That’s a very interesting and pertinent presentation by a guy named Grubb from RedHat:
A few items caught my eye:
Slide 7 points out that the CERTs really don’t do a good job, comparatively speaking, of detecting vulnerabilities. It seems that the “million eyes” of other FOSS parties, developers, other distributors & packagers and individuals are much more effective than companies and organizations targeted at such things.
Slide 15 addresses partitioning. I’m amazed at the number of people I hear on the *IX forums I subscribe to and web sites I read that fail to partition and protect their disks. Its as if they think the way Microsoft’s OEM/consumer systems ship with everything under C: is the way to go with Linux as well. Oh, I do see some separate
/home, but it seems only a few of the corporate admins have noted the security bugs possible if
/tmp is on the root partition. The advantages of further partitioning I have found to be immense – compartmentalization prevents so many minor problems from becoming major ones. The designers of the Titanic should have realised.
There’s so much more good stuff in that about specifics of configuration. My advice to many less security-experienced sysadmins is “just do it”. Why? In my database of quotes I have
Bullet proof vest vendors do not need to demonstrate that naked
people are vulnerable to gunfire. Similarly, a security
consultant does not need to demonstrate an actual vulnerability
in order to claim there is a valid risk.
The lack of a live exploit does not mean there is no risk.
– Crispin Cowan, 23 Aug 2002
That *I* can’t demonstrate or document an exploit is no reason for the
sysadmin to fail to apply a well known baseline control such as those documented in this slideshow and many other books and articles. Yes, I know that I sound like Donn Parker when I say that, but this is sensible prudence.
“Just Do It”