red Hat vs Debian, installing a POP server. Security

Its a general winge at the business world in general, rather than Linux.
I use Debian. Its defaults are pretty secure, and its packages do a good
job at configuring themselves. My employer has just bought Red Hat,
because of the Corporate Presence. I perhaps ought to be sending this
to their rep, as I expect we have a support contract with them.

It has taken some effort to get a POP server working (OK, about 15
minutes). On Debian it sorted itself out nicely. Apt got the dependencies
automatically. The POP server package put itself in /etc/inetd.conf,
picked up the system default hosts.allow and pluggable authentication
settings and added itself to the log watcher (basic intrusion detection)
rules by placing a file in the appropriate .d directory. All I had to
do was type

 apt-get install pop3d

Then to be sure (and so we could repeat it by hand on Red Hat if needed),
I checked what it had done.

On Red Hat we had to enable it in xinetd by hand. Maybe there's a GUI
somewhere for this, but it wasn't done for us. We then met the firewall.
Running nmap against the box, we found that it stealths ports 1 to 1023.
Port 1024 is open, and nmap claims it to be KDM, which is not something
I'd want the outside world to see. Ports above remain closed, but not
stealthed, so I wonder if the firewall just doesn't go that high. I'd
expect a default deny policy with few allowed ports open. Our admin took
the firewall down, this is an internal test box only, otherwise I could
have looked at the iptables and found out.

I also found that the Red Hat system (it was a Workstation Install)
enables remote root access in SSH by default. Debian are far more paranoid
and don't even allow X over SSH by default. Debian also don't install
things like portmap unless needed.

It seems to be like VHS and BetaMax. The market leader, with the
advertising and the pretty GUIs, is not actually as usable or complete in
my experience as the quiet but not market leader. Debian is technically
well thought out, but lacking in the GUI sense where Red Hat has a
pretty GUI, but technically is at least different. 

To be fair, I ought to compare against Red Hat Server Install. Install
it myself, put it on the network, try to add a POP server, and hit it
with things like nmap.

There are some things that could be improved still. Bind is the only
thing on my system according to netstat that binds to loopback only. All
my other services bind to all interfaces, though my firewall (outboard
for paranoia's sake) protects them. I have TCP Wrappers, which is good,
though it would be nice if everything used it. Some things up on high
ports should really be well protected, such as desktop components.
More use could be made of chroot by default, making it easy to setup for
services like bind which don't need much from outside their chroot jails.

 - Richard

-- 
   _/_/_/  _/_/_/  _/_/_/ Richard dot Corfield    at    ntlworld dot com
  _/  _/    _/    _/      Fortune Cookie: What is food to one, is to
 _/_/      _/    _/       others bitter poison.   -- Titus Lucretius
_/  _/  _/_/    _/_/_/    Carus