OpenBSD, Security, and Theo de Raadt 178
AdamK writes "Here's a very interesting article on security and OpenBSD. It also briefly mentions Linux, comparing the two." A quote from the story: "OpenBSD is so secure that it even got the attention of the U.S. Department of Justice, which stores and transmits top-secret data using 260 copies of the OS."
Paranoia-HOWTO (Score:1)
1) disable floppy-boot in bios-setup.
2) set bios-password
3) lock case, and have a case-breach-sensor, which triggers deletion of all HDDs. This prevents the attacker from deleting the bios-password and from taking out the discs
4) don't have reset or power-switches (not needed if atx-powersupply). ctrl-alt-del deactivated too of course.
So, this only leaves pulling the plug to turn the machine off, then open it, shorten the bios-password-del-jumper and THEN boot from floppy. And therefore we need to:
5) have 2 of these boxes which monitor each other and have them sound a big, loud alarm in case one fails. Disc-deletion and sealing of all doors to the server-room is then, of course, a standard feature
Did I forget anything ? ;-)
rob
Fluff (Score:1)
It doesn't matter how tight your kernel and base software are (As de Raadt says in the article) if you go out and install a third party server that's insecure. I do agree with him that Linux dist maintainers such as Redhat are much too lax in the security arena when they assemble their distributions. They've always been much to free with those setuid bits, pretty much guaranteeing that if a user can get a login on your system, it is then trivial to obtain root.
In my experience, third party source code auditing is the number one way to guarantee that any given piece of software is secure. Back when I was working with Data General to get a B2 certification for DG/UX one of my jobs was to audit functions in the C library. We'd take a function, look at the source, form a test plan, write up the test plan, and feed a test program to an automated test platform that would try the function out with an assortment of values, checking for unwanted side effects or erroneus return values. We did this for every single function in the C library. We did similar testing on all the core utilities of the OS. All our tests were completely documented so that they could be reviewed later. I'd feel a lot more secure with Linux if a distribution would apply this level of scrutiny to any program given a setuid bit and the C library as well (And I'd want to be able to access the test plans and results online.)
Re:BIOS security (Score:1)
Deraadt is worse than a script-kiddy (Score:1)
Want proof?
http://www.freebsd.org/cgi/getmsg.cgi?fetch=293
http://www.freebsd.org/cgi/getmsg.cgi?fetch=560
http://www.freebsd.org/cgi/getmsg.cgi?fetch=635
I wouldn't use OpenBSD if it was the only free operating system on Earth.
Re:Security... (Score:1)
just probably annoy them a little bit. It's a moot point
anyway, seeing as I was way off base in describing
how the password system works...
Re:Security... (Score:1)
On OpenBSD, all account information is stored in a non-text format file called (on my system) pwd.db. Editing user information is done by running the new password entries through a program called pwd_mkdb which preforms some checks, then modifies the database.
I believe, that if the authentication technique for Root is set to One Time Passwords, that you would have to edit pwd.db itself to revert to normal passwords, as I do not think that pwd_mkdb will make that change.
on the linux side (Score:1)
at the lilo prompt, instead of typing 'linux' (or whatever) type 'linux single'. bam, instant root access shell.
as for the other operating systems, assuming they're not using a cryptographic file system, your worst case scenario is add the drive to an alternate machine which can access the filesystem, mount it as
I, personally, am not concerned with these kinds of 'vulnerabilities' considering that in almost all cases, if you have something truly secure, they're locked away in a camera'd, card-access only server room anyway.
My biggest issue with BSD... (Score:1)
The only problem with OpenBSD... (Score:1)
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
Re:Fluff (Score:1)
Hrrm. You have experience in performing this task, and you have an itch to scratch. Sounds to me like you just volunteered your services :)
The source is out there. Use it friend, use it.
Re: BSD Passwords - Get it right! (Score:1)
Note that the db database is pretty similiar to the way that sendmail handles it's maps.
For the full lowdown, do "man 5 passwd".
I'm not sure whether or not the authentication technique would be used in single user mode.
I think you can make the system ask for a password in single user mode by labelling the console "insecure" in
Re:Mirror here: (Score:1)
It's actually kinda fun to give my box a little action. And what action... I haven't seen this many hits on my own website... um... ever!
Re:And are the DOJ security experts? (Score:1)
And, of course, it can be misleading to speak of a "secure operating system" - security is a property of the system as a whole. A Windows NT mail hub can store and forward a PGP-encrypted message without the contents of the message being any more readable, and an OpenBSD machine can be configured with open "telnet" ports and guessable passwords.
And if the telnet ports are open, so what? maybe a user account is compromised, but that attacker still isn't going to gain root. Compare that to Redhat Linux, shipping a remote root vulnerable imapd until the release of 6.0!
No one involved with the OpenBSD project claims that it can be used by clueless people. In fact, quite the contrary. They encourage people to discover facts for themselves, educate themselves thoroughly, rather than providing simple cookbook instructions without understanding. Rather, the emphasis is on providing an operating system that is complete, secure, stable, and instantly usable for the educated user.
Re:Here we go... (Score:1)
Re:There's bureaucracy and then there's bureaucrac (Score:1)
Any chance my van could be used for, uh, off-site storage?
Re:I've never actually tried *BSD (Score:1)
When fiddling with init scripts, I prefer BSD. This is a very subjective thing and I think largely the preference is determined based on what you learned first...
When fiddling with devices, I prefer Linux -- BSD disk labels (somewhat like an alternate method of an extended partition on a PC, not really) are a little daunting for the uninitiated, IMHO.
When it comes to handling package management, Debian has the only Linux distribution that comes close to FreeBSD in terms of ease of use and power. For people who don't think much of package management (you Slackware guys), you might prefer NetBSD.
Re:BIOS security (Score:1)
--
Re:OpenBSD gripes (Score:1)
Friend, OpenBSD is the easiest un*x to install and configure. When you first choose the disk layout i have never seen another system hold your hand and help you so much when giving the size of each partition you want. It has been the easiest un*x to configure for our NIS environment here, including running amd.
Maybe we have different desires for what our chosen OS gives us, but from my job POV i need a system that integrates into our environment with a minimum of fuss and trickery, and OpenBSD is by far the easiest i have found. For those curious, we run Solaris, SunOS, AIX, HP-UX, Linux, BSDI, Irix, Digital Alpha, OpenBSD; all at many different revs and languages and platforms.
-j
Re:Mirror here: (Score:1)
Re:Here we go... (Score:1)
Re:Mirror here: (Score:1)
It's actually kinda fun to give my box a little action. And what action... I haven't seen this many hits on my own website... um... ever!
Re:I've never actually tried *BSD (Score:1)
Maybe I'll tinker with FreeBSD 68k, and maybe try it on one of the x86 boxes here at work.
NetBSD is my favourite of the *BSD's (Score:1)
For portablility, NetBSD is the champion of the *BSD's. If you need prepackaged security tools, then OpenBSD is your obvious choice. And if you're running an Intel machine then FreeBSD performs the best of the BSD's on that platform.
As for NetBSD
Chris
Chris Wareham
Stick a pony in my pocket ... (Score:1)
I've actually had my eye on a rather nice 21" premium Sun monitor (I've only got one of the cheaper 17" ones at home). I honestly don't know what is going to happen to all the hardware, but I doubt they'll offer it for sale to the staff.
Which reminds me. The Goth/Industrial club I go to (the legendary Slimelight in Islington, London) has converted one of its unused rooms into a warehouse for just about every kind of computer kit. Vax's, Suns and hordes of old PC's. Strange.
Chris
Chris Wareham
There's bureaucracy and then there's bureaucracy (Score:1)
I'm rewriting two systems that currently run on Solaris. I was expected to do this from an NT workstation running Hummingbird Exceed and connecting to a server in Amsterdam.
Firstly, the development server no lnoger exists. Secondly, our net connection to Holland is diabolical.
So I replaced NT with Linux on the sly, and rewrote the system in two weeks. Now I need to test it
The recently appointed IT manager has made one decision since taking up his post:
Duhhh
This has meant two things for me, a recently arrived contractor:
1) The Unix sysadmins *all* left in disgust at the switch to NT
2) We have storerooms full of unused Sun equipment, but no one will sanction the setting up of a new Unix server
Sorry about the pointless griping, but I had to get it off my chest.
Chris
Chris Wareham
Re:Security... (Score:1)
There are two kinds of 'physical access' - access to the keyboard and floppy drive, and full access to the machine, including removing the case.
In many environments such as schools, users have the first but not the second. You can assume that they won't open the case of the machine or steal it, but they will try booting from floppy, CTRL-ALT-DEL or 'linux single'. In these cases, a BIOS password and LILO boot password, combined with a secure operating system, should suffice.
Re:Security... (Score:1)
So just use your own version of pwd_mkdb that is a little more obliging.
Security and Physical Access are compatible (Score:1)
There, now your box should be secure against physical attacks.
Show me numbers!!! (Score:1)
But, this article was completely full of statements with no numbers or facts to back any of it up. Infact it seems to want to trash Linux pretty bad by claiming to be much better in all the aspects mentioned in the article.
First, off the comment about *BSD fragmentation and being so aged it's useless? Personally, I've never heard such rumors. And if I did, I wouldn't go taking them for face value. If you think that everything you read on the net is true. You have bigger misconceptions then these.
And I don't think Linux is slower in any regard or truely fragmented. I do however think that some distrobutions have gotten sloppy though. And in turn performance isn't what it should be. Once again this isn't a problem. Surely with all the distros out there one should be able to suit your needs. Choice is good.
The author also mentions all the applications out there for *BSD. Well, I'd bet the majority of the *BSD people out after installing *BSD run out for KDE or GNOME or some other major piece of GPL'ed software. So even though I don't think it's wrong of them to use GCC for there needs(isn't that what it's there for). I do think it is wrong of the *BSD communities to complain about the GPL license. By now most people should know this is a personal prefrence and nobody is going to change anyone's mind.
And here is a quote ment to start a flame war.
"But many are simply curious about why a new user would choose Linux over FreeBSD, despite FreeBSD's technical superiority."
Well, that statement should have flushed the last of the credibility this author had left. Obivously, he is bias and this just adds to the rest of the FUD he is spreading. Once again, these are all his personal opinions and not facts. He seems to have made these opinions public to confuse newbies and put down Linux.
The author also mentions that some scripts he wrote broke when upgrading. And that upgrading the to glibc was a pain. I guess he was expecting progress to be held up because he wrote a few scripts and didn't like upgrading his compiler. Next time I'm sure they will check in with him first. Once again I think that this is a common mistake of expecting everything to be hand feed. Even though it's software that is in *developement*.
The only problem I have with *BSD? Well, I can tell you that I'm not fond of the licensing. And I'm definately sick of these *BSD vs. Linux wars going on. And that I'm starting to become a little disappointed in Slashdot's choice of articles lately. But, don't think I don't love you anymore Rob. I do appreciate this site, thanks(to everyone at Slashdot and Andover).
Conclusion:
Don't give this article a second thought. Don't go flaming this guy. If you feel the need to correct him. *BE POLITE*
Re:Bullshit (Score:1)
Re: BSD Passwords - Get it right! (Score:1)
-1: Permanently insecure.
0: Insecure. Anything is possible.
1: File flags (e.g, schg, sattr, sunlnk, etc) cannot be modified. No direct memory access.
(if you run xdm, raise the level in Xsession or some such so that it happens AFTER x starts)
2: Same as 1 + No direct disk access (can't write directly to block devices)
3: Same as 2 + firewall rules can't be changed.
Very good things, these levels.
Re:Paranoia-HOWTO (Score:1)
In Stephenson's Cryptonomicon the Ordo guys had a metal doorframe to their machine room. Embedded in the doorframe were wire loops. (You can guess it now).
BIOS security (Score:1)
bypass BIOS passwords with shorting the battery or disconnecting it. That's true of most systems, but for my old IBM PC330 (486DX2-66). The power on password came with the following caveat: "If you forget this password, there is no way to change it or reset it and the motherboard must be replaced."
I never believed this was true until I finally got ahold of the internal Service Manual for this one. The corrective action to take on a unit that had been returned due to a lost Power-on password was to replace the motherboard!
There was a second level of password that was kept that could be reset if you were too chicken to use the power-on. Man, sometimes IBM stuffs the damndest stuff into their BIOS and board designs.
Quite interesting... (Score:1)
Re:OpenBSD gripes (Score:1)
OpenBSD, FreeBSD, Linux (Score:1)
FreeBSD did the same thing on the second box - couldn't recognise the ethernet card. While comparing the ethernet driver sections of the OpenBSD kernel source and the Linux kernel source, I noted that Linux supported 4 times as many chipsets as the BSD's, including the one for the card in the second machine. I chuckled actually as *BSD advocates are always claiming that they have better networking than Linux. They can feel free to continue thinking that fallacy, there were some other strong points to OpenBSD that I liked a lot and its a shame that I can't run a BSD system due to severe lack of hardware support in their kernels.
Of course the NetBSD crowd are now going to tell me that its my fault for not using NetBSD - but don't bother, I already checked and the card isn't supported with that either.
Re:OpenBSD, FreeBSD, Linux (Score:1)
One thing that did surprise me was that ssh was not included - I had to grab it from ports. There were buttloads of other security/crypto stuff though.
Re:I've never actually tried *BSD (Score:1)
They both do good jobs at the same thing. I personally like OpenBSD's NAT implementation (all you have to do is add -alias to your pppd command line and you have NAT) but at the same time, I like alot of things about Linux too.
Using the tool that I like for the job at hand.
Try both! Learning something new never hurts and who knows... the knowledge will probably come in handy some day!
--
Re:Security... (Score:1)
That means that for the last 2.5 years, not enough sites have been running OpenBSD for it to be worth trying to crack.
There is no doubt that the OpenBSD team have done a better job on out-of-the-box security than any other free system out there, but that does not mean that the system is uncrackable. They would be the first to tell you that. As the system's popularity grows and it becomes a richer target, you will start to see OpenBSD security alerts.
Re:Paranoia-HOWTO (Score:1)
>clickety click
...Time to get back to xtank.
-Chris
Protection against opening the case - C4! (Score:1)
If anyone tries to open that computer to bypass OS and BIOS security, it'll blow itself to pieces, taking the data with it. And prolly the one doing the crack, as an added bonus.
The best place to put the device would be in a empty hard drive case. With the exception of the wiring for the tamper switches (and you could prolly get creative and hide thoses well), it would be indisquishable from a real drive. It would also put the charge right near the data it is designed to destroy.
If you're brave, use a mercury switch so the thing cannot even be moved.
If you're *REALLY* brave, connect a relay to the PSU, so the thing cannot even be *turned off*.
If you ever want access to the system again, replace the keyboard lock with a decent lock, complete with a tamper switch, and still no one will be the wiser.
This is, of course, supreme overkill, and highly dangerous to boot, but I suppose if you really don't want your data getting compromised...
DISCLAIMER: If you actually do this, and then blow up something you wanted (data, a body part, whatever), do not blame me. I said it was dangerous.
Re:Hotmail (Score:1)
Re:Bullshit (Score:1)
WRONG! Re:on the linux side (Score:1)
If you boot into sigle user modem it WILL ask you for password. This has nothing to do with OS Kernel but with INIT scripts!
The following is from my
# What to do in single-user mode.
~~:S:wait:/sbin/sulogin
Screw RedHat for not using this!
Re:Deraadt is worse than a script-kiddy (Score:1)
Not to mention, the messages used as examples are 3 years old. This is all old water under the bridge, and if you refuse to use an OS because of the person who cares and feeds it, then thats your problem. Its BECAUSE of, not IN SPITE of Theo's single-mindedness that OpenBSD is as secure as it is.
Re:The only problem with OpenBSD... (Score:1)
I don't even understand what you're implying....that he only fixes bugs when he hears about a script going around? Thats just untrue...99% of the time when a new exploit is released, its already been fixed for months in OpenBSD
Theo's a real smart guy. Yes, he can be a pain
and he's not the friendliest guy around, but he's
real smart, and knows exactly what he's doing.
Re:Security... (Score:1)
You create an empty password in the shadow password file. After reboot you login as root and you're not asked for a password.
Re:Hotmail (Score:1)
Re:The only file systems which guard against this. (Score:1)
So you'd have to put the key on a smartcard. Of which there would be copies (can't have the company go down because someone lost a smartcard)
Re:My Take, from someone that uses it daily. (Score:1)
Re:Oops (Score:1)
Re:Security and Physical Access are compatible (Score:1)
^.
( @ )
Uh. (Score:1)
Duh
Re:Why I prefer BSD (Score:1)
Re:Security... (Score:1)
Re:BIOS security (Score:1)
Re:And are the DOJ security experts? (Score:1)
Re:Stick a pony in my pocket ... (Score:1)
Re:Fluff (Score:1)
Re:Deraadt is worse than a script-kiddy (Score:1)
Date: Wed, 25 Dec 1996 03:01:53 -0800
From: "Jordan K. Hubbard"
To: Aleph One
Cc: freebsd-core@freebsd.org, freebsd-chat@freebsd.org, freebsd-questions@freebsd.org
Subject: Re: IP Filtering to www.freebsd.org
Message-ID:
In-Reply-To: Your message of "Tue, 24 Dec 1996 23:15:43 CST."
Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
> I have come across some disturbing information. It seem that FreeBSD
> project is filtering IP packets comming from the OpenBSD project. In
> particular access from 199.185.137.*, and maybe 199.185.136.*, to
> www.freebsd.org. If this is true it marks a very low point on the history
> of FreeBSD.
This was started well over 3 months ago and is old old news. I fail
to understand how this could only suddenly "come to light" for anyone
involved with either project, we being very open indeed about it at
the time (just search our mailing list archives for freebsd-hackers
with Theo as the keyword).
We were forced to filter the OpenBSD project because the same hosts
and/or IP address range that it uses were also used in repeated
attacks against the FreeBSD project's mailing lists and development
machines by Theo Deraadt, who actually owns the network in question.
These were not covert attacks, they were very open and Theo sent
personal mail to several core members threatening to escalate them
with the aid of (quote) "his cracker friends." It was at this stage
that we added filtering, to try and block (in one small way) such
attempts.
When the OpenBSD project decides to have someone less criminally
inclined as its representative, we'll be happy to discuss this with
them. Until then, the man has shown himself unable to exercise a
degree of self-restraint which would be consistent with someone of his
age and responsibilities, and if he insists on behaving like a 14
year- old cracker then he will obviously be treated as such.
It is simply unfortunate in the extreme that he chose to use machines
on the same network to conduct his attacks (also misusing a machine at
MIT for that purpose, for which its admins were not amused), and has
done the OpenBSD project a grave disservice in doing so. We have
taken, I believe, only the most appropriate steps to defend ourselves
from Theo's juvenile behavior and will continue to do so.
> If the project is to succeed its in the basis of its quality, support,
> and technical merits, and not by means of cheap tricks. Anyone wish to
> comment?
This is no "cheap trick", this is self-defense, plain and simple. I
only regret that such defense against a "leading light" in the
software community is necessary at all.
Trust me folks, we have ample documentation for the claims I make
above and if you'd like a second opinion, just ask the NetBSD project
why it does precisely the same thing with packets from Theo's network.
The list of people singularly unimpressed with Theo's behavior in the
past and with great reason to distrust it in the future is long
indeed. I can only suggest that the OpenBSD project find a more
credible representatitive, and if you choose Kevin Mitnick as your
best man then you probably shouldn't be too surprised if the FBI shows
up at your wedding.
Jordan
Re:How to prevent booting from floppy (Score:1)
Very true. Even with a case lock on the machine, these are only measures meant to stall someone, prevent mischief, or simply make it not worth breaking into more than anything else. True security in the sense you're talking about means locking a machine in a door-less vault with no connectivity to the outside world. Of course... then you open yourself up to nose-toting talk show hosts. 8)
Security in real life means making things secure enough that almost anyone tempted to break it will go on to easier prospects when they feel the effort isn't worth the end result.
How to prevent booting from floppy (Score:1)
Re:Protection... overheating? (Score:1)
Re:Hotmail (Score:1)
Are we talking about the Hotmail with the huge security hole in their cgi programming, which would be a security hole on any OS, even NT?
If so, they apparently use a mix of FreeBSD, Solaris and NT, and their recent security holes have nothing to do with FreeBSD, or even NT for that matter.
George
Re:There's bureaucracy and then there's bureaucrac (Score:1)
Re:Security... (Score:1)
As for OpenBSD's security, 2.5 years without a security alert speaks for itself I think.
Re:No it wouldn't. (Score:1)
Re:Security... (Score:1)
Re:Quite interesting... (Score:1)
Re:Security... (Score:1)
-konstant
NetBSD ftp'd, partitioning drive... (Score:1)
Thanks for the input!
I've never actually tried *BSD (Score:1)
Not to start a debate or flame war, but for anyone who's used *BSD and Linux why do you prefer one over the other? Or the particular distribution of either that you use? I've only had experience with Debian (which I have read is more secure and I use more often)and RH (the first one I tried, mega mega easy to install and configure), and a weeeeeee bit on LinuxPPC.
Re:Why I prefer BSD (Score:1)
programers to think through what they are doing while linux is more of a quick hack. That is Linux is more release quickly and often where as BSD is get
it right, then release. The only advantage is if it is wrong BSD makes it easier to throw away that code as it isn't released.
Does this also mean that it is harder to remove bad code if it does make it into a release?
Yay Theo! Yay Calgary! (Score:1)
_______________________________________________
$which weed
The only file systems which guard against this... (Score:2)
Why I prefer BSD (Score:2)
Simple, it is BSD, not SysV.
There are differences, but you get used to that. I'm already in the habbit of typing "ps -aef;ps -aux;ps -ae;ps -ex;ps -ax;ps -a" of which normally only one returns what I was looking for. (Challange, guess which variant eash is used on - trick question, I may have one made up)
Other than command line arguements, of which ps is about the worst few people will be able to tell the difference without being told. That is if you replcaed the login screen on any xbsd box with one that said Linux few people would notice the difference.
I like the way freeBSD is configured, but I've only played with slackware 3.0 for linux, which is not a fair comparition.
As a programer, I think that *BSD is better programed overall. This is not to say that *BSD is perfect, or that Linux is all bad, there are places where linux is better programed. Overall though from what I've seen the majority of cases leaves *BSD better. One aspect of better is that BSD encourages programers to think through what they are doing while linux is more of a quick hack. That is Linux is more release quickly and often where as BSD is get it right, then release. The only advantage is if it is wrong BSD makes it easier to throw away that code as it isn't released.
FreeBSD has better networking code, though linux has cought up for the most part. Linux has better SMP, but FreeBSD is catching up. OpenBSD is more secure, netBSD is more portable. (Linux has been ported alot, but netBSD has more useful working ports, while many linux ports belong in the curisoity catagory due to the hardware limits)
Finially, BSD is not GNU. This is religion for many people, but the fact it I don't like the GNU license. Your welcome to disagree, I don't worship the BSD license, just prefer it given a choice
Mirror here: (Score:2)
Please be gentle with my box... this may not be wise of me.
Re:Here we go... (Score:2)
7) BSD is all caps, and capslock sucks
Here we go... (Score:2)
1) BSD Sucks
2) Linux is best
3) BSD is too fragmented
4) BSD is dying
5) There is no software for BSD
6) There is no hardware support for BSD.
<WHINE>
I said it so all you trolls don't have to.
OpenBSD FAQ (Score:2)
8.3 - I forgot my root password, what do I do now?
A few steps to recovery
1.Boot into single user mode. For i386 arch type boot -s at the boot prompt.
2.mount the drives.
bsd# fsck -p / && mount -u /
3.If
bsd# fsck -p
4.run passwd
5.boot into mulituser mode.. and remember your password!
Re:Security... (Score:2)
Re:Security... (Score:2)
Re:There's bureaucracy and then there's bureaucrac (Score:2)
Re:How to prevent booting from floppy (Score:2)
But unless you physically lock the machine up, or do something radical like fill the floppy drive connector with epoxy, you really can't prevent someone from opening the box and hooking up a floppy drive and resetting the CMOS memory...
Re:BIOS security (Score:2)
Re:BIOS security (Score:2)
Re:BIOS security (Score:2)
Here is a question. Supposing the opposite problem happens... Instead of forgetting the password, what happens if too many people (like a former employee for instance) knows what the password is... If its burned into PROM, how do I change it? Can I? If so, how many times before the PROM is full? This would seem to be a serious enough problem to make this 'feature' unusable even if you don't worry about losing/forgetting passwords.
Re:Security... (Score:2)
Its a hardware problem. Linux can't do anything to fix that, and neither can anything else. If you have physical access to the machine you can override anything (including BIOS passwords, by resetting the CMOS memory (either a jumper or shorting the battery momentarily)). Even if no floppy is connected, you can open the machine and hook one up. Or you can remove the hard drive the passwd or shadow file is on, hook it up to another machine and change the files.
Unless you physically lock the machine up, it is not secure.
Re:Security... (Score:2)
sequence and password protected the BIOS, but it wouldn't have
prevented "plan B" - which is to wipe the BIOS by opening the case, or
to remove the HD and install it in another machine.
And yes, I'm aware of the need for physical security; (the servers
were stored in a locked, alarmed room.)
I was just asking, because (as I said) this BSD shop told them that if
it was running BSD, then there was no way anyone could break into
them.
So which OS's do you use that can prevent you from booting from a
different volume? (be it floppy, hard drive, or some other medium.)
Then paint me a script-kiddie (Score:2)
Slashdotted? (Score:2)
Re:yeesh (Score:2)
I wonder if it's significant that the URL is in the subdirectory "teasers".
Re:Paranoia-HOWTO (Score:2)
You might add an internal UPS so that case-breach disk destruction could continue happily even when the power cord is pulled.
Re:I've never actually tried *BSD (Score:2)
Seriously. back in 1995 I worked for a national ISP that I won't name. We had to build news machines. A lot of news machines. We had quite a few ISP customers, and they all wanted news.
At the time, I was a Mac user. UNIX was the clunky thing I used to read my email and run traceroute with. I mention this only to show that I had no prior BSD/Linux bias.
After much pain, we got Linux going (Red Hat 3.2, I believe, but don't quote me). A pentium 200 filled about 20 meg, then leveled out. Not bad.
The FreeBSD 1.5 machine, with the same hardware, filled a DS3. (Boy, were those T1 customers hanging off that site *pissed*! But that's another story.) The FreeBSD box didn't so much as break a sweat.
So, we plugged it into an OC3.
The box finally leveled out at 80 meg. My gut reaction is that it was the cheap 100bT NIC that filled out.
Of course, we eventually smoked the SCSI arrays (remember back when an 8 gig array was impressive?) But the OS just kept going, and going, and going.
As a network engineer, FreeBSD earned my trust.
Now, most people don't need to soak an OC-3. But those of us who do (Best, Yahoo, etc) tend to run FreeBSD.
Your T-1 ISP? Either will work just fine.
Your desktop? Linux will support your goofy desktop hardware.
Re:Security and Physical Access are compatible (Score:2)
Steps 1 and 2 - disabling booting from floppies and CDs in BIOS and setting a BIOS password - are laughably easy to get around. Just pop the cover on the box. Most systems either have a jumper that lets you reset the CMOS or you can just unplug the battery that saves the CMOS memory. Bye-bye BIOS password.
After that step 3 - setting LILO passwords - becomes moot because I will boot off a floppy| CD|second hard disk and just mount your Linux|FreeBSD|OpenBSD|NetBSD|Solaris|whatever partition.
So only step 4, encrypting provides you with any protection. From the way you stated step 4 I am assuming you mean encrypting the entire file system and unencrypting at boot time (rather than unencrypting individual files on the fly during operation). That is the only practical way to achieve security when physical access cannot be controlled, but you better use a damn-big, randomly-generated key.
And are the DOJ security experts? (Score:3)
And, of course, it can be misleading to speak of a "secure operating system" - security is a property of the system as a whole. A Windows NT mail hub can store and forward a PGP-encrypted message without the contents of the message being any more readable, and an OpenBSD machine can be configured with open "telnet" ports and guessable passwords.
The care and effort put into OpenBSD's security aspects is of course useful and laudable, but it won't do you the user any good if you don't understand your own role in keeping the system secure.
--
Re:Security... (Score:3)
I assume if OpenBSD puts such an emphasis on security, shadowed passwords would be a default setting which would have stopped the method you've outlined here. I'm amazed that the disgruntled system admin didn't use them, but that may go some way to explain why he was let go.
This is not true. You can't directly get to a root shell like you can with single user mode (or, if single user prompts for a password, try lilo: linux rw init=/bin/sh --don't forget to umount /, then just reboot the machine, shutdown won't work) on linux. You can just pop in an install floppy and mount your / filesystem and edit the passwd file though. Physical access = root access. Shadowing the passwords doesn't change that, you can still edit /etc/shadow.
Re:Security... (Score:3)
In general, physical access to the machine allows access to everything, typically through a method such as what you employed. BSD is no different from Linux (or DOS, or NT, or about anything else) in this regard.
Yes, a person could use a cryptographic hack to keep all file systems encrypted, but the performance hit is usually bad enough that most people find it far, far more economical (and effective) to lock the servers in a machine room with restricted access...
My Take, from someone that uses it daily. (Score:3)
As for limitations, it comes with X and Netscape. Also, there are some new programs that are supposed to allow you to compile Linux binaries and run them. I haven't used this but it sounds cool. So, basically it isn't much more limited than Linux for software. Last I saw it doesn't support dual CPUs and I'm not sure about RAID so it gives up quite a lot to Linux there. Maybe once Linux becomes too mainstream and Linus too much of an icon, all the 'real' computer hacks will turn to OpenBSD for the next revolution? Just kidding.
Lastly, I know that people have been donating hardware (like gigabit ether) that will help keep it a viable, quality OS.
Security... (Score:3)
A couple of weeks ago, I got a call from a company that was letting
their sysadmin go (and not on good terms, either), and needed someone
to hack their (linux) servers, as nobody else knew root passwords; I
got called in; downtime was not an issue, so (with the aid of a
rescue disk) it was just a matter of rebooting the boxes and editing
the passwd file...
After seeing how simple it was to get into the boxes, they immediately
asked if I could switch the boxes over to BSD, as the previous people
they had called (a BSD shop) had told them that if they had used
BSD, then there was no way anyone could get into the boxes, as BSD is
"uncrackable."
Now, I don't have any experience with BSD (I tried installing it, but
there are no drivers for my home machine, which I use as a testbed,)
so I didn't have any firm comeback; but I would like to know (from
the BSD people who will be reading this) if the same technique I used
would be possible on a BSD machine. (I'm hard pressed to think of how
this could be done, short of encrypting the root FS, or something
similar.)
Can anyone shed some light on this? Is BSD really "uncrackable", or
are these other guys just blowing smoke?