Re: Red Hat vs Debian, installing a POP server. Security

It all depends on your approach.  Almost everything that you dislike 
about RedHat is a conscious decision that I happen to agree with.

On Wednesday 24 September 2003 12:53 pm, 
Richard.Corfield.Admin-XZoyATsUNX5Wk0Htik3J/[email protected] wrote:
>  apt-get install pop3d

It's just like Windoze.  When it works, you don't have to think about 
it.  But can you figure out what went wrong when it doesn't work quite 
right?  Do you know what it's doing for/to you?


> On Red Hat we had to enable it in xinetd by hand. Maybe there's a GUI
> somewhere for this, but it wasn't done for us. We then met the
> firewall. Running nmap against the box, we found that it stealths
> ports 1 to 1023. Port 1024 is open, and nmap claims it to be KDM,
> which is not something I'd want the outside world to see. Ports above
> remain closed, but not stealthed, so I wonder if the firewall just
> doesn't go that high. I'd expect a default deny policy with few
> allowed ports open. Our admin took the firewall down, this is an
> internal test box only, otherwise I could have looked at the iptables
> and found out.

Manually enabling xinetd services is intentional.  The policy is to not 
enable something that the user isn't aware of.  You can install RedHat 
with every package included, but it doesn't enable most things by 
default.  Yes, there is a nice GUI to enable and disable services.  I 
just use "chkconfig" from the command line.  It's quite simple.

I've had some issues with RedHat's firewall setup (unable to run NFS 
through it).  In the end, I just disable the firewall and rely on the 
main firewall.  Of course, I know that all un-configured services are 
disabled.

At no time will RedHat or Debian save you from being an idiot.  You 
still need to understand your own security.  RedHat's firewall is 
really for home users (that don't have a clue).  If you want to run 
services through it, then you had better know what you are doing.

>
> I also found that the Red Hat system (it was a Workstation Install)
> enables remote root access in SSH by default. Debian are far more
> paranoid and don't even allow X over SSH by default. Debian also
> don't install things like portmap unless needed.

There are no known exploits to these features.  I use root and X over 
SSH extensively.  I couldn't admin all the systems without them.  When 
a security hole shows up, I make sure that the patched version gets 
applied ASAP (as with any security patch).

>
> It seems to be like VHS and BetaMax. The market leader, with the
> advertising and the pretty GUIs, is not actually as usable or
> complete in my experience as the quiet but not market leader. Debian
> is technically well thought out, but lacking in the GUI sense where
> Red Hat has a pretty GUI, but technically is at least different.

You're just bellyaching about a system thats different for you.  
RedHat's default security is much tigher than Solaris, IRIX, or Windoze 
(the true market leaders).  All the admin tools are there, but you will 
have to find them and use them.

RedHat does well is all areas.  Some distros are better in some areas, 
but RedHat will continue to improve.  As always, use what works best 
for you.

>
> To be fair, I ought to compare against Red Hat Server Install.
> Install it myself, put it on the network, try to add a POP server,
> and hit it with things like nmap.

It's probably not any different.  All the things that you complain about 
are design decisions.  The main thing that the "server" edition adds is 
extended support.  "Enterprise" edition might be a little different, 
but the main thing there is a longer release cycle.

>
> There are some things that could be improved still. Bind is the only
> thing on my system according to netstat that binds to loopback only.
> All my other services bind to all interfaces, though my firewall
> (outboard for paranoia's sake) protects them. I have TCP Wrappers,
> which is good, though it would be nice if everything used it. Some
> things up on high ports should really be well protected, such as
> desktop components. More use could be made of chroot by default,
> making it easy to setup for services like bind which don't need much
> from outside their chroot jails.

Many packages already change ownership after they start (you have to 
start as root to get the low ports).

You probably guess that I've been using RedHat since 4.1.  I've found it 
to be much easier to administer than SunOS, Solaris, IRIX, or Windoze.  
I don't think that RedHat is perfect, but you should at least 
understand it before griping.

One of my pet peaves is that Linux has become like Mac/Windoze in that 
you now have to run the menu maze to find the admin tools.  Menus are 
good in some cases, but that shouldn't be the only way to find the 
"proper" way to administer something.

-Dan