Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5019 > unrolled thread

Security features in the upcoming release (Stretch)

Started by"m.largo@t-online.de" <m.largo@t-online.de>
First post2016-09-23 15:30 +0200
Last post2016-09-27 10:40 +0200
Articles 8 — 7 participants

Back to article view | Back to linux.debian.security

Contents

  Security features in the upcoming release (Stretch) "m.largo@t-online.de" <m.largo@t-online.de> - 2016-09-23 15:30 +0200
    Re: Security features in the upcoming release (Stretch) "Jonathan Hutchins" <hutchins@tarcanfel.org> - 2016-09-23 16:00 +0200
      Re: Security features in the upcoming release (Stretch) Reed Black <reed@unsafeword.org> - 2016-09-23 19:50 +0200
        Re: Security features in the upcoming release (Stretch) Richard Owlett <rowlett@cloud85.net> - 2016-09-23 22:10 +0200
          Re: Security features in the upcoming release (Stretch) stefano frabetti <stefano.frabetti@gmail.com> - 2016-09-24 03:50 +0200
            Re: Security features in the upcoming release (Stretch) Darko Gavrilovic <d.gavrilovic+debian@gmail.com> - 2016-09-24 04:50 +0200
              Re: Security features in the upcoming release (Stretch) Richard Owlett <rowlett@cloud85.net> - 2016-09-24 15:10 +0200
    Re: Security features in the upcoming release (Stretch) Russell Coker <russell@coker.com.au> - 2016-09-27 10:40 +0200

#5019 — Security features in the upcoming release (Stretch)

From"m.largo@t-online.de" <m.largo@t-online.de>
Date2016-09-23 15:30 +0200
SubjectSecurity features in the upcoming release (Stretch)
Message-ID<skyIa-4aO-23@gated-at.bofh.it>
Hi everybody,
is there already some evidence about security improvements in the upcoming Debian release? I took a look at the security feature page in the Wiki [1] but Stretch is not listed there. Furthermore, the list is not as complete as the list of Fedora [2]. Is there somebody with an insight into the actual state of security in Debian willing to complete this list? Or are not as many security features implemented as in Fedora?

Secondly, what is about the policies for SELinux and Apparmor? Will there be working SELinux policies (like in RHEL or Fedora) with Stretch which work out of the box (like in RHEL or Fedora) on a desktop system?

Finally, which of the new kernel security features (since the release of Jessie) will be enforced in Stretch? Are there plans to migrate some kernel hardening from PaX to Debian Stretch? 

Generally, it would be nice to find more information about proactive security measures which are provided by Debian. For me as a user and admin, it is very difficult to assess the level of proactive security in Debian in comparison to other major distros like Fedora or RHEL / CentOS. Therefore, I think it would be great if the wiki page can be expanded.

Thank you very much for your answers in advance and also if there is somebody who is able to complete the wiki page.

Yours, 
Maximilian

Hyperlinks
------------------------------
[1] https://wiki.debian.org/Security/Features
[2] https://fedoraproject.org/wiki/Security_Features_Matrix





----------------------------------------------------------------
Gesendet mit Telekom Mail <https://t-online.de/email-kostenlos> - kostenlos und sicher für alle!

[toc] | [next] | [standalone]

#5021

From"Jonathan Hutchins" <hutchins@tarcanfel.org>
Date2016-09-23 16:00 +0200
Message-ID<skzbc-4lr-47@gated-at.bofh.it>
In reply to#5019
It is difficult for me to rationalize a serious concern for "security"
with the idea that one should lie back and expect the packaging team to
take care of it all for you.  If you are concerned with security, you
should be actively configuring security features yourself, not expecting
that someone else has the same priorities that you do.

[toc] | [prev] | [next] | [standalone]

#5022

FromReed Black <reed@unsafeword.org>
Date2016-09-23 19:50 +0200
Message-ID<skCLM-6RK-19@gated-at.bofh.it>
In reply to#5021

[Multipart message — attachments visible in raw view] — view raw

On Fri, Sep 23, 2016 at 6:42 AM, Jonathan Hutchins <hutchins@tarcanfel.org>
wrote:

> It is difficult for me to rationalize a serious concern for "security"
> with the idea that one should lie back and expect the packaging team to
> take care of it all for you.  If you are concerned with security, you
> should be actively configuring security features yourself, not expecting
> that someone else has the same priorities that you do.
>

Advance notice of what's landing helps an engineer know what to focus on,
and where work would be duplicated. Resources are finite. That includes
time. Not everything needs to be done in house in order to be "serious."

[toc] | [prev] | [next] | [standalone]

#5023

FromRichard Owlett <rowlett@cloud85.net>
Date2016-09-23 22:10 +0200
Message-ID<skEXf-8mF-19@gated-at.bofh.it>
In reply to#5022
On 9/23/2016 12:42 PM, Reed Black wrote:
> On Fri, Sep 23, 2016 at 6:42 AM, Jonathan Hutchins
> <hutchins@tarcanfel.org <mailto:hutchins@tarcanfel.org>> wrote:
>
>     It is difficult for me to rationalize a serious concern for
>     "security"
>     with the idea that one should lie back and expect the
>     packaging team to
>     take care of it all for you.  If you are concerned with
>     security, you
>     should be actively configuring security features yourself,
>     not expecting
>     that someone else has the same priorities that you do.
>
>
> Advance notice of what's landing helps an engineer know what to
> focus on, and where work would be duplicated. Resources are
> finite. That includes time. Not everything needs to be done in
> house in order to be "serious."
>

I'll take it one step further.
Mr. Hutchins never responded to questions raised by Mr. Largo.
Mr. Hutchins may have multiple PhD's in "Internet Security" with 
decades of experience.
*I DO NOT*
I am actually an "END USER". I've been told I am an 
"administrator" *SOLELY* because I'm the ultimate authority of 
the multiple systems residing on my table top .

Mr. Largo has evidently done his "homework".
He, and those like me, deserve a polite/germane/relevant response.

[toc] | [prev] | [next] | [standalone]

#5024

Fromstefano frabetti <stefano.frabetti@gmail.com>
Date2016-09-24 03:50 +0200
Message-ID<skKgh-32I-1@gated-at.bofh.it>
In reply to#5023
> He, and those like me, deserve a polite/germane/relevant response.

Bravo!  +1

[toc] | [prev] | [next] | [standalone]

#5025

FromDarko Gavrilovic <d.gavrilovic+debian@gmail.com>
Date2016-09-24 04:50 +0200
Message-ID<skLcl-3JF-1@gated-at.bofh.it>
In reply to#5024
I think there is an Apparmor progress page, no?

https://wiki.debian.org/AppArmor/Progress

Just wondering, if you like Fedora/RH SELinux & AppArmor
implementation better, then why not just stick to deploying them?

On Fri, Sep 23, 2016 at 9:49 PM, stefano frabetti
<stefano.frabetti@gmail.com> wrote:
>> He, and those like me, deserve a polite/germane/relevant response.
>
> Bravo!  +1
>

[toc] | [prev] | [next] | [standalone]

#5026

FromRichard Owlett <rowlett@cloud85.net>
Date2016-09-24 15:10 +0200
Message-ID<skUSl-1nH-5@gated-at.bofh.it>
In reply to#5025
On 9/23/2016 9:44 PM, Darko Gavrilovic wrote:
> I think there is an Apparmor progress page, no?
>
> https://wiki.debian.org/AppArmor/Progress

Quoting above page:
"AppArmor/Progress (last edited 2015-08-14 09:33:50 ..."  :<



>
> Just wondering, if you like Fedora/RH SELinux & AppArmor
> implementation better, then why not just stick to deploying them?

I read the OP being in the position of wanting to use Debian but 
choice was being made more dificult by lack of information. YMMV

>
> On Fri, Sep 23, 2016 at 9:49 PM, stefano frabetti
> <stefano.frabetti@gmail.com> wrote:
>>> He, and those like me, deserve a polite/germane/relevant response.
>>
>> Bravo!  +1
>>
>
>

[toc] | [prev] | [next] | [standalone]

#5027

FromRussell Coker <russell@coker.com.au>
Date2016-09-27 10:40 +0200
Message-ID<slW5H-7dN-5@gated-at.bofh.it>
In reply to#5019
My plan is to have the KDE and GNOME desktop environments working with SE Linux enforcing mode on Stretch along with the most important apps such as Google Chrome/Chromium.

I hope to have something ready to test in Unstable in a few weeks.

On 23 September 2016 11:21:55 pm AEST, "m.largo@t-online.de" <m.largo@t-online.de> wrote:
>Hi everybody,
>is there already some evidence about security improvements in the
>upcoming Debian release? I took a look at the security feature page in
>the Wiki [1] but Stretch is not listed there. Furthermore, the list is
>not as complete as the list of Fedora [2]. Is there somebody with an
>insight into the actual state of security in Debian willing to complete
>this list? Or are not as many security features implemented as in
>Fedora?
>
>Secondly, what is about the policies for SELinux and Apparmor? Will
>there be working SELinux policies (like in RHEL or Fedora) with Stretch
>which work out of the box (like in RHEL or Fedora) on a desktop system?
>
>Finally, which of the new kernel security features (since the release
>of Jessie) will be enforced in Stretch? Are there plans to migrate some
>kernel hardening from PaX to Debian Stretch? 
>
>Generally, it would be nice to find more information about proactive
>security measures which are provided by Debian. For me as a user and
>admin, it is very difficult to assess the level of proactive security
>in Debian in comparison to other major distros like Fedora or RHEL /
>CentOS. Therefore, I think it would be great if the wiki page can be
>expanded.
>
>Thank you very much for your answers in advance and also if there is
>somebody who is able to complete the wiki page.
>
>Yours, 
>Maximilian
>
>Hyperlinks
>------------------------------
>[1] https://wiki.debian.org/Security/Features
>[2] https://fedoraproject.org/wiki/Security_Features_Matrix
>
>
>
>
>
>----------------------------------------------------------------
>Gesendet mit Telekom Mail <https://t-online.de/email-kostenlos> -
>kostenlos und sicher für alle!

-- 
Sent from my Nexus 6P with K-9 Mail.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web