Secure installation and updating

From: Stian Øvrevåge (sovrevage_at_gmail.com)
Date: 03/07/05

  • Next message: Cal Cornils: "Re: Secure installation and updating" 
    Date: Mon, 7 Mar 2005 15:04:18 +0100
To: freebsd-newbies@freebsd.org

    Hi list, first time reader, first time poster...

    To build some practical skills within Unix, Networking and Security, I
    have made myself a case study to provide some services for a fictional
    corporation. I have some ( very limited ) experience with FreeBSD and
    have therefore choosen that as my primary server OS.

    I want to assure trustworthyness and integrity along the whole
    lifetime of the installations. Including secure installation and
    initial updating as well as secure destruction and sanitizing,
    something I feel is left out from many security-related discussions.

    In security-related questions regarding the whole operation I assume
    the worst, that my "trusted" network is already compromised, that
    there are remote vuln's to every program I run, that connections I
    make to the Internet is not to be relied upon. It's within the latter
    my current dilemma is. After reading countless pages on secure
    installation I've understood that it is highly recommended to download
    the newest kernel and rebuild. I'm not aware of which methods CVSup
    uses for authentication and encryption. Assuming that my session with
    updating my sources can be sniffed, hijacked, mitm-ed, or substituted
    from the beginning, I would have grave problems with trusting my fresh
    box. There is also another problem I with this; I want to keep the box
    completely shielded from any hostile network, including my own
    "trusted". This to minimize exposure to the possible undisclosed
    vuln's that might reside within the default installation.

    To sum it all up: Is it possible to download the newest source to for
    example a USB pen drive ( keywords: ultra-portable and
    super-unpredictable ), and transfer this to my isolated box, and hence
    updating without exposure?

    Regards,
    Stian
    _______________________________________________
    freebsd-newbies@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-newbies
    To unsubscribe, send any mail to "freebsd-newbies-unsubscribe@freebsd.org"

  • Next message: Cal Cornils: "Re: Secure installation and updating"

    Relevant Pages

    • Re: unspected shutdown. TCP attack?
      ... possible to restart a computer o corrupt TCP/IP stack, ... TCP packets from network. ... We used network monitor, netstat, sniffers, security policies, ..etc. ...
      (microsoft.public.win2000.general)
    • Re: unspected shutdown. TCP attack?
      ... possible to restart a computer o corrupt TCP/IP stack, ... TCP packets from network. ... We used network monitor, netstat, sniffers, security policies, ..etc. ...
      (microsoft.public.win2000.networking)
    • No "ConnectComputer" in the IIS [brand new installation]
      ... But because I didn't want to start all over the installation again I did the ... Server network. ... You may receive a security warning. ...
      (microsoft.public.inetserver.iis)
    • Re: Tracking Security in Ports and Base System
      ... security upgrade, then upgrading each applicable port by hand. ... I understand, there is only one tag for ports, which gets you ... After installation it will update this security database ... ports updating is sysutils/portupgrade. ...
      (freebsd-questions)
    • Re: Tracking Security in Ports and Base System
      ... I'm not sure there is a way to do this for ports, ... security upgrade, then upgrading each applicable port by hand. ... After installation it will update this security database ... ports updating is sysutils/portupgrade. ...
      (freebsd-questions)
    Loading