3 ms·

A big note to add: if you want a secure system, forget Ubuntu entirely and go with CentOS or RHEL with SELinux enabled and locked down correctly. It's as damn

by meaty 14y ago

A big note to add: if you want a secure system, forget Ubuntu entirely and go with CentOS or RHEL with SELinux enabled and locked down correctly. It's as damn near bullet proof as you can get.

jiggy2011 14y ago
Perhaps, though I am more familiar with Ubuntu/Debian as I have used it extensively on the desktop. This means I am more confident in the implications of my actions and also have more consistent dev/deploy platforms.
- tesmar2 14y ago
  It is worth switching, in my opinion, because of all the man-hours put into securing RHEL. The systems aren't THAT different and if you are pretty linux saavy already, I'd guess that you could have an understanding of the differences learned in ~6 weeks.
fulafel 14y ago
selinux can be a help but still very far from bulletproof. it's a type of bandaid. It was created by NSA so naturally they promote it.
- pilom 14y ago
  SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by default now is indeed a band-aid. However, when developers and system admins understand how to create correct and secure SElinux policies, it does indeed approach bulletproof. With SELinux root can build systems which are so secure that root himself cannot hack them.
  - zurn 14y ago
    > With SELinux root can build systems which are so secure that root himself cannot hack them. Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :) See eg. http://grsecurity.net/~spender/exploits/exploit2.txt http://grsecurity.net/~spender/exploits/exploit2.txt
    - meaty 14y ago
      The exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly... So it technically would extinguish itself there and then. It works on the principle of least privilege so you start with nothing and add what the process needs.
      - icelancer 14y ago
        No True SELinuxman, I see

by meaty 14y ago

A big note to add: if you want a secure system, forget Ubuntu entirely and go with CentOS or RHEL with SELinux enabled and locked down correctly. It's as damn near bullet proof as you can get.

jiggy2011 14y ago

Perhaps, though I am more familiar with Ubuntu/Debian as I have used it extensively on the desktop. This means I am more confident in the implications of my actions and also have more consistent dev/deploy platforms.

tesmar2 14y ago
It is worth switching, in my opinion, because of all the man-hours put into securing RHEL. The systems aren't THAT different and if you are pretty linux saavy already, I'd guess that you could have an understanding of the differences learned in ~6 weeks.

fulafel 14y ago

selinux can be a help but still very far from bulletproof. it's a type of bandaid. It was created by NSA so naturally they promote it.

pilom 14y ago
SELinux itself is a tool for Mandatory Access Control. As it is a tool, it needs to be used correctly. The SELinux policy which is deployed on most OS's by default now is indeed a band-aid. However, when developers and system admins understand how to create correct and secure SElinux policies, it does indeed approach bulletproof. With SELinux root can build systems which are so secure that root himself cannot hack them.
- zurn 14y ago
  > With SELinux root can build systems which are so secure that root himself cannot hack them. Sounds like your administrator would be well served to spend more time studying real-world vulnerabilities and less time focusing on SELinux :) See eg. http://grsecurity.net/~spender/exploits/exploit2.txt http://grsecurity.net/~spender/exploits/exploit2.txt
  - meaty 14y ago
    The exploiting process wouldn't have access to /dev/net/tun if SELinux was configured properly... So it technically would extinguish itself there and then. It works on the principle of least privilege so you start with nothing and add what the process needs.
    - icelancer 14y ago
      No True SELinuxman, I see