Paranoid Penguin - Security Features in Debian 3.1

Last month, I began a three-part series on distribution-specific security features, beginning with SUSE Linux 10.0. This month, I continue with Debian 3.1, and next month I will conclude with Red Hat Enterprise Linux.

As you may recall, unless you missed last month's column or have been enjoying yourself in memory-impairing ways since then, several things about SUSE 10.0 really struck me: its wide variety of security-enhancing software packages and security-scanning tools; its inclusion of several different virtual machine platforms; and Novell AppArmor, which adds Mandatory Access Controls (MACs) to individual applications and processes.

When I began exploring security features in Debian 3.1 (Sarge) GNU/Linux, I was therefore particularly interested to determine how does Debian 3.1 compare with SUSE 10.0 in those areas? And, what unique security features does Debian bring to the table?

Like SUSE, Debian GNU/Linux is a general-purpose Linux distribution designed to be useful in a wide variety of desktop and server roles. Also like SUSE, Debian includes a long and varied bundle of binary software packages.

Unlike SUSE, Debian is a 100% not-for-profit undertaking. There is no expensive Enterprise version of Debian 3.1 with more features than the freeware version. There's only one version of Debian GNU/Linux 3.1, and it's 100% free—;unless you purchase Debian CD-ROMs from a Debian re-packager such as LinuxCentral (see the on-line Resources), in which case you're paying primarily for the cost of CD-ROM production, not for Debian itself.

Arguably, there are security ramifications associated with any purely free software product. Business-oriented IT managers love to ask, “Who's accountable when things go wrong?” But others point to Debian's impressive record of releasing timely security patches as evidence that the Debian Security Team is at least as dependable and responsive as any equivalent commercial entity. My own opinion is that its freeness isn't a major factor one way or the other. Debian doesn't have a reputation for being any more or less secure than commercial general-purpose Linux distributions.

So, what is the Debian installation experience like, and how does it encourage good security?

Compared to other major general-purpose Linux distributions, Debian's installer is decidedly old-school. It uses a bare-bones, text-based GUI that does little more than install software packages. Although this may be off-putting to many users, especially those new to Linux, it minimizes the system resources required to install Debian and the amount of time you'll spend waiting for the installer to load itself into RAM.

Software package installation, as with any Linux distribution, is the heart of the Debian installation process, and in Debian 3.1 it's handled by aptitude. aptitude is similar to its predecessor, dselect, but with a couple of important differences. The first is that although it's text-based like dselect, aptitude sports drop-down menus you can access by pressing the F10 key. The second difference is that, for me at least, aptitude organizes packages in a much less confusing way than dselect. It's still primitive compared to the graphical package installers in SUSE, Red Hat Enterprise Linux and so on (and arguably clunkier than the text-based Slackware installer); however, aptitude is a significant improvement over dselect.

With aptitude, it's also easy to update your local package list and get the latest security patches from the Debian.org site (see Resources). In fact, anytime you install software using the Advanced Packaging Tool (apt) system (for example, when you run aptitude or apt-get), Debian automatically checks for security updates for the packages you're attempting to install.

The bad news about the Debian installer is that it doesn't seem to do very much to harden your system, even in a preliminary way. It doesn't give you an opportunity to create even a basic local firewall policy or choose a preconfigured or default policy. It doesn't even check your root and first nonprivileged-user account passwords for complexity (although it does warn you that passwords need to be complex).

Rather, it appears as though in Debian the emphasis is on providing users with as wide a variety of security-related software packages as possible, rather than actually helping users set up any of those packages. Considering that Debian consists of more than 15,000 software packages in all, you've got many choices indeed. Table 1 lists some Debian packages that directly enhance system security.

In addition to the local security-enhancing packages in Table 1, Debian includes many tools for analyzing the security of other systems and networks. Table 2 lists some notable ones.

Sifting through all these packages at installation time can be daunting. One thing that helps is aptitude's ability to search for packages by name. Another is the “Securing Debian Manual” (see Resources).

Once you've selected and installed your initial set of software packages, aptitude runs a few post-installation scripts (depending on what you installed). On my test system, I was disappointed to see very little in these scripts germane to security—these deal primarily with basic system setup, such as network settings. If you need to reconfigure these basic settings later (without editing files in /etc directly), you can re-invoke that part of the installer with the base-config command.

In summary, Debian's installation-time security features are disappointing and sparse. It may not be fair to compare the purely volunteer-driven Debian effort to a commercial product, but in my opinion, Debian sorely needs a centralized, security feature-rich installation and administration utility akin to SUSE's YaST.

Like other major Linux distributions, Debian increases in size and complexity with each new release. The paradox here is that Debian's ever-growing, almost unparalleled selection of software packages makes it more complex, even to the point of confusion—confusion causes sloppiness; sloppiness introduces avoidable security holes. A central administration utility would go a long way to reduce this confusion and enhance security for Debian neophytes and power users alike. It would go even further if it included modules for creating local firewall policies, managing virtual machines, managing SELinux or Trustees policies and so on.

All ranting aside, I like Debian, and as of this writing, I'm in the process of migrating my Web server from SUSE to Debian (though my laptop will remain a SUSE box). It's also worth mentioning that there are many unofficial Debian installers available, including other Linux distributions based on Debian and able to run Debian packages (see Resources).

So, moving on, let's talk about some particularly interesting and useful groups of security-related packages in Debian GNU/Linux 3.1.