3 ms·

Some interesting bits of information here, like "connectivity checker", but you have to go a long way down the page before the specific ubuntu stuff crops up --

Some interesting bits of information here, like "connectivity checker", but you have to go a long way down the page before the specific ubuntu stuff crops up -- most of it is the usual enterprise stuff about locking it down so the users can't actually use the computer. They don't think LUKS is good enough for full disk encryption They don't like OpenVPN -- IPSec is the only approved vpn. That led me to https://www.darkwirevpn.com/vpns/ipsec-versus-openvpn/ https://www.darkwirevpn.com/vpns/ipsec-versus-openvpn/ I fully agree with no "curl http://blah http://blah | sudo bash " though. If software is worth deploying, it's worth deploying as a package (deb, snap, container, whatever. Versioned. Repeatable. Signed)

angry_octet 8y ago
IPSec implementations are so complex, I have no faith they are rigorously debugged. I'm quite partial to Wireguard https://www.wireguard.com https://www.wireguard.com. As to the guide overall, it suffers from the typical delusions of enterprise IT, which delivers a castrated platform with marginal security improvements. Users will still suffer XSS from crappy Oracle corporate applications, phishing, buffer overflows etc. But at least they won't be able to use grep! Nasty bash programs!
- viraptor 8y ago
  There's also zerotier https://www.zerotier.com/ https://www.zerotier.com/ if you want something nicer to configure and potentially need to handle double-nat. The implementation is not as minimal, but will pretty good.
  - angry_octet 8y ago
    I really like their Edge devices, particularly the ability to enforce a distributed firewall. However, it really isn't clear to me how their crypto works. They use PK to do something, and traffic is encrypted with a symmetric cipher. How are nodes authenticated to join? It isn't clear from their description. They don't do PFS, it seems like there is no key rollover at all? Maybe I'm just obtuse, but I don't think they have explained it very well.
- viraptor 8y ago
  > Users will still suffer XSS from crappy Oracle corporate applications, phishing, buffer overflows etc. Buffer overflows - the guide mentioned both sandboxing (snap/apparmor) and remote low level data collection (auditd). If you don't trust the app, that's about as much as you can do. Phishing - There's not much the OS can do. 2fa is required on the service itself, but that's not in scope for this doc. XSS - Since you're connecting through a proxy in the recommended networking setup, there's a chance some known endpoints will be blocked. Again, that's in scope for the remote service, not really the OS setup. I think they did a good job of describing what can you do as far as end-user workstations go. You could do some improvements by getting a grsec kernel, but that's not really Ubuntu 18.04 anymore. (I wish they mentioned it as an option though)
  - angry_octet 8y ago
    My point is they are crippling the functionality of the computer to achieve a marginal security improvement. The insecurity largely resides on the applications, which it barely touched on. Snaps are great, but anything that can touch X is a problem. Profiles for AppArmor are tricky to get right. If they want to do confinement then dockerised apps is much more effective than treating the end user as the primary threat to guard against. All the effort to prevent end users running binaries won't stop ROP gadgets or prevent kernel breaks. Adding 2FA for login, decent firewall and container networking rules, and syslog reporting, would be far more useful than their bizarre paranoia about users running scripts. The complaint about LUKS is also bizarre, because the work function for trying one passphrase is enormous by default, and easily configured to be stupendously costly (e.g 30s). Its also quite feasible to boot from a USB key, which has a passphrase wrapped key; when separated from the computer this is very secure. TPM isn't foolproof either, so it comes across as rather ill informed.

angry_octet 8y ago

IPSec implementations are so complex, I have no faith they are rigorously debugged. I'm quite partial to Wireguard https://www.wireguard.com https://www.wireguard.com. As to the guide overall, it suffers from the typical delusions of enterprise IT, which delivers a castrated platform with marginal security improvements. Users will still suffer XSS from crappy Oracle corporate applications, phishing, buffer overflows etc. But at least they won't be able to use grep! Nasty bash programs!

viraptor 8y ago
There's also zerotier https://www.zerotier.com/ https://www.zerotier.com/ if you want something nicer to configure and potentially need to handle double-nat. The implementation is not as minimal, but will pretty good.
- angry_octet 8y ago
  I really like their Edge devices, particularly the ability to enforce a distributed firewall. However, it really isn't clear to me how their crypto works. They use PK to do something, and traffic is encrypted with a symmetric cipher. How are nodes authenticated to join? It isn't clear from their description. They don't do PFS, it seems like there is no key rollover at all? Maybe I'm just obtuse, but I don't think they have explained it very well.
viraptor 8y ago
> Users will still suffer XSS from crappy Oracle corporate applications, phishing, buffer overflows etc. Buffer overflows - the guide mentioned both sandboxing (snap/apparmor) and remote low level data collection (auditd). If you don't trust the app, that's about as much as you can do. Phishing - There's not much the OS can do. 2fa is required on the service itself, but that's not in scope for this doc. XSS - Since you're connecting through a proxy in the recommended networking setup, there's a chance some known endpoints will be blocked. Again, that's in scope for the remote service, not really the OS setup. I think they did a good job of describing what can you do as far as end-user workstations go. You could do some improvements by getting a grsec kernel, but that's not really Ubuntu 18.04 anymore. (I wish they mentioned it as an option though)
- angry_octet 8y ago
  My point is they are crippling the functionality of the computer to achieve a marginal security improvement. The insecurity largely resides on the applications, which it barely touched on. Snaps are great, but anything that can touch X is a problem. Profiles for AppArmor are tricky to get right. If they want to do confinement then dockerised apps is much more effective than treating the end user as the primary threat to guard against. All the effort to prevent end users running binaries won't stop ROP gadgets or prevent kernel breaks. Adding 2FA for login, decent firewall and container networking rules, and syslog reporting, would be far more useful than their bizarre paranoia about users running scripts. The complaint about LUKS is also bizarre, because the work function for trying one passphrase is enormous by default, and easily configured to be stupendously costly (e.g 30s). Its also quite feasible to boot from a USB key, which has a passphrase wrapped key; when separated from the computer this is very secure. TPM isn't foolproof either, so it comes across as rather ill informed.