[Author Prev][Author Next][Thread Prev][Thread Next]
[Author Index (this month)][Thread Index (this month)][Top of Archive]

Re: Security followup

Subject: Re: Security followup
From: "Decker F. Wong-Godfrey" <dfgodfrey -at- milmanco -dot- com>
To: "TECHWR-L" <techwr-l -at- lists -dot- raycomm -dot- com>
Date: Wed, 15 Jan 2003 13:19:39 -0800





This may be true of some older versions of Linux. Anymore, the installation of Linux systems is geared toward functionality; simply clicking on the choice for "desktop system" install will configure the system without services.



Not true, I'm afraid. True, most Linux distributions disable the more obvious problems, such as telnet and ftp. However, not all do so, and some have options that don't. Almost all enable some services without asking, too - which is why, the first thing you should do after installing is check to see what services are enabled.

I'm not disagreeing, I've overgeneralized on the point. But with a recent lab installation of Debian 3.0, Mandrake 8.2 and 9.0 as well as Red Hat 8.0, the distros allow the user to choose what services will be enabled. The installers tell the user exactly what services will be running--no matter what installation is chosen. It clearly shows what services will be listening. Older Red Hat (like 7.1) did evil things like enabling services and firewalls without telling the user.

I don't disagree. The user should know exactly what ports are open. But I don't foresee my mom using netstat or running a portscanner anytime soon.




^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Help Authoring Seminar 2003, coming soon to a city near you! Attend this
educational and affordable one-day seminar covering existing and emerging
trends in Help authoring technology. See http://www.ehelp.com/techwr-l2.

A new book on Single Sourcing has been released by William Andrew
Publishing: _Single Sourcing: Building Modular Documentation_
is now available at: http://www.williamandrew.com/titles/1491.html.

---
You are currently subscribed to techwr-l as:
archive -at- raycomm -dot- com
To unsubscribe send a blank email to leave-techwr-l-obscured -at- lists -dot- raycomm -dot- com
Send administrative questions to ejray -at- raycomm -dot- com -dot- Visit
http://www.raycomm.com/techwhirl/ for more resources and info.


Follow-Ups:

References:
Re: Security followup: From: Andrew Plato
Re: Security followup: From: Decker F. Wong-Godfrey
Re: Security followup: From: Bruce Byfield

Previous by Author: Re: Security followup
Next by Author: Re: Security followup
Previous by Thread: Re: Security followup
Next by Thread: Re: Security followup

[Top of Archive] | [Author Index (this month)] | [Thread Index (this month)]

What this post helpful? Share it with friends and colleagues:

Sponsored Ads