c0t0d0s0.org

Darren Moffat shows a nice trick in his blog. He explains how you can make a file in a ZFS filesystem even immutable for the root user. Hmm, i should integrate this to the LKSF book.

An interesting PSARC case got it´s approval: PSARC/2008/321 - No Root Login:

It has been suggested that Solaris should permit "root" to be a no login account.
[...]
Add a "solaris.system.maintenance" authorization. Modify sulogin(1M) toprompt for a username and password. If the username entered is authenticated by the password and has the "solaris.system.maintenance" authorization, enter system maintenance mode. If not, as before this project, deny access.

Besides of making root a role, this would be another way to get rid of a direct usable root account in Solaris. With this change you can use your own username and password to log into an "root shell" without knowing the root password ... there doesn´t even have to be a root password. You only need the authorization solaris.system.maintenance in your user attributes.

(via ceri on twitter)

The Communications Security Establishment Canada certified Solaris 10 Release 11/06 Trusted Extensions:

Solaris Trusted Extensions has been developed to meet the requirements of the B1 class of the TCSEC, and now meets the equivalent Labelled Security Protection Profile (LSPP) in addition to the (CAPP) and (RBAC) by virtue of the underlying Solaris 10 11/06 operating system.

You can gather the certificate at their website. Unlike for example the EAL+4 LSPP certification, this evaluation included a graphical desktop

The JET tutorial isn´t complete, but shorten the time a little bit for you, i wrote a tutorial about a small but nevertheless important topic - passwords:

• Part 1: Introduction
• Part 2: Using strong password hashing
• Part 3: Using a password policy
• Part 4: Conclusion

These are some simple tricks to make your system more secure, just by ensuring that the keys to your server are well-choosen and not simple ones. But as i stated before there is something you should keep in mind: Don´t make the passwords too hard to remember.

User have the habit to break any security policy. At least as long you don't enforce it. One of the most annoying habit from the view of the security people is the tendency to choose weak passwords, the name of the boy or girl friend, the prefered brand of cars, birthdays ... you name it. This passwords are everything but secure. But you can configure Solaris to check the new passwords.

Many people are unaware of the fact, that only the first eight characters of a password are used in the default configuration of Solaris. Don´t believe it? Let´s try it.

The password is the key to the system. When you know the username and the password, you can use the system. If not ... well ... go away. You can´t overemphasize the value of good passwords. There is something you can do as the admin at the system level to ensure such passwords: At first you can use stronger mechanisms to hash the passwords. And you can force the users of your system to use good password. This tutorial will explain both tasks.

A hard disk goes down in flames through the atmosphere and specialists were still able to recover 90 percent of the data: Data recovered from Seagate drive in Columbia shuttle disaster. At the end, data seems to be more resistant then most of us believe, when you put a vast amount of effort behind the recovery.

This leads me to annother thoughtgame: Let´s assume, you shredder a disk to pieces as tiny as 1 square millimeter. This would just look like dust to you. A modern harddisk stores 200 gigabit per square inch. One square inch are 645.16 square milimeters. Thus a harddisk would store 310 megabits on a square milimeter. Let´s assume 10 bits per byte (for error correction and similar things) and you have 31 megabytes worth of data on one of these pieces of dust.

It´s just a question of effort to recover the data, when you can yield 10 million euros out of the data (trade secrets, credit card data) it would give you a nice profit when you spend for example 9 million to recover the data. Yet another reason for cryptography everywhere or you may end up with degaussing, shreddering and remelt your old harddisks just to be safe.

No software is without errors. This is a basic law of computer science. And when there is no bug in the software (by a strange kind of luck) your hardware has bugs. And when there are no bugs in the hardware, cosmic rays are flipping bits. Thus an operating system needs some mechanisms to stop a process or the complete kernel at once without allowing the system to write anything back to disk and thus manifesting the corrupted state. This tutorial will cover the most important concepts surrounding the last life signs of a system or an application.

A really interesting article about Automatic Patch-Based Exploit Generation:

Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds. Coupled with a worm, all vulnerable hosts could be compromised before most are even aware a patch is available, let alone download it. Thus, Microsoft should redesign Windows Update. We propose solutions which prevent several possible schemes, some of which could be done with existing technology.

(found via Bruce Schneiers blog)

I found two really interesting interesting presentation. At first Brent Paulson wrote an really interesting presentation about practical Opensolaris Security. It´s a good overview about the possibilities of Solaris to increase the level of security at your installation. Ben Rockwood of cuddletech.com wrote an good preso about the usage of dtrace in conjunction with mysql.

When you want to place a system into a network, it´s a good practice to harden the system. Hardening is the configuration of a system to minimize the attack vectors for an intruder by closing down services, configuring stricter security policies and activating a more verbose logging or auditing.

Okay, at the first moment i was really in fear that we have installed OS images with a nasty new security vulnerability or we installed a solaris version with the infamous telnet bug, when i´ve read this Sun confirms it shipped vulnerable servers. Okay, then searching for the SunAlertSome Sun SPARC Enterprise T5120 and T5220 Servers Shipped With an Incorrect Solaris 10 Image Containing an Insecure Configuration. Drama queens ... just a little experience from the field: We delivered a system in a configuration that many systems gets within 10 minutes after booting anyway .. with activated remote root login Well, believe it or not ... there are customers still using telnet. The day when the last admin understands that telnet or remote direct root login are bad ideas will be the same day i´m out for figure skating in hell ...

PS: Nevertheless, something like that should not happen ....

I´ve linked to the Opensolaris project for implementing Flexible Mandatory Access Control a few days ago. Yesterday we´ve made the announcement that a joint effort of Sun(NASDAQ:JAVA) and the NSA ("No such agency") to implement NSA's Flux Advanced Security Kernel (FLASK) in Opensolaris was started by the both partners.