5 ms·

So here's something I've always wondered. If you use linux as a desktop/workstation in enterprise, how do you deploy it securely ? Other than chromeos, I don't

So here's something I've always wondered. If you use linux as a desktop/workstation in enterprise, how do you deploy it securely ? Other than chromeos, I don't see any other distro trying to tackle this. With all traditional distros, you'll likely need to give the user sudo on their machine to be productive (for eg., installing packages). However, all bets are off once you do that. You can restrict sudo to certain programs, but that also isn't very practical (for eg., sudo for yum is basically sudo for the whole system since you can install arbitrary packages). You can create a chromeos like system, but is there no interest in it ? There are some developments like fedora silverblue and nixos, but how is it that this has gone unsolved till now ?

gerdesj 8y ago
"you'll likely need to give the user sudo on their machine" - no we have sysadmins and application management systems to obviate that. If a user needs an app then they ring up the helldesk and get added to a group (after authorisation), which causes the app to appear.
- bubblethink 8y ago
  >If a user needs an app then they ring up the helldesk That seems very inefficient and friction prone. We have stuff like the nix package manager that can install stuff locally without sudo. It also has other nice features from what I've read. What I'm saying is that we need general purpose distros where you don't need sudo to use them.
  - gerdesj 8y ago
    "That seems very inefficient and friction prone" That's the way its done in general: User makes request, request is approved, action. I was noting that a Linux system does not get in the way of that work flow by being a Linux system. If the box belongs to a company then the company gets to decide what is on it. If the box belongs to the end user then obviously root rights are in order. However, my wife never gets to use anything requiring root rights on her Arch Linux laptop and does not care and would not know what it is anyway. I keep her laptop functioning effectively by watching disc space and other metrics and regularly patching/updating it for her.
  - romeisendcoming 8y ago
    Interesting you bring this up. Regardless of the provenance of packages and facility for installation you seem to be hinting that there should be a method to install specific service/feature sets to a system securely and without systems access. I designed such a system which runs with appropriate permissions to a task, is modular, and accomplishes the provisioning via 'job' files submitted to a service endpoint. A user could describe the software they want installed. The SA performs due diligence on vetting software and designs a standard install module then generates a skeleton jobfile and provides it to the requesting user to fill in necessary details and submit. Wash , rinse, repeat.
- PinkMilkshake 8y ago
  I'm sure this is possible in some places but in others it would be completely impractical. At a university, specifically in the STEM faculties, not giving users sudo/admin would create an endless workload for IT. We end up being nothing more than professional software installers.
  - pjmlp 8y ago
    Depends on how much one cares about security. On my university we still had real UNIX servers, no way IT could allow for everyone installing what they felt like. And the local PCs with Slackware/RedHat would get booted via tftp.
tempfs 8y ago
You run your own Software repo(s) on site and you only allow software to appear in that repo that you trust. You use applications like puppet to automate installations from your repos. LDAP can store users,groups and attributes that can be used into determining which groups get what software baselines. Not really all that different from what goes on in the Microsoft world with WSUS/Appstores/etc. Just the implementation is different and much more customizable.
- bubblethink 8y ago
  So the agent still needs to hook into something with elevated privileges to install packages, just that instead of having granular control in the package manager, it has moved to server side with an RBAC/HBAC tie-in. I agree that it solves practical issues, but it would be nice to not have privileged access at all. Also, doesn't it create friction if you don't have a package in your repos ?
  - Spivak 8y ago
    I mean 'your repos' typically are a superset of what's available in your distro's repos so it's fairly rare for someone to complain that software isn't available.
zingermc 8y ago
You could easily make a root-privileged daemon that listens for requests to install packages from users in a particular group.
- naniwaduni 8y ago
  You'd need to vet the packages you install, because otherwise you can install a package which executes arbitrary code during installation.
- gerdesj 8y ago
  Puppet, Chef etc
bobbob1921 8y ago
Any reasonably secure windows systems have restricted user accounts that do not allow app installs. (I'm talking ofcourse in a corporate environment) The help desk / it call for any app install approvals is common in my experience
peterwwillis 8y ago
For installing/using Linux applications without root access, use Docker containers. For security, use rootless containers. Most major graphical apps have a Dockerfile now.
gcb0 8y ago
that's literary redhat, Ubuntu, suse, etc... they all have enterprise support and onprem repos

gerdesj 8y ago

"you'll likely need to give the user sudo on their machine" - no we have sysadmins and application management systems to obviate that. If a user needs an app then they ring up the helldesk and get added to a group (after authorisation), which causes the app to appear.

bubblethink 8y ago
>If a user needs an app then they ring up the helldesk That seems very inefficient and friction prone. We have stuff like the nix package manager that can install stuff locally without sudo. It also has other nice features from what I've read. What I'm saying is that we need general purpose distros where you don't need sudo to use them.
- gerdesj 8y ago
  "That seems very inefficient and friction prone" That's the way its done in general: User makes request, request is approved, action. I was noting that a Linux system does not get in the way of that work flow by being a Linux system. If the box belongs to a company then the company gets to decide what is on it. If the box belongs to the end user then obviously root rights are in order. However, my wife never gets to use anything requiring root rights on her Arch Linux laptop and does not care and would not know what it is anyway. I keep her laptop functioning effectively by watching disc space and other metrics and regularly patching/updating it for her.
- romeisendcoming 8y ago
  Interesting you bring this up. Regardless of the provenance of packages and facility for installation you seem to be hinting that there should be a method to install specific service/feature sets to a system securely and without systems access. I designed such a system which runs with appropriate permissions to a task, is modular, and accomplishes the provisioning via 'job' files submitted to a service endpoint. A user could describe the software they want installed. The SA performs due diligence on vetting software and designs a standard install module then generates a skeleton jobfile and provides it to the requesting user to fill in necessary details and submit. Wash , rinse, repeat.
PinkMilkshake 8y ago
I'm sure this is possible in some places but in others it would be completely impractical. At a university, specifically in the STEM faculties, not giving users sudo/admin would create an endless workload for IT. We end up being nothing more than professional software installers.
- pjmlp 8y ago
  Depends on how much one cares about security. On my university we still had real UNIX servers, no way IT could allow for everyone installing what they felt like. And the local PCs with Slackware/RedHat would get booted via tftp.

tempfs 8y ago

You run your own Software repo(s) on site and you only allow software to appear in that repo that you trust. You use applications like puppet to automate installations from your repos. LDAP can store users,groups and attributes that can be used into determining which groups get what software baselines. Not really all that different from what goes on in the Microsoft world with WSUS/Appstores/etc. Just the implementation is different and much more customizable.

bubblethink 8y ago
So the agent still needs to hook into something with elevated privileges to install packages, just that instead of having granular control in the package manager, it has moved to server side with an RBAC/HBAC tie-in. I agree that it solves practical issues, but it would be nice to not have privileged access at all. Also, doesn't it create friction if you don't have a package in your repos ?
- Spivak 8y ago
  I mean 'your repos' typically are a superset of what's available in your distro's repos so it's fairly rare for someone to complain that software isn't available.

zingermc 8y ago

You could easily make a root-privileged daemon that listens for requests to install packages from users in a particular group.

naniwaduni 8y ago
You'd need to vet the packages you install, because otherwise you can install a package which executes arbitrary code during installation.
gerdesj 8y ago
Puppet, Chef etc

bobbob1921 8y ago

Any reasonably secure windows systems have restricted user accounts that do not allow app installs. (I'm talking ofcourse in a corporate environment) The help desk / it call for any app install approvals is common in my experience

peterwwillis 8y ago

For installing/using Linux applications without root access, use Docker containers. For security, use rootless containers. Most major graphical apps have a Dockerfile now.

gcb0 8y ago

that's literary redhat, Ubuntu, suse, etc... they all have enterprise support and onprem repos