Re: NSA's Secure Linux Distribution
On Fri, Dec 22, 2000 at 05:36:14PM -0500, Jacob Kuntz wrote: > but what fact are these fears based in? would the nsa really plop a backdoor > in an opensource project, hoping it missed and accepted with the rest of the > code? i doubt it. their whole (advertised) motive was to protect against the > possibility of Trusted (AIX|Solaris|PalmOS|whatever closed os) going belly > up. Hi, I'm from the government, I'm here to help you. -- Ethan Benson http://www.alaska.net/~erbenson/ pgp6FbsCU6pA4.pgp Description: PGP signature
Re: NSA's Secure Linux Distribution
On Fri, 22 Dec 2000, Jacob Kuntz wrote: > from the secret journal of Britton ([EMAIL PROTECTED]): > > > > Pardon my paranoia, but even if it was worth making all the changes they > > are talking about (which are pretty extensive), I'd want to see anything > > coming from the NSA audited carefully before being included. > > > > Britton Kerin > > you're pardoned. i'm sure we're all a little wary of No Such Agency right > now, with carnivore and all. > > but what fact are these fears based in? would the nsa really plop a backdoor It wouldn't be paranoia if it had a basis in fact :) > in an opensource project, hoping it missed and accepted with the rest of the > code? i doubt it. their whole (advertised) motive was to protect against the > possibility of Trusted (AIX|Solaris|PalmOS|whatever closed os) going belly > up. Agreed. But past things like the weird unexplained DES s-boxes show that NSA is at least not afraid of doing things that are blatantly suspicious. And a lot of insiders there have the attitude that no one outside a project ever really looks closely enough at things to detect problems unless something is noticably broken. With Linux and open source that assumption is probably more wrong than ever before, but still with a grain of truth in it. > of course i plan on running this monster on a throwaway machine before i > make form any real opinions. Good thought. I guess if it seems to work we could offer an alternate kernel package, and perhaps one huge package with all their patched utilities or something? Trouble is a lot of them are kind of buried in other debian packages and would not be easy to substitute for. > jacob kuntz > [EMAIL PROTECTED] > underworld.net/~jake Britton
Re: NSA's Secure Linux Distribution
from the secret journal of Britton ([EMAIL PROTECTED]): > > Pardon my paranoia, but even if it was worth making all the changes they > are talking about (which are pretty extensive), I'd want to see anything > coming from the NSA audited carefully before being included. > > Britton Kerin you're pardoned. i'm sure we're all a little wary of No Such Agency right now, with carnivore and all. but what fact are these fears based in? would the nsa really plop a backdoor in an opensource project, hoping it missed and accepted with the rest of the code? i doubt it. their whole (advertised) motive was to protect against the possibility of Trusted (AIX|Solaris|PalmOS|whatever closed os) going belly up. of course i plan on running this monster on a throwaway machine before i make form any real opinions. -- jacob kuntz [EMAIL PROTECTED] underworld.net/~jake
Re: NSA's Secure Linux Distribution
Pardon my paranoia, but even if it was worth making all the changes they are talking about (which are pretty extensive), I'd want to see anything coming from the NSA audited carefully before being included. Britton Kerin __ GNU GPL: "The Source will be with you... always." On Fri, 22 Dec 2000, Jacob Kuntz wrote: > from the secret journal of Brent Fulgham ([EMAIL PROTECTED]): > > No doubt most of you have seen the NSA's secure linux posting > > on Slashdot this morning. > > > > Looking at: > > http://www.nsa.gov/selinux/docs.html > > > > there appears to be several utilities that have been updated > > to provide enhanced security. > > > > Should we be merging these patches into Debian, assuming they > > appear to be compatible with our policy, etc.? > > > > unless we have a policy against security, it should be fine. :) it's all > gpl. > > -- > jacob kuntz > [EMAIL PROTECTED] > underworld.net/~jake
Re: NSA's Secure Linux Distribution
from the secret journal of Buddha Buck ([EMAIL PROTECTED]): > >unless we have a policy against security, it should be fine. :) it's all > >gpl. i posted that before i hit the download page. > >Security-enhanced Linux is not an attempt to correct any flaws that may > >currently exist in Linux. Instead, it is simply an example of how > >mandatory access controls that can confine the actions of any process, > >including a superuser process, can be added into Linux. The focus of this > >work has not been on system assurance or other security features such as > >security auditing, although these elements are also important for a secure > >system. > > In addition, while they provide 15 new or modified system utilities, they > also provide 36 new system-calls, and require a custom kernel to handle the > system. > > On their to-do list are the following items: > > >Port the kernel patches to the latest 2.2 kernel > >Port the kernel patches to the 2.4.0 kernel > >Port the utility patches to the latest versions of the base utilities > > so I'm not even sure we -could- apply their patches, even if we wanted to. > you have a point. but what about seperate packages for the modified ones, or even wrapper scripts like we do with dhcpd? that sounds somewhat ugly, adding quite a bit of bulk to the default install since even tar and procps get patched. -- jacob kuntz [EMAIL PROTECTED] underworld.net/~jake
Re: NSA's Secure Linux Distribution
At 04:38 PM 12-22-2000 -0500, Jacob Kuntz wrote: from the secret journal of Brent Fulgham ([EMAIL PROTECTED]): > No doubt most of you have seen the NSA's secure linux posting > on Slashdot this morning. > > Looking at: > http://www.nsa.gov/selinux/docs.html > > there appears to be several utilities that have been updated > to provide enhanced security. > > Should we be merging these patches into Debian, assuming they > appear to be compatible with our policy, etc.? > unless we have a policy against security, it should be fine. :) it's all gpl. I'd take a close look at what they did before deciding to integrate their patches in. The goals of the NSA in doing this may not be suitable for Debian. I'm not talking about paranoia concerning the NSA putting back-doors into everything; I'm taking as given that they are being honest and upfront about what they are doing and why. But... Here is a quote from their "overview" page (http://www.nsa.gov/selinux/index.html): Security-enhanced Linux is not an attempt to correct any flaws that may currently exist in Linux. Instead, it is simply an example of how mandatory access controls that can confine the actions of any process, including a superuser process, can be added into Linux. The focus of this work has not been on system assurance or other security features such as security auditing, although these elements are also important for a secure system. In addition, while they provide 15 new or modified system utilities, they also provide 36 new system-calls, and require a custom kernel to handle the system. On their to-do list are the following items: Port the kernel patches to the latest 2.2 kernel Port the kernel patches to the 2.4.0 kernel Port the utility patches to the latest versions of the base utilities so I'm not even sure we -could- apply their patches, even if we wanted to. -- jacob kuntz [EMAIL PROTECTED] underworld.net/~jake -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: NSA's Secure Linux Distribution
In article <[EMAIL PROTECTED]>, Brent Fulgham <[EMAIL PROTECTED]> wrote: >No doubt most of you have seen the NSA's secure linux posting >on Slashdot this morning. > >Looking at: >http://www.nsa.gov/selinux/docs.html > >there appears to be several utilities that have been updated >to provide enhanced security. Ofcourse it's not just the utilities - they rely on the special NSA Linux kernel. Packaging the NSA versions of the utilities is only useful if Debian was also using the NSA Linux kernel. The NSA Linux kernel is based on 2.2 (while 2.4 is due out soon), it deviates from the standard kernel in a big way, and it is higly experimental. The kernel people are going to look at the NSA kernel, and might merge the security features in 2.6 or 3.0, then again they might not merge them at all. So I guess it's not an issue. Unless you want to start a seperate destribution, based on Debian: Debian/GNU/NSA Linux Mike.
Re: NSA's Secure Linux Distribution
from the secret journal of Brent Fulgham ([EMAIL PROTECTED]): > No doubt most of you have seen the NSA's secure linux posting > on Slashdot this morning. > > Looking at: > http://www.nsa.gov/selinux/docs.html > > there appears to be several utilities that have been updated > to provide enhanced security. > > Should we be merging these patches into Debian, assuming they > appear to be compatible with our policy, etc.? > unless we have a policy against security, it should be fine. :) it's all gpl. -- jacob kuntz [EMAIL PROTECTED] underworld.net/~jake
