SecurityinDebian详解.PDF

Security in Debian Foodfor thought andfor discussion /˜ jfs/debconf/security/ ´ ˜ Javier Fernandez-Sanguino Pena jfs@ Debconf3 - Oslo - 19th july 2003 – p.1/20 Security in Debian: a discussion Main Goal: spark some discussion of the Debian GNU/Linux status from a security point of view. Secondary Goals: share some personal views on where are we heading. prompt for action in some areas Personal Goals: CC certification (EAL4?) Easy setup (Knoppix-like) of security-related servers (NIDS, VA..) Debconf3 - Oslo - 19th july 2003 – p.2/20 Security in Debian: Avoiding issues /ecol-79-e.png Debconf3 - Oslo - 19th july 2003 – p.3/20 Security in Debian: The Good Things The Security Team is doing an excellent work at keeping stable free of security bugs. Mean time for the team to upload a new package fixing a security vulnerability published on Bugtraq is 7 days. Security vulnerabilities are fixed for all our (11) supported architectures at the same time (well, most of the time..) Debconf3 - Oslo - 19th july 2003 – p.4/20 Security in Debian: The Good Things Debian provides much more security-related tools than any other operating system. Some white-hat (protection) tools: intrusion detection systems, integrity checkers, forensics tools, firewall wrappers, log analysis, encryption... Some grey-hat (attack) tools: vulnerability assesm