Craig White wrote: >> My connection to the outside world is through my desktop, and ADSL. >> I connect to my ISP by dhcp (and pppoe). >> I'm running shorewall standard two-interface setup on my desktop. >> As far as I can see, this means that no-one outside my system >> should be able to get in, >> and I certainly see hundreds of packets each day on LogWatch >> that have failed to get in through a large number of ports. >> >> (1) Am I deluded in thinking myself reasonably safe? > Have wireless access on your home lan? I do use WiFi inside my house, and in theory I guess someone outside could break in. However, with my geographical situation this is extremely improbable, and I would regard worry about it as verging on paranoia. > What if you are slow in updating > kernel in shorewall system? I'm not sure what this means. There must be a fraction of a second when re-booting my desktop - which I never do except when I compile a new kernel, or there is a power outage - when I am connected to the outside world before shorewall starts. (Actually, for reasons I don't understand - or haven't looked into - shorewall does not start properly when it should, and has to be re-started in /etc/rc.d/rc.local .) But again, it seems to me one has to keep a sense of proportion on security risks, and the chances of somebody sneaking in during that fraction of a second are pretty remote. > What if you access malicious web site as > root? I don't think I have ever accessed the web as root. Why would anyone do that? > What if you download a tarball with malicious code? Almost the only time I download tarballs would be to get and compile code, which I assume is reasonably safe. > There's so many different ways you can have your security break - to > look at your system and say, well I'm not running a web server, so this > doesn't apply is entirely beside the point. Actually, I am running httpd on my desktop, for internal use. (I'm not sure if I need it for this, but I keep a yum update repository on my desktop, and update from this on my other machines. Also, I use it to test Java applets.) But I don't allow access to the server from outside. > Windows employs too little audited code, too few security checks and > consequently, we see the things that have happened with their reputation > with respect to security. Linux has a new technology that is arriving > simultaneously with the 2.6 kernels that is designed to provide another > additional layer of security - very handy when you execute the wrong > code, misconfigure the wrong daemon, absentmindedly stop firewall > services, etc. Yes, it's a PITA. Yes, we are having to deal with a > technology that we neither understand nor wish to deal with. It seems to me that this is the real reason for pushing SELinux - to give Linux a name as a "secure system" as compared with Windows. This seems to me a wholly desirable end in itself, and I am happy to do my tiny bit by running SELinux on my home system for this reason alone. But I am not convinced, as I said, that SELinux adds measurably to my security. -- Timothy Murphy e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie tel: +353-86-2336090, +353-1-2842366 s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
