5 ms·

>which is arguably better than anything Linux has built-in. No it isn't. There's a reason why government and military servers run hardened Linux with SELinux,

by YATA0 5y ago

>which is arguably better than anything Linux has built-in. No it isn't. There's a reason why government and military servers run hardened Linux with SELinux, and not any of the BSDs.

NexRebular 5y ago
Any source for this statement?
- YATA0 5y ago
  There are no DoD STIGs[0] for the BSDs, meaning they cannot run on military servers. Similarly, there are no CIS guides[1]. What would I know, only designed and implemented TS+ systems for a decade! [0] https://public.cyber.mil/stigs/downloads/ https://public.cyber.mil/stigs/downloads/ [1] https://www.cisecurity.org/ https://www.cisecurity.org/
  - NexRebular 5y ago
    There are a lot of them for Windows... should I then trust that linux is as secure for government use as Microsoft systems are?
    - YATA0 5y ago
      Now you're shifting the goal posts after I provided sources that the US gov does not use BSD. Microsoft Server systems for government use have been audited and have strict controls for implementation, hardening, securing, etc. They're probably more secure than BSD.
      - NexRebular 5y ago
        Yet I see BSD on the STIG list as well. Are there different levels of security for the list items or how does this work if Windows can be said to be more secure than BSD even if both are checkmarked on the audits?
        YATA0 5y ago
        Since you keep editing your comment: Not sure what you mean, but the custom Windows Server that the US government uses is likely more secure than BSD. >Yet I see BSD on the STIG list as well. No you don't. DISA does not provide STIGs for any of the BSDs. The US government does not use the BSDs for secure systems (TS+ etc.).
        NexRebular 5y ago
        Interesting... does that mean that all secure systems are running on Cisco networking? As said, they do have STIGs and CIS documents for JunOS but I guess they don't run any Juniper in the US secure networking despite of having certifications.
        YATA0 5y ago
        >Interesting... does that mean that all secure systems are running on Cisco networking? Now you're strawmaning on top of shifting goal posts again. >As said, they do have STIGs and CIS documents for JunOS No they don't. The CIS documents specifically outline the operating systems they support, and there are ZERO BSDs listed (click on Operating Systems)[0]. Similarly, there are zero STIGs for Junos OS. There are STIGs and CIS benchmarks for Juniper network devices, but not for Junos OS. The actual devices could be running on FreeDOS for all we care, but FreeDOS in and of itself would not be allowed to run on any servers. Hilariously, even Juniper is moving away from BSD. Junos OS Evolved is Linux based. You're fractally wrong. [0] https://www.cisecurity.org/cis-benchmarks/ https://www.cisecurity.org/cis-benchmarks/
    - trasz 5y ago
      It’s not about providing any real security, it’s about ticking checkboxes. So yes, if the checklist says “Linux and Windows are ok” then you can mark the checkbox, and with FreeBSD you couldn’t.
zie 5y ago
I said built-in, you seem to have missed that part. SELinux is not built-in(though it is for certain distributions of Linux). Security is hard to define, let alone prove. Everyone has a very different definition of security. So first one has to ask, secure from what? I imagine most of the reason around BSD not on the official list(s) is because it's not as popular. I mean GenodeOS[0] is arguably one of the most secure OS's around these days, but I doubt you can find any public Govt support(by any govt) for running it in production today. Going back to my original comment, security is complicated, and there is no "secure", but hopefully for a given set of security threats, there is a "secure enough". The same exists in physical security. Our home door locks are notoriously not secure, but they are generally secure enough for most home needs. But your average home door lock would obviously be idiotic as protection for Fort Knox's gold deposit door. Comparing BSD to Linux security is complicated, but for most high value targets, the answer probably is, run more than one OS. Root DNS servers and other highly critical internet infrastructure all do this as a matter of common practice. If you are mono-culture Linux only, I worry for your security, as you are effectively a single zero-day away from being owned. Linux, BSD, Windows, etc will all have RCE's and zero-days as a normal part of existing. 0: formal proof secure(sel4), for some definitions of provable even: https://genode.org/ https://genode.org/
- YATA0 5y ago
  >I said built-in, you seem to have missed that part. I did not miss that part, you're just mistaken. >SELinux is not built-in(though it is for certain distributions of Linux). Wrong. SELinux is 100% "built-in" to Linux. That's like saying btrfs or Wireguard are not "built-in" to Linux because certain distros may or may not have them compiled in. Nonetheless, SELinux is part of the kernel [0]. The rest of your dribble is a painful Gish gallop because you were decisively proven wrong. Mature up a bit and take the L. Fomenting about being proven wrong is against the Guidelines here. [0] https://lore.kernel.org/selinux/ https://lore.kernel.org/selinux/
  - zie 5y ago
    I'm not trying to hate on SELinux, it's great stuff, for what it is. I'm not trying to hate on you either, though clearly you seem to have hatred towards me, which is just sad. I'm happy to accept that SELinux is now built-in to Linux, the kernel parts do indeed seem to be built in now, news to me, thanks for that. I don't follow Linux kernel stuff much anymore, I haven't contributed to Linux in over a decade. You seem to assume SELinux is the end-all be all of Linux security. It isn't. I recognize, based on your other comment, that you are fairly new to the field(a whole decade, go you!). Please open your mind and accept differing perspectives, it will do wonders for your ability to reason about security properly. HardenedBSD[0] essentially implements grsecurity for FreeBSD, plus FreeBSD has built-in capabilities with Capsicum[1], which is true capability based security, which is much different than SELinux's MAC stuff. If you don't believe me, go read the capsicum paper[1] and come to your own conclusions, it might prove enlightening. Also, see CheriBSD. :) 0: https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison 1: https://papers.freebsd.org/2010/rwatson-capsicum/ https://papers.freebsd.org/2010/rwatson-capsicum/ If you just want to continue hating on me, no reason to respond, we can go our separate ways. If you want to have a reasoned discussion about security, then I'm happy to continue.
trasz 5y ago
“Government and military servers” tend to run Windows ;-) SELinux looks nice on paper - another box to check - but it’s just another mitigation later, not something that can be considered “trusted”.
- YATA0 5y ago
  Microsoft Server systems for government use have been audited and have strict controls for implementation, hardening, securing, etc. They're probably more secure than BSD. >SELinux looks nice on paper - another box to check - but it’s just another mitigation later, not something that can be considered “trusted”. This is fractally wrong.
  - deleted 5y ago
    [deleted]

by YATA0 5y ago

>which is arguably better than anything Linux has built-in. No it isn't. There's a reason why government and military servers run hardened Linux with SELinux, and not any of the BSDs.

NexRebular 5y ago

Any source for this statement?

YATA0 5y ago
There are no DoD STIGs[0] for the BSDs, meaning they cannot run on military servers. Similarly, there are no CIS guides[1]. What would I know, only designed and implemented TS+ systems for a decade! [0] https://public.cyber.mil/stigs/downloads/ https://public.cyber.mil/stigs/downloads/ [1] https://www.cisecurity.org/ https://www.cisecurity.org/
- NexRebular 5y ago
  There are a lot of them for Windows... should I then trust that linux is as secure for government use as Microsoft systems are?
  - YATA0 5y ago
    Now you're shifting the goal posts after I provided sources that the US gov does not use BSD. Microsoft Server systems for government use have been audited and have strict controls for implementation, hardening, securing, etc. They're probably more secure than BSD.
    - NexRebular 5y ago
      Yet I see BSD on the STIG list as well. Are there different levels of security for the list items or how does this work if Windows can be said to be more secure than BSD even if both are checkmarked on the audits?
      - YATA0 5y ago
        Since you keep editing your comment: Not sure what you mean, but the custom Windows Server that the US government uses is likely more secure than BSD. >Yet I see BSD on the STIG list as well. No you don't. DISA does not provide STIGs for any of the BSDs. The US government does not use the BSDs for secure systems (TS+ etc.).
        NexRebular 5y ago
        Interesting... does that mean that all secure systems are running on Cisco networking? As said, they do have STIGs and CIS documents for JunOS but I guess they don't run any Juniper in the US secure networking despite of having certifications.
        YATA0 5y ago
        >Interesting... does that mean that all secure systems are running on Cisco networking? Now you're strawmaning on top of shifting goal posts again. >As said, they do have STIGs and CIS documents for JunOS No they don't. The CIS documents specifically outline the operating systems they support, and there are ZERO BSDs listed (click on Operating Systems)[0]. Similarly, there are zero STIGs for Junos OS. There are STIGs and CIS benchmarks for Juniper network devices, but not for Junos OS. The actual devices could be running on FreeDOS for all we care, but FreeDOS in and of itself would not be allowed to run on any servers. Hilariously, even Juniper is moving away from BSD. Junos OS Evolved is Linux based. You're fractally wrong. [0] https://www.cisecurity.org/cis-benchmarks/ https://www.cisecurity.org/cis-benchmarks/
  - trasz 5y ago
    It’s not about providing any real security, it’s about ticking checkboxes. So yes, if the checklist says “Linux and Windows are ok” then you can mark the checkbox, and with FreeBSD you couldn’t.

zie 5y ago

I said built-in, you seem to have missed that part. SELinux is not built-in(though it is for certain distributions of Linux). Security is hard to define, let alone prove. Everyone has a very different definition of security. So first one has to ask, secure from what? I imagine most of the reason around BSD not on the official list(s) is because it's not as popular. I mean GenodeOS[0] is arguably one of the most secure OS's around these days, but I doubt you can find any public Govt support(by any govt) for running it in production today. Going back to my original comment, security is complicated, and there is no "secure", but hopefully for a given set of security threats, there is a "secure enough". The same exists in physical security. Our home door locks are notoriously not secure, but they are generally secure enough for most home needs. But your average home door lock would obviously be idiotic as protection for Fort Knox's gold deposit door. Comparing BSD to Linux security is complicated, but for most high value targets, the answer probably is, run more than one OS. Root DNS servers and other highly critical internet infrastructure all do this as a matter of common practice. If you are mono-culture Linux only, I worry for your security, as you are effectively a single zero-day away from being owned. Linux, BSD, Windows, etc will all have RCE's and zero-days as a normal part of existing. 0: formal proof secure(sel4), for some definitions of provable even: https://genode.org/ https://genode.org/

YATA0 5y ago
>I said built-in, you seem to have missed that part. I did not miss that part, you're just mistaken. >SELinux is not built-in(though it is for certain distributions of Linux). Wrong. SELinux is 100% "built-in" to Linux. That's like saying btrfs or Wireguard are not "built-in" to Linux because certain distros may or may not have them compiled in. Nonetheless, SELinux is part of the kernel [0]. The rest of your dribble is a painful Gish gallop because you were decisively proven wrong. Mature up a bit and take the L. Fomenting about being proven wrong is against the Guidelines here. [0] https://lore.kernel.org/selinux/ https://lore.kernel.org/selinux/
- zie 5y ago
  I'm not trying to hate on SELinux, it's great stuff, for what it is. I'm not trying to hate on you either, though clearly you seem to have hatred towards me, which is just sad. I'm happy to accept that SELinux is now built-in to Linux, the kernel parts do indeed seem to be built in now, news to me, thanks for that. I don't follow Linux kernel stuff much anymore, I haven't contributed to Linux in over a decade. You seem to assume SELinux is the end-all be all of Linux security. It isn't. I recognize, based on your other comment, that you are fairly new to the field(a whole decade, go you!). Please open your mind and accept differing perspectives, it will do wonders for your ability to reason about security properly. HardenedBSD[0] essentially implements grsecurity for FreeBSD, plus FreeBSD has built-in capabilities with Capsicum[1], which is true capability based security, which is much different than SELinux's MAC stuff. If you don't believe me, go read the capsicum paper[1] and come to your own conclusions, it might prove enlightening. Also, see CheriBSD. :) 0: https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison 1: https://papers.freebsd.org/2010/rwatson-capsicum/ https://papers.freebsd.org/2010/rwatson-capsicum/ If you just want to continue hating on me, no reason to respond, we can go our separate ways. If you want to have a reasoned discussion about security, then I'm happy to continue.

trasz 5y ago

“Government and military servers” tend to run Windows ;-) SELinux looks nice on paper - another box to check - but it’s just another mitigation later, not something that can be considered “trusted”.

YATA0 5y ago
Microsoft Server systems for government use have been audited and have strict controls for implementation, hardening, securing, etc. They're probably more secure than BSD. >SELinux looks nice on paper - another box to check - but it’s just another mitigation later, not something that can be considered “trusted”. This is fractally wrong.
- deleted 5y ago
  [deleted]