From the Editor - Security One Step at a Time
April 1st, 2004 by Don Marti in
As I write this, yet another e-mail worm is spreading among non-Linux computers and incidentally filling my mailbox with “YOU HAVE A VIRUS” bounces from dumb software that somehow doesn't yet get the concept that worms forge mail. There's nothing like a worm attack that spares Linux to bring out the smug superiority in Linux users.
Cut it out. The attack path here is one step long. All that's keeping us safe is that most programs for Linux don't make it easy to run attachments from incoming mail. But combine the right vulnerability in a common desktop app with a little social engineering, and you've got a Linux worm.
Last year, the not-so-dramatically-named CAN-2003-0434 vulnerability allowed humble PDF files to run arbitrary commands as you. Linux users and distributions dealt with it quickly enough that it didn't turn into a vector for spreading a worm. With today's larger Linux user base and more desktop standardization, the next vulnerability will be a bigger risk.
Now that we've scared you, we'll cover the tools you could use to prevent not just a mail worm, but other attacks we don't know about yet. Run a local firewall and don't let programs on your company's desktops reach outside SMTP servers. Deploy exactly the firewall policy you want, on every host, with the advanced iptables advice in Chris Lowth's Kernel Korner on page 24. As you move your business apps to PHP, design them for security with Xavier Spriet's battle-tested designs on page 54.
And, make the next move in the spam wars. Deal with forgery where it starts. Although the US has essentially legalized spam, all the ISP advertising we've seen recently has used spam filtering as a selling point. Sender Permitted From, which Meng Weng Wong covers on page 62, lets you pop up out of the weeds and get mail through to customers who use strict spam filtering. SPF is a “look at me, I'm legit” measure you can deploy in a few minutes for a simple mail configuration.
Finally, in our cover story, Ibrahim Haddad and Miroslaw Zakrzewski explain a promising example of how to apply the kernel's Linux Security Module (LSM) interface to add process-level access control for telecom apps running on clusters (page 68). Developers can carry out this level of work, free of restrictions, because of the freedom that the GPL licensing consensus gives all of us. Keep your systems secure and enjoy this month's issue.
Subscribe now!
Recently Popular
| Building a Call Center with LTSP and Soft Phones | Aug-25-05 |
| Why Python? | May-01-00 |
| An Open Video to HP | Jul-02-08 |
| Boot with GRUB | May-01-01 |
| Data Manipulation with Sprog | Jul-03-08 |
| Chapter 16: Ubuntu and Your iPod | Aug-30-06 |
Featured Video
From the Magazine
July 2008, #171
Heard of the Web? If not, read on. This month we talk with Matt Mullenweg about WordPress. If you want to get your hands dirty in Web code, take a look at the rest of our feature articles on WebKit, Dojo and OpenLaszlo.
In the rest of the issue, you'll find articles on OpenID, RDFa and Quanta Plus.
Kyle Rankin puts a new spin (as in "no" spin SSD) on hard drives and
also tells you how to migrate to that new disk (spinning or not).
Mick Bauer continues his series on customizing live CD's.
And, James Gray gives us a feel for the state of Linux in the enterprise.
After all that, you may need some TV time. If so, check out our review
on how to make that digital TV tuner card work in your Linux box.
Delicious
Digg
Reddit
Newsvine
Technorati






Re: From the Editor, April 2004: Security One Step at a Time
On March 15th, 2004 Anonymous says:
Hi Don,
I need to see if you could e-mail me about setting up a firewall on my PC. I think it is setup but I'm just not sure? When I installed Fedora Redhat I asked for high security to be installed. How do I check to see from the command line if it is installed?
Thank you,
Rob McLachlan @ rlmcommunications@joimail.com
Re: From the Editor, April 2004: Security One Step at a Time
On April 9th, 2004 Anonymous says:
from a root prompt:
setup
select Firewall Configuration and just use one of the settings High preferably... I mostly use custom myself or write my own iptables rules...
Re: From the Editor, April 2004: Security One Step at a Time
On March 22nd, 2004 Anonymous says:
No problem! Just post your IP and I am sure that plenty of people would be happy to test to see if your network is vulnerable.
Re: From the Editor, April 2004: Security One Step at a Time
On March 18th, 2004 Anonymous says:
iptables -L