| IRC log started Thu Dec 13 19:26 |
| Fernand0 | Hello, |
|---|
| Fernand0 | we are happy to have today the talk of Javier Fernández-Sanguino Peña. |
|---|
| Fernand0 | He is a Debian Developer, in charge of several security-related packages, |
|---|
| Fernand0 | and others. He is also actively involved in Spanish-translation of Debian |
|---|
| Fernand0 | packages. |
|---|
| Fernand0 | He is working in Germinus Solutions [http://www.germinus.com, visit them, |
|---|
| Fernand0 | not now LATER ;) ], |
|---|
| Fernand0 | in the security division of the company. |
|---|
| Fernand0 | He is going to talk today about Howto improve security in an open operating |
|---|
| Fernand0 | system: Debian GNU/Linux. |
|---|
| Fernand0 | Thank you for comming here, and specially thanks to Javier for preparing |
|---|
| Fernand0 | this interesting talk for UMEET conference. |
|---|
| Fernand0 | Questions will be in #qc, as usual |
|---|
| Fernand0 | Mr. Fernández-Sanguino... |
|---|
| jfs | Ok. |
|---|
| jfs | Thanks all for coming. |
|---|
| jfs | First off, the conference will be in english |
|---|
| jfs | *unless* all here in the channel are spanish speakers (which I guess is not the case) |
|---|
| jfs | Since questions are at the #qc channel I will be grateful if the people |
|---|
| jfs | make questions as they see fit. |
|---|
| jfs | Also, since the conference/lecture is quite open regarding the theme |
|---|
| jfs | I do not mind people saying what they would like to here. |
|---|
| jfs | I do not have a time limit (but I guess you do) since I'm at the office and we're not closing til late today :) |
|---|
| Fernand0 | in fact, you have }:) |
|---|
| Fernand0 | next conference is in 2:30 ;) |
|---|
| jfs | In any case, just to complement what Fernand0 has just mentioned |
|---|
| jfs | my interest in security in Debian GNU/Linux has grown with my working in the security division area |
|---|
| jfs | (for about a year). |
|---|
| jfs | I am a Debian developer since 1998 so it's also evident that my interest has grown in that |
|---|
| jfs | area for that time. |
|---|
| jfs | I have been working in the last year in order to provide some more security in the Debian project, |
|---|
| jfs | even if not working directly in the Security Team, by providing software that might be useful for security-related purposes. |
|---|
| jfs | In any case, at first I will go through some basic steps on how to harden a Debian GNU/Linux |
|---|
| jfs | I guess that the practical side is the one you will value most. |
|---|
| jfs | And that practical side is documented at the Debian Documentacion Project |
|---|
| jfs | (more specifically at http://www.debian.org/doc/manuals/securing-debian-howto/index.en.html) |
|---|
| jfs | So, feel free to browse through the document during or after the conference. |
|---|
| jfs | So, the question that one would start asking himself is: should I have a bastion host? should I harden my installation? |
|---|
| jfs | The answer is, of course, it depends on what your needs are. |
|---|
| jfs | Your security needs are different if you are just surfing the web at your home |
|---|
| jfs | from what your needs are if you want to setup an server for a government organisation. Ain't it? |
|---|
| jfs | I also warn you that I quite like doing polls on the conference |
|---|
| jfs | (we would use the #qc channel for that). |
|---|
| jfs | First poll: who has hardened a UNIX system before? |
|---|
| Fernand0 | who can say that he ardened it? |
|---|
| Fernand0 | hehe |
|---|
| Fernand0 | maybe sort of |
|---|
| dardhal | me |
|---|
| Fernand0 | or tried would be a correct answer ;) |
|---|
| jfs | (That way I can also see the kind of audience I have here :) |
|---|
| jfs | only two people? Well that out of 40 is quite a surprise (but maybe the others are just sleeping right now :( |
|---|
| Fernand0 | or they are shy ;) |
|---|
| sarnold|g | sleeping .. sorry :( |
|---|
| karina | i did |
|---|
| jfs | In any case, when you have a given system you need to have it hardened |
|---|
| jfs | be it an anonymous attacker, a virus or a malicious program, if a given system is not |
|---|
| jfs | hardened you are bound to have problems in the long run. |
|---|
| viZard | :) |
|---|
| jfs | Even home users, which are being now really being hit hard by many malicious people |
|---|
| jfs | do need to have hardened systems or at least need some kind of protection. |
|---|
| jfs | So, before you begin setting up a server or any given system |
|---|
| jfs | you have to think "what will I use it for?" |
|---|
| jfs | Will I use it for an exposed WWW server? |
|---|
| riel | well, some distros just don't have services running by default ;) |
|---|
| jfs | Will I use it as a shared connection server for my LAN? |
|---|
| jfs | (so that they all use a single router to access the Internet) |
|---|
| jfs | Will I just use it at home for surfing and writting documents/emails? |
|---|
| jfs | Once you know what you are going to use it for you can figure out your potential threats |
|---|
| jfs | the more the threats you have the greater the risks |
|---|
| jfs | So, what does it all have to do with Debian? |
|---|
| jfs | Well, it has do to because one of the most important things that can keep you secure is |
|---|
| jfs | to install only those things that are necessary in your system. |
|---|
| jfs | This means that if I want to use a printer only for myself, I do not put a printer service for everybody in my LAN to use. |
|---|
| jfs | Debian GNU/Linux is great for this. |
|---|
| jfs | I'm not going to talk around issues regarding physical security and the environment |
|---|
| jfs | which are ilustrated in the document through some of the "before you begin steps" |
|---|
| jfs | Now, if you have this ideas clear. Go ahead and install. |
|---|
| jfs | The default installation of Debian (no package selection) |
|---|
| jfs | is quite limited in functionality. There is only one tidbit in Debian 2.2 which you mightw |
|---|
| jfs | want to disable rather quickly if you do not use it: the RPC portmapper (used by the NFS server and other software) |
|---|
| jfs | Even if you have quite a limited number of services running on your machine, and even less listening on the outside for people to come and ask |
|---|
| jfs | You better implement your security policy beforehand in the system. |
|---|
| jfs | This means, that if your users can only do some simple stuff and only connect at specific time frames. |
|---|
| jfs | Implement this restrictions in your system (that is, if you have users that access your systems) |
|---|
| jfs | Debian does ship with full Plugged Autentication Support Modules |
|---|
| jfs | which allow you to configure fully what are the users's limits: core dumps, memory, processes, logins (from where, when) and that kind of stuff |
|---|
| jfs | Customizing this is useful even if you have no users, since you have to consider your running services as also "users of the system" |
|---|
| jfs | What shall we do now? |
|---|
| jfs | Well, install whatever you need for your service. |
|---|
| jfs | There are two issues here regarding Debian that are quite important: |
|---|
| jfs | issue #1: All services installed in Debian are enabled ( *not disabled*) by default |
|---|
| jfs | issue #2: All services in Debian are installed in a "secure by default" manner (to the extent possible) |
|---|
| jfs | There are some exceptions to issue #2 (some services could be hardened better) |
|---|
| jfs | but Debian developers have to find a balance between usability and security. |
|---|
| jfs | That balance is not easy to find however. |
|---|
| jfs | And all security measures can be, of course, improved. |
|---|
| jfs | How? |
|---|
| jfs | Well, you can do this two ways, you can do it the Regulary Way (tm) |
|---|
| jfs | that is, configure your system's services one by one in a thoughtful way. |
|---|
| jfs | Which can be a pain if you do not know how to or you are doing it for many machines. |
|---|
| jfs | Or use an automatic system to do it for you. |
|---|
| jfs | Poll: How many of you here know Bastille (and are listening?)? |
|---|
| Fernand0 | me |
|---|
| riel | I've looked at bastille, but never used it |
|---|
| dardhal | me too |
|---|
| Fernand0 | it disableb my at for users :/ |
|---|
| Fernand0 | hehe |
|---|
| dardhal | I've even tried to translate it to Spanish, but things went wrong |
|---|
| jfs | [It's kind of funny, there's a lot of people (45) here but not very talkative] |
|---|
| jfs | [nobody has questions up to the moment?] |
|---|
| jfs | Well, for those that do not know Bastille (I take silence as a yes) |
|---|
| jfs | Bastille (www.bastille-linux.org) is an automatic system to harden a system |
|---|
| jfs | unlike Titan (www.fish.com/titan) it's intent is to automate the hardening process and |
|---|
| jfs | , at the same time, ilustrate the user/administrator on what bastille will do for him. |
|---|
| jfs | Well, guess what, Bastille is available in Debian. Version 1.2.0 is a patched version (it does not support Debian upstream) |
|---|
| jfs | but from version 1.3.0 Bastille (as provided at sourceforge) will fully support Debian. |
|---|
| jfs | That's one thing I'm quite proud ;) (even if there are some bugs lurking, I fixed some myself today) |
|---|
| jfs | Bastille can automatically setup some security measures (both the user limits I talked about previously and service hardening) automatically |
|---|
| jfs | Now, Bastille may not be able to secure all the services currently and that's what the |
|---|
| jfs | Manual is for, to secure other services too... |
|---|
| jfs | I am currently working on providing some more Debian-speficic tests/checks/features for Bastille (so you should see that improving in the near future) |
|---|
| jfs | In any case, a hardening procedure goes as long as your paranoia goes. |
|---|
| jfs | The prefered method is: install, harden, install, harden, upgrade, test etc... |
|---|
| jfs | What other things can we configure in order to improve our overall security? |
|---|
| jfs | Well, a firewall is a nice thing to have. But's it's better not to depend on it too :) |
|---|
| jfs | Debian GNU/Linux provides different firewall schemes depending on the kernel you are running (since that is, of course, kernel dependant) |
|---|
| jfs | But it also does provide a number of firewall configuration modes the user/admin can choose from. |
|---|
| jfs | Of course, playing with ipchains/netfilter syntax can be a pain. So that's what firewall-easy, easyfirewall, gfcc, mason |
|---|
| jfs | and other cool firewall generators (like firestarter) are there for. |
|---|
| jfs | Also missed knetfilter, BTW. |
|---|
| jfs | This are new to Debian 3.0 (woody, soon to be released) and were not previously in Debian 2.2 |
|---|
| jfs | Now, if you want to add another level of security |
|---|
| jfs | you need to add intrusion detection in your system and logging auditing. |
|---|
| jfs | You can setup two kinds of intrusion detection in a given Debian GNU/Linux system: both network and host IDS. |
|---|
| jfs | Network IDS (which can be setup in the hardened host or on another host) |
|---|
| jfs | can be provided with Snort (the main reference) and other tools like ippl or iplogger |
|---|
| jfs | Host IDS can be provided in many ways. The standard Debian installations provides a simple (but useful) |
|---|
| jfs | mechanism to do a limited host-ids: suid checks (configured at /etc/checksecurity) |
|---|
| jfs | You can also setup, host checks using the 'debsums' package which provides checks for modified binaries installed by Debian packages |
|---|
| jfs | Another package I'm currently working on which can be used for intrusion detection (as well as internal audits) |
|---|
| jfs | is tiger. A kind of old package from the Texas University (the TAMU team IIRC) |
|---|
| jfs | which can check your systems' configuration and look out for suspecting activity. |
|---|
| jfs | The Debian package has been improved to add new debian-specific tests, and I did a quite a cleanup of bugs the last week so it's quite better know :) |
|---|
| Fernand0 | are there any plans to support a security-scripts like in BSDs ? |
|---|
| jfs | If want another layer of security then you can go for upgraded kernels |
|---|
| jfs | can you elaborate more I do not know the BSD security scripts? |
|---|
| Fernand0 | BSD systems have a set of scripts |
|---|
| jfs | Fernand0 asks if there are plans to support a security-scripts like in BSDs |
|---|
| Fernand0 | checking each night about changes of setuid, suspecting activities in the system, and so on |
|---|
| jfs | ? |
|---|
| jfs | I am not very knowledgeable regarding thoses scripts (will have to check though) |
|---|
| Fernand0 | there was a project to adapt them to red hat like distros, but not sure if some problems appeared |
|---|
| Fernand0 | and it was discontinued |
|---|
| jfs | But in any case tiger is, for example, made up of security scripts that can be run on a single report (calling 'tiger') |
|---|
| jfs | or through a given cron job. The cron job can be configured to run different security scripts at different times. |
|---|
| jfs | where can I find them' |
|---|
| Fernand0 | i understand this |
|---|
| Fernand0 | this is the reason i remembered bsd's |
|---|
| Fernand0 | let me check ;) |
|---|
| jfs | For example, you can check all your filesystem each day and check your open ports once an hour. |
|---|
| jfs | Tiger, even if a little out of date in some checks, has quite a flexible framework to work with. |
|---|
| jfs | In any case, I was talking about security in the kernel. |
|---|
| jfs | Debian admin/users do not have to download the patches for themselves and aplly them and go through all the problems that can appear if the patch is not for the same kernel version you want to run... |
|---|
| jfs | Debian developers are working in providing some of the kernel patches so that they can be installed easily in a given Debian system. |
|---|
| jfs | Since Debian has a flexible way to make local kernel packages, user's just have to make use of a new package if they want functionalities like those provided by LIDS, OpenWall and SELinux (currently not available in the distribution although there are some sample packages) |
|---|
| jfs | I read today yesterday's intersting talk regarding the Linux Security Modules |
|---|
| jfs | so when that's ready it would be even easier to install those kernel-related changes. |
|---|
| jfs | Not all security-related patches are yet available, but some already are (and this is also a new feature in Debian 3.0) |
|---|
| jfs | Debian also provides tool to avoid rootkit installations (through the chkrootkit package) |
|---|
| jfs | Any questions up to here? Does someone want to ask for more in depth information? |
|---|
| jfs | ?????? |
|---|
| Fernand0 | all of these packages will be stable enough for woody in time ? |
|---|
| jfs | Fernand0 asks if "all of these packages will be stable enough for woody in time ?" |
|---|
| jfs | Well, many of the packages have been tested by both maintainers and users so they should be stable enough. |
|---|
| jfs | However, help by users in order to debug some bugs still lurking around is very much appreciated (developers have a limited time :)) |
|---|
| jfs | Some of them have been available in the 'testing' area for quite some time. |
|---|
| jfs | In any case, most of the stableness depends on the upstream sources (not debian developers) |
|---|
| Fernand0 | I found it |
|---|
| Fernand0 | http://sourceforge.net/projects/security-script/ |
|---|
| cronos | all the packages mentioned have been available for a while |
|---|
| jfs | Fernand0, thanks, will check. |
|---|
| cronos | what you are saing is that Debian is going to make debs |
|---|
| cronos | of stuff lile tripwire and LIDS ? |
|---|
| jfs | cronos asks if I'm saying that Debian is going to make debs |
|---|
| cronos | i don see how can you make a deb that installs LIDS |
|---|
| jfs | No, I'm saying that Debian already has those debs for quite some time and users have tested and used them during that time. |
|---|
| cronos | or SELinux |
|---|
| jfs | Also, there is an important issue regarding software: it has to "fit in" the system. And Debian packages do fit in the system (or else they should have an important bug report) |
|---|
| jfs | cronos wonders "how can you make a deb that installs LIDS" |
|---|
| cronos | do debian has a LIDS or SELinux deb? |
|---|
| sarnold|g | as both LIDS and SELinux require kernel patches, any .deb would probably be a simple patch file, plus the associated utilities |
|---|
| jfs | well, you do not "install LIDS". |
|---|
| cronos | <jfs> well, you do not "install LIDS" << that is my point |
|---|
| sarnold|g | (and associated manpages, of course :) |
|---|
| jfs | The deb packages that provide LIDS install the kernel patches so you can make the kernel package with lids. |
|---|
| cronos | you have debs for stuff liike tripwire |
|---|
| cronos | and aide |
|---|
| cronos | not the others |
|---|
| jfs | The way that kernel packages works is that it automatically downloads/installs the appropiate kernel sources and patches it so you can have a LIDS enabled kernel |
|---|
| cronos | The deb packages that provide LIDS install the kernel patches so you can |
|---|
| cronos | make the kernel package with lids. |
|---|
| cronos | thats more likely |
|---|
| cronos | thanks |
|---|
| jfs | All this is tested so it works flawlessly. |
|---|
| jfs | LIDS for example (I'm checking the code right now :) |
|---|
| jfs | also provides a way to enable lids on system startup (creating /etc/init.d/lids and handling the SystemV rc links) |
|---|
| jfs | However, Debian could (but does not currently IIRC) provide the kernels themselves already with LIDS, or Openwall or SELinux. However kernel patches are a better aproach (since you can have already a custom kernel and we don't want to break it don't we :) |
|---|
| jfs | cronos says that there are "debs for stuff liike tripwire and aide but not the others" |
|---|
| jfs | cronos, you are right regarding LIDS I might not have explained myself correctly |
|---|
| cronos | jfs i am impress, thanks for sharing that, i did not know trhat debian could do that |
|---|
| cronos | jfs but at least the debian team is moving in the right direction |
|---|
| jfs | well. Check http://packages.debian.org/samhain http://packages.debian.org/integrit |
|---|
| jfs | (samhain is not in testing due to a grave bug not yet solved BTW) |
|---|
| jfs | Well. I was going to talk about audits (if people feel like it :) |
|---|
| jfs | Should I go for it? |
|---|
| jfs | :) |
|---|
| jfs | Well, even if you have a hardened system you want someway to test it. |
|---|
| jfs | In Debian you can currently do both black box audits and white-box audits. |
|---|
| jfs | One of the packages I started with in Debian, quite a lot time ago, is SATAN. |
|---|
| cronos | he he, there has to be silence, the channel si on +m |
|---|
| cronos | but yes,please go ahead : ) |
|---|
| viXard | YES ! |
|---|
| jfs | Yes, granted, SATAN is quite out of date, but it's packaged for Debian (and installs like a breeze, I still remember a book about "security" saying that SATAN was difficult to install and work in Linux :) |
|---|
| cronos | s/si/is |
|---|
| jfs | cronos, well I expected answers in this channel but not all people are signed here :) |
|---|
| jfs | In any case Debian also provides Nessus (www.nessus.org) and up-to-date security assesment scanner with a lot of features. |
|---|
| jfs | Renaud Deraison is doing a really good work with it (quite a number of plugins) |
|---|
| jfs | and it does compete head to head with comercial-closed source scanners |
|---|
| jfs | So you can use a Debian GNU/Linux box to audit your hardened server (but don't use the same box, it's supposed to be used over the network). |
|---|
| jfs | If you want internal audits, you can use tiger, as I mentioned above, for security audits too. |
|---|
| jfs | I could took also on how the Debian Security Team works too, if you like. |
|---|
| jfs | [I was working on providing some statistics for these conference which might be interesting] |
|---|
| jfs | Well, if there are no more questions I will talk a bit on how the security is handled by the Security Team in Debian and finish with those remarks the conference. |
|---|
| viXard | :) |
|---|
| jfs | Ok. The Debian Security Team is the group in charge of handling security issues. It's a separate group so it can act quickly to resolve security issues and a security fix does not have to wait for the upstream author or debian developer to be applied. |
|---|
| jfs | They keep up to date with common places regarding security vulnerabilities, this means Bugtraq (and keeping up to date in Bugtraq is not an easy task) |
|---|
| jfs | and some other "more oscure" sources :) |
|---|
| sarnold|g | hehe |
|---|
| jfs | When a vulnerability is found they test if Debian is vulnerable to it. If so there are two ways to proceed. |
|---|
| jfs | First off, keep in mind that the Debian security team supports the "stable" distribution. The reason being that "unstable" just changes too much and that patches get there faster anyway. |
|---|
| jfs | So the security team first checks if the Debian stable version is vulnerable and if so produce a fix (the upstream might have made it already or it's based on a newer version and needs to be backported) |
|---|
| jfs | When the fix is ready it is tested *in all* architectures. |
|---|
| jfs | (do not forget that Debian supports more than just i386, since it currently works in six architectures IIRC). As a matter of fact Debian 3.0 will be supported in ten IIRC. |
|---|
| jfs | When the tests have been made and the packages have been checked then a DSA (Debian Security Advisory) is sent out to debian-security-announce, bugtraq and other security related lists. |
|---|
| jfs | The packages are available for download at security.debian.org (sorry, no mirrors yet, in order to avoid trojans) |
|---|
| jfs | So how does one keep up to date with security fixes? |
|---|
| jfs | The magic line is......... |
|---|
| jfs | deb http://security.debian.org/ potato/updates main contrib non-free |
|---|
| jfs | (BTW tiger also checks if you do not have your packages up to date checking against the DSAs) |
|---|
| jfs | Also, these security checks are moved on to "proposed-updates" area which is the packages area in Debian stable distribution for packages that are supposed to be upgraded just after an installation. |
|---|
| jfs | This proposed-updates area is also the one that motivates the release of "version" of a stable release. Since the unstable release might get some time to get frozen (sometimes over a year), the ISO images and package sites are updated with these. There have been up to 4 new releases of Debian 2.2 (latest stable) due to new security bugs being found before a new release is finished. |
|---|
| jfs | As to how much time does it take for the Security Team to produce an update that really depends on what the problem is and if a fix is easy to produce/backport. |
|---|
| jfs | But, in any case, many security issues are fixed in less than a week and quite a lot of them are fixed the same day that the information is posted at Bugtraq |
|---|
| jfs | [I was preparing a graphic regarding this but it's difficult to aggregate information from the DSAs and Bugtrags database, that is, it's not easy to automate it, but will post the results somewhere when I'm done] |
|---|
| jfs | Oh, and I forgot to say it. All the security fixes (DSAs) are digitally signed with the key of one of the members of the Security Team. |
|---|
| jfs | Debian does have the ability to sign packages and check signatures upon download but we're not quite there yet (but check the debsigs package in woody :) |
|---|
| jfs | Well, I guess that's more or less all I was thinking on talking about. |
|---|
| sarnold|g | did they finally get the OK from a lawyer type that putting crypto into main is acceptable? |
|---|
| jfs | ummm... yes... but the september 11th issues might have changed the environment a bit.. |
|---|
| jfs | And I hope I have given an overview (even if not too in-depth) regardin Debian GNU/linux security. |
|---|
| jfs | In any case it's time for questions now. So it's your turn to talk :) |
|---|
| jfs | First one: |
|---|
| jfs | sarnoldlg asks "did they finally get the OK from a lawyer type that putting crypto into main is acceptable?" |
|---|
| jfs | Answer: since the law regarding cryptography export did change this year Debian could move crypto into main. |
|---|
| jfs | *However* due to the tragedy of sept 11th it is not clear if there will be a US drawback regarding this issue (there have been quite some movements in the Congress) |
|---|
| c0rEd | translation |
|---|
| c0rEd | en donde |
|---|
| c0rEd | ? |
|---|
| jfs | So, Debian woody will *not* have crypto in main for the moment. It would be a shame to do all the changes needed to the infrastructure for this |
|---|
| jfs | and then change it back again (probably after woody is released) when the law restricts again that kind of exportation. |
|---|
| dani | c0rEd: #redes |
|---|
| jfs | [that's not an official standpoint, is my point of view] |
|---|
| c0rEd | viZard veo logs despues tengo que salir ahora |
|---|
| c0rEd | viZard nos vemos |
|---|
| jfs | More questions? (don't worry if they are in Spanish, I will translate them...) |
|---|
| cronos | jfs thanks, it think this was one of the best so far |
|---|
| cronos | IMHO |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| peter111 | plas pals plas plkas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas |
|---|
| peter111 | plas pals plas plkas plas plas plas plas plas plas |
|---|
| peter111 | plas pals plas plkas plas plas plas plas plas plas |
|---|
| sarnold|g | thank you jfs :) |
|---|
| MJes | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| peter111 | BRAVO¡ BRAVO¡ |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas (se supone que son aplausos) |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | Gracias jfs XD |
|---|
| jfs | you are all welcome. |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| peter111 | plasd plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| jfs | Are there any questions? Any takers? |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | and also for translators! |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJes | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| cronos | a bit? |
|---|
| cronos | i think a lot |
|---|
| jfs | Venga, seguro que alguno tiene alguna pregunta, u os habeis enterado de todo? |
|---|
| MJes | a little! |
|---|
| dardhal | jfs: ¿ la política de seguridad de Debian no habla acerca de "minmun knowledge" ? |
|---|
| cronos | jfs yo tenia una pregunta pero es de el metodo de desconeccion de TCP |
|---|
| dardhal | jfs: es con respecto a los permisos de, por ejemplo, /etc/security/* |
|---|
| cronos | jfs quisieras oirla? |
|---|
| jfs | dardhal asks "doesnt' debian policy talk about minimum knowledge?" |
|---|
| jfs | cronos, no se si podré contestarla :) |
|---|
| jfs | dardhal, yes. |
|---|
| cronos | jfs quisas lo dejamos para otro momento, grx |
|---|
| jfs | dardhal, The Debian filesystem is setup in a "hardened" way. |
|---|
| dardhal | jfs: I was wondering about world-readable files under this directory |
|---|
| jfs | (or at least tries to) |
|---|
| jfs | dardhal, in any case, there is quite a number of things that need to be set according to your own security policy. |
|---|
| dardhal | Wouldn't it be more secure to "hide" those files from everyone but root (knowing what it is on the files could easy an attck, directing it to some accounts, at some times, etc) ? |
|---|
| jfs | In the case of /etc/security I'm not really sure why are they world readable (do not know if something would break if they were not) |
|---|
| jfs | You might be right here, I will have to check that. |
|---|
| jfs | But, in any case, sensible information *is* protected in Debian. |
|---|
| dardhal | jfs: Ok, thanks (check Debian bug #96565) |
|---|
| ToniSB | pero en cualquier caso, la informacion sensible *esta* protegida en debian |
|---|
| ToniSB | ui |
|---|
| ToniSB | perdon ;) |
|---|
| HoraPe | ToniSB: s/sensible/sensitiva/ |
|---|
| jfs | Problem is that in some sites there might be more sensible information that needs to be protected in diffferent ways that in other sites. |
|---|
| zerog | good evening |
|---|
| jfs | For example, some sites might have a security policy that says "no user will know which other users are available in the machine (or using it)" |
|---|
| jfs | Obviously, in order to setup your policy you have to "tune" your system, and Debian cannot expect to be tuned to all the possible environments. |
|---|
| cronos | jfs el directorio es drwxr-xr-x, pero ficheros como group.conf y pam_env.conf son -rw-r--r-- |
|---|
| cronos | no es solo Debian |
|---|
| dardhal | It is clear that every site has different security requirements, but I thought that "minimun knowledge" was a Good Thing (TM) |
|---|
| jfs | In any case, that's a good question, and I will take a look at it (reading bug 96565 maybe the policy needs to be fixed) |
|---|
| jfs | More questions? |
|---|
| cronos | Transendental Meditation ? |
|---|
| cronos | TM? |
|---|
| cronos | <jfs> More questions? <, yes, one request, please join us more often |
|---|
| jfs | Well, its the second time in a row... |
|---|
| MJesus | yes !!! you are right cronos ! |
|---|
| cronos | he |
|---|
| cronos | en serio |
|---|
| jfs | (second year I am at UMEET :) |
|---|
| cronos | colegas, yo me tengo que ir a cortar le~a |
|---|
| cronos | ciao |
|---|
| zerog | au revoir |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| viZard | plas plas plas plas plas plas plas plas |
|---|
| jfs | thanks all for attending. |
|---|
| jfs | Bye. |
|---|
| dardhal | jfs: great job Javier, nice to see you again :) |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plas pklas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas s plas plas plas plas plas plas plas plas plas plas |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plas pklas plas plas plas plas |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plas pklas plas plas plas plas |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plas pklas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas s plas plas plas plas plas plas plas plas plas plas |
|---|
| MJesus | plas plas plas plas plas plas plas plas plas plas plas plas s plas plas plas plas plas plas plas plas plas plas |
|---|
| kikov | se dardhal... |
|---|
| peter111 | OTRA¡ OTRA! OTRA! OTRA! |
|---|
| dardhal | kikov: buenas noches |
|---|
| jfs | buenas noches :) |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plass plaS PLAS PLAS pals plas plaa plas plas plas p,as plas plas plas plas plas plas plas plas |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plass plaS PLAS PLAS pals plas plaa plas plas plas p,as plas plas plas plas plas plas plas plas |
|---|
| peter111 | plas plas plas plas plas plas plas plas plas plas plass plaS PLAS PLAS pals plas plaa plas plas plas p,as plas plas plas plas plas plas plas plas |
|---|
| peter111 | GGGGGRRRRRAAAAAACCCCCCCIIIIIIAAASSSSS |
|---|
| peter111 | +++++!!!!!! |
|---|
| peter111 | ¡¡¡¡¡!!!!! |
|---|
| peter111 | 1 |
|---|
| Eliz | saludos a todos! |
|---|
| Eliz | saludos a todos! |
|---|
| viZard | en algunos 40 minutos la conferencia titulada Aplicaciones en KDE |
|---|
| viZard | dictada por Antonio Larrosa |
|---|
| viZard | no se lo pierdan |
|---|
| viZard | asi aprovecho y le rega~o ya que tengo dos dias instalando KDE2.2.2 |
|---|
| viZard | XD |
|---|
| zerog | jua |
|---|
| zerog | que flojo |
|---|
| viZard | mas tarde (muy tarde para europa) la conferencia titulada "Comercio Electronico" dictada por Daniel Yucra |
|---|
| viZard | es el Qt |
|---|
| zerog | un rpm y no lo puedes instalar? |
|---|
| viZard | lleva mucho compilando |
|---|
| zerog | juaaaaaaaaaaaaaaaaaaaaa |
|---|
| zerog | compilalo en casa |
|---|
| viZard | prestame tu maquinita ;) |
|---|
| zerog | :P~ |
|---|
| zerog | ahi ta, nadie le hace caso |
|---|
| viZard | je |
|---|
| zerog | yo prefiero gnome |
|---|
| zerog | ese kde tra mas vainas que barco de ilegales |
|---|
| viZard | es para la gente de mi casa, a ver si aprenden |
|---|
| pekesan | yo ni uno ni otro |
|---|
| pekesan | xfce |
|---|
| viZard | Ximian? |
|---|
| viZard | hombre, si es para mi mama ! |
|---|
| zerog | bueh, pekesan en mi freebsd solo tengo consola |
|---|
| zerog | que ya de grafiquitos tamos hartos |
|---|
| zerog | los dos OS mejor diseniados son el QNX y el BeOS |
|---|
| zerog | verdadera belleza y buen gusto |
|---|
| zerog | para tu madre? |
|---|
| zerog | no seas criminal |
|---|
| zerog | me refiero al interface gui de ambos os's |
|---|
| zerog | el xp parece un juego de video : ) |
|---|
| viZard | se fue la luuuuuuuuuuuuuuuuuuuuuuuuz/ |
|---|
| zerog | que pais este virgen de la altagracia |
|---|
| pekesan | bueno...mi xfce no esta mal...lo he dejao mu bonito |
|---|
| pekesan | el xp ni lo konozko ni pienso |
|---|
| zerog | uh que silencio |
|---|
| pekesan | los demas estan bien si |
|---|
| pekesan | los dos el qnx y el beos |
|---|
| zerog | pero conoces el QNX? |
|---|
| zerog | bonitos y eficientesw |
|---|
| pekesan | de vista |
|---|
| pekesan | no he trabajado kon el |
|---|
| pekesan | pero he visto escritorios |
|---|
| zerog | lo malo del qnx es que no es smp |
|---|
| zerog | y el beos lo compro la palm |
|---|
| pekesan | eso es bastante malo |
|---|
| zerog | asi que no se sabe que ira a pasar |
|---|
| zerog | yep |
|---|
| zerog | ya casi me muero con la compra y venta del procesador alpha |
|---|
| zerog1 | pos yo casi me muero con la venta del alpha |
|---|
| pekesan | por? |
|---|
| zerog1 | lo que significo su muerte |
|---|
| zerog1 | para mi, el mejor procesador ever built, y que me excuse el aleman de ayer con su mips |
|---|
| pekesan | yo es ke alphas no los he visto ni en photo |
|---|
| zerog1 | ah |
|---|
| pekesan | yo estuide mips |
|---|
| pekesan | me diverti bastante estudiando teoria sobre MIPS |
|---|
| zerog1 | lo que pasa e s que alpha era una empresa independiente |
|---|
