Re: [vox-tech] Re: OpenBSD and Security

["Adam Getchell" <acgetchell@ucdavis.MAPSedu>]

> I don't see how this is true.  Openbsd has the same security problems
> in sendmail, named, openssh, ftpd that the rest of the distributions
> have.  Either they don't do line by line security audits of PORTS

As I mentioned in my last message, sendmail and OpenSSH are audited parts of
OpenBSD. Also, I think that ipf is better than ipchains for firewalling.

> or they miss the security holes just like the rest of the world.  Line
> by line audits help, are hardly foolproof, and many people do them.

OpenBSD has been source code audited since the summer of 1996, patching
basic software bugs and security flaws as a byproduct. Often, security
exploits in Linux reported in BugTRAQ have been fixed months earlier in
OpenBSD.

> Openbsd has something like 25 security problems with 2.7:
> http://www.openbsd.com/errata27.html

RedHat 7.0 has 42:
http://www.redhat.com/support/errata/rh7-errata-security.html

OpenBSD 2.8 has 12, and they're all fixed if you follow the patch branch:
http://www.openbsd.org/security.html

Granted, you could use RedHat update agent, but it crashes on me and I don't
like paying monthly subscription fees.

> Of those I know who take an interest in such things, they install whatever
> OS they choose, install the latest patches, turn off ALL network services,
> turn on ssh, THEN put the machine on the net.  Then they start installing/
> configuring the functionality they need, making sure it's 100% up to
> date (often distributions use slightly old versions), configuring it
> for maximum security, make sure it runs as a user with minimum privileges
> etc.

The workflow on OpenBSD is much easier: install, install patches, configure
functionality. You don't have to turn off networking services because
they're not on by default. SSH is already configured. You get an email of
your file permissions and the changes that were made to secure the system --
really, have you installed OpenBSD to compare it with a Linux installation?

> Then they take proactive measures, monitoring file checksums, tracking
> access logs, analyzing network traffic etc.

This is already setup in OpenBSD. When a file changes, root gets an e-mail
about it. Under Linux, I had to install logcheck to get similiar
functionality.

> Redhat provides MD5 checksums and CryptoSigned packages to help insure the
> integrity of a system package or binary, not that other OS's/distributions
> don't.

Cryptography is integrated throughout OpenBSD. Under Linux, I had to install
tripwire.

Anyways, to each their own.

> Bill

--Adam