4 ms·
Most of the ideas are good but I think you need a pretty big team to sustain your systems if you're flipping all the security switches to non-default values. I
by xyzzy123 6y ago
Most of the ideas are good but I think you need a pretty big team to sustain your systems if you're flipping all the security switches to non-default values.
It would be fine as a one-time activity but it creates an ongoing stream of work to deal with breakages, particularly during upgrades.
Your OS ends up in a configuration that no upstream devs have tested compatibility for and you end up shouldering that for each component of your workload.
The recommended security options (given you have opted to tweak all the things) change over time as well and that creates additional work.
I think for many (most?) teams choosing a minimalist OS where an upstream does this kind of maintenance (say COOS or BottleRocket in container world) will produce better real-world results.
- randmeerkat 6y agoOr just use FreeBSD if you really care about secure by default.
- jmnicolas 6y agoAccording to the author: > Despite popular belief, OpenBSD's security is actually lacking in a lot of ways. https://madaidans-insecurities.github.io/openbsd.html https://madaidans-insecurities.github.io/openbsd.html It's probably not better on FreeBSD.
- andi999 6y agoI did this, and 1 month later got bad emails about shutting down the server because of ntp vulnerability. Maybe it was just a new vulnerability found at that time, but then this brings me to the missing item of the text: how to keep up? What pages tell you about new found vulnerabilities, so you can mitigate.
- randmeerkat 6y agoThere’s a few resources listed here: https://www.freebsd.org/doc/handbook/security-advisories.html https://www.freebsd.org/doc/handbook/security-advisories.htm...
- andi999 6y agoThanks. I am always puzzled why linux on server is more popular than BSD.
- unixhero 6y agoIsn't that OpenBSD?