On Thu, Nov 23, 2006 at 05:07:52PM +0100, Igor Sobrado wrote:
> [U]sing certificates is an excellent choice too. I suppose
> that OpenBSD currently supports using certificates stored in
> removable media. A bit hard to configure, but highly secure.
> Indeed.
I find it hard to think of a situation in which this would actually stop
an attacker, instead of making his/her work a little harder. I suppose
securelevel 2, an immutable kernel, and immutable system binaries might
make it harder to compromise the box across reboots. Provided the
securelevels actually work as advertised (I'm not sure; Theo thinks them
useless, and they can certainly be circumvented just by mounting
something over directories - at least until reboot).
Things like gdb and systrace are scarily powerful.
Joachim
