Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #268597

Re: making Debian secure by default

Path csiph.com!weretis.net!feeder6.news.weretis.net!feeder8.news.weretis.net!fu-berlin.de!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From Lee <ler762@gmail.com>
Newsgroups linux.debian.user
Subject Re: making Debian secure by default
Date Thu, 28 Mar 2024 19:10:01 +0100
Message-ID <In2ml-2kVP-3@gated-at.bofh.it> (permalink)
References <ImJa1-27aa-1@gated-at.bofh.it> <ImKz7-28aw-1@gated-at.bofh.it> <ImPyN-2bh9-3@gated-at.bofh.it> <ImY94-2heG-5@gated-at.bofh.it> <ImZRv-2iJ8-1@gated-at.bofh.it>
X-Original-To debian-user@lists.debian.org
X-Mailbox-Line From debian-user-request@lists.debian.org Thu Mar 28 18:02:57 2024
Old-Return-Path <ler762@gmail.com>
X-Amavis-Spam-Status No, score=-6.949 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
X-Policyd-Weight using cached result; rate: -5.5
X-Gm-Message-State AOJu0YxkmxwjizhbNTLfn6veYzw4iqQBPSfnEy4fRrvIX/FS5PAuWZ5c sFJAZwB1Z2Qx9yVzbRUnkPRsbQZPSVxn98SSKBvUXvs366d+jVOLiL5l2xnJPL9hkm7wWoc4vHl RcLqsb5cSDjb303Sqd6aRm+vuDrYL/i3axFAYzQ==
X-Google-SMTP-Source AGHT+IE/mA83woD837TX8YFXIklE1zsx6nrBpJTw3L+HetC3Z6aNpnF18Od0gAc/bFgaTpILnv/uKqAZhJYN0qnrg4s=
X-Received by 2002:a6b:e614:0:b0:7d0:6295:fc3b with SMTP id g20-20020a6be614000000b007d06295fc3bmr4494355ioh.9.1711648953138; Thu, 28 Mar 2024 11:02:33 -0700 (PDT)
MIME-Version 1.0
Content-Type text/plain; charset="UTF-8"
Content-Transfer-Encoding quoted-printable
X-Mailing-List <debian-user@lists.debian.org> archive/latest/810553
List-ID <debian-user.lists.debian.org>
List-URL <https://lists.debian.org/debian-user/>
List-Archive https://lists.debian.org/msgid-search/CAD8GWsvr0BQykcq-m9fQoHFi05FTWkSFH=HZykM0t91CxQu-rA@mail.gmail.com
Approved robomod@news.nic.it
Lines 49
Organization linux.* mail to news gateway
Sender robomod@news.nic.it
X-Original-Date Thu, 28 Mar 2024 14:02:20 -0400
X-Original-Message-ID <CAD8GWsvr0BQykcq-m9fQoHFi05FTWkSFH=HZykM0t91CxQu-rA@mail.gmail.com>
X-Original-References <CAD8GWssBoRrCzW0TSUGxMeuY=y_bTM-nMuSO7_4g1Kyk79fgqQ@mail.gmail.com> <ZgSljhflfCtsnnCq@mail.bitfolk.com> <CAD8GWsswLPH327tvj64HkWuMfayXczJyyviSk9Um2CAHHjoovg@mail.gmail.com> <ZgVw+HFmMseszOcm@mail.bitfolk.com> <ZgWLmLCjcOTqhk2a@wooledge.org>
Xref csiph.com linux.debian.user:268597

Show key headers only | View raw

On Thu, Mar 28, 2024 at 11:24 AM Greg Wooledge  wrote:
>
> On Thu, Mar 28, 2024 at 01:30:32PM +0000, Andy Smith wrote:
> > I'm just not sure that you'll find any "hardening" guide that will
> > specifically say "disable writing to your terminal as there might be
> > a bug in a binary that is setgid tty" before yesterday's reveal that
> > there is such a bug in "wall".
> >
> > The more general advice to audit every setuid/setgid binary is more
> > likely to be present.
> [...]
> > If the maintainer of util-linux doesn't agree, then the next thing
> > I'd try is a bug against the Debian Administrator's Handbook:
> >
> >     https://www.debian.org/doc/manuals/debian-handbook/
> >
> > This has a chapter on security, so possibly it would be appropriate
> > to mention "m,esg n" there.
>
> A more proactive endeavor would be to document known best practices
> on the wiki.  A quick search found a couple pages that might serve
> as starting points:
>
>     https://wiki.debian.org/SecurityManagement
>     https://wiki.debian.org/Hardening  -- says it's for package maintainers
>
> Anyone who is serious about such a project probably has a long road ahead
> of them.

Is there a generally preferred web link checker program for Debian?
I took a look at
  https://www.debian.org/doc/manuals/securing-debian-manual/ch04s15.en.html
and the 4.15. Protecting against buffer overflows section has this bit:
recompile the source code to introduce proper checks that prevent
overflows, using the
 http://www.research.ibm.com/trl/projects/security/ssp/ patch for GCC
(which is used by
 http://www.adamantix.org)

http://www.research.ibm.com/trl/projects/security/ssp/ patch gives me
a connect failed and
http://www.adamantix.org sends me to a vietnamese tv site??

Seems to me that an easy first step would be to check that all the
links still work.

Regards,
Lee

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

making Debian secure by default Lee <ler762@gmail.com> - 2024-03-27 22:40 +0100
  Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 00:10 +0100
    Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 05:30 +0100
      Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 14:40 +0100
        Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 16:30 +0100
          Re: making Debian secure by default Hans <hans.ullrich@loop.de> - 2024-03-28 16:50 +0100
            Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 19:20 +0100
              Re: making Debian secure by default Ralph Aichinger <ra@h5.or.at> - 2024-03-29 08:50 +0100
              Re: making Debian secure by default Stefan Monnier <monnier@iro.umontreal.ca> - 2024-03-29 20:10 +0100
              Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-29 20:40 +0100
          Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 17:00 +0100
            Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 21:20 +0100
          Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-28 18:50 +0100
            Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 20:40 +0100
            Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-29 18:00 +0100
              Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-03-29 18:30 +0100
                Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 18:50 +0100
                Re: making Debian secure by default Nicholas Geovanis <nickgeovanis@gmail.com> - 2024-04-01 02:30 +0200
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-01 03:50 +0200
                Re: making Debian secure by default Roberto C. Sánchez <roberto@debian.org> - 2024-04-01 05:00 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-01 10:40 +0200
                Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default <tomas@tuxteam.de> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-06 09:50 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Nate Bargmann <n0nb@n0nb.us> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default Charles Curley <charlescurley@charlescurley.com> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default John Hasler <john@sugarbit.com> - 2024-04-06 09:51 +0200
                Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default John Hasler <john@sugarbit.com> - 2024-04-06 09:52 +0200
                Re: making Debian secure by default Joe <joe@jretrading.com> - 2024-04-06 09:52 +0200
              Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 18:50 +0100
                Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-29 21:00 +0100
                Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-30 17:10 +0100
          Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 19:10 +0100
            Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-28 23:20 +0100
    Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 17:30 +0100
      Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 18:10 +0100
      Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 18:10 +0100
        Re: making Debian secure by default Florent Rougon <f.rougon@free.fr> - 2024-03-28 18:10 +0100
  Re: making Debian secure by default jeremy ardley <jeremy.ardley@gmail.com> - 2024-03-28 00:40 +0100
    Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 00:50 +0100
      Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 05:50 +0100
  Re: making Debian secure by default <tomas@tuxteam.de> - 2024-03-28 06:20 +0100
    Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-28 06:30 +0100
      Re: making Debian secure by default <tomas@tuxteam.de> - 2024-03-28 08:20 +0100
      Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 12:20 +0100
        Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-28 12:40 +0100
          Re: making Debian secure by default David Wright <deblis@lionunicorn.co.uk> - 2024-03-28 21:40 +0100
            Re: making Debian secure by default Emanuel Berg <incal@dataswamp.org> - 2024-03-29 10:40 +0100
              Re: making Debian secure by default David Wright <deblis@lionunicorn.co.uk> - 2024-03-30 04:00 +0100
    Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-28 15:50 +0100
    Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 17:30 +0100
      Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 18:10 +0100
        Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 21:50 +0100
      Re: making Debian secure by default tomas@tuxteam.de - 2024-03-28 18:30 +0100
        Re: making Debian secure by default Lee <ler762@gmail.com> - 2024-03-28 20:30 +0100
          Re: making Debian secure by default Greg Wooledge <greg@wooledge.org> - 2024-03-28 20:30 +0100
            Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 21:50 +0100
          Re: making Debian secure by default tomas@tuxteam.de - 2024-03-28 21:20 +0100
            Re: making Debian secure by default Curt <curty@free.fr> - 2024-03-29 17:10 +0100
              Re: making Debian secure by default debian-user@howorth.org.uk - 2024-03-29 21:50 +0100
    Re: making Debian secure by default debian-user@howorth.org.uk - 2024-03-28 22:50 +0100
  Re: making Debian secure by default Marc SCHAEFER <schaefer@alphanet.ch> - 2024-03-28 12:10 +0100
    Re: making Debian secure by default Franco Martelli <martellif67@gmail.com> - 2024-03-28 17:30 +0100
    Re: making Debian secure by default Michel Verdier <mv524@free.fr> - 2024-03-28 17:30 +0100
      Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-28 17:40 +0100
  Re: making Debian secure by default Michael Kjörling <2695bd53d63c@ewoof.net> - 2024-03-28 21:50 +0100
  Re: making Debian secure by default Richmond <dnomhcir@gmx.com> - 2024-03-28 21:50 +0100
  Re: making Debian secure by default Jeffrey Walton <noloader@gmail.com> - 2024-03-29 16:40 +0100
  Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-31 21:10 +0200
    Re: making Debian secure by default Roberto C. Sánchez <roberto@debian.org> - 2024-03-31 21:30 +0200
      Re: making Debian secure by default gene heskett <gheskett@shentel.net> - 2024-03-31 22:30 +0200
        Re: making Debian secure by default Andy Smith <andy@strugglers.net> - 2024-03-31 23:20 +0200
          Re: making Debian secure by default gene heskett <gheskett@shentel.net> - 2024-04-01 01:00 +0200

csiph-web