pavement

Security (Why FreeBSD?)

From FreeBSDwiki
(Difference between revisions)
Jump to: navigation, search
m (Reverted edits by 220.134.110.231 (Talk); changed back to last version by Jimbo)
 
(18 intermediate revisions by 7 users not shown)
Line 1: Line 1:
−
FreeBSD has a significantly better security record, particularly as concerns out-of-the-box security, than most if not all Linux distributions. As an example, the default FreeBSD install includes OpenSSH set NOT to allow root logins - the hopeful remote user must log into SSH as a user in the wheel group, and must then [[su]] to root afterwards.
+
:''[[Security]] redirects to this article about FreeBSD's security record. For information on securing FreeBSD, see [[:Category: Securing_FreeBSD |Securing FreeBSD]].''
  
−
Most if not all Linux distros instead default OpenSSH to allow root login, which is hideously insecure because it allows a cracker to use a program like John the Ripper to try dictionary or brute-force attacks against the root account directly.
+
FreeBSD has a significantly better security record—particularly out-of-the-box security—than most Linux distributions.  For example, a default FreeBSD installation includes OpenSSH configured to disallow root logins—a potential attacker must first know the account name of a user in the [[wheel]] group (because only users in group [[wheel]] can use [[su]]), log in as that user, and then [[su]] to root.  Most Linux distributions instead install OpenSSH configured to allow root logins, which is more insecure because it allows a cracker to use an [http://www.k-otik.com/exploits/08202004.brutessh2.c.php automated program] to attempt dictionary or brute-force attacks against the root account.
−
 
+
−
While we agree on the conclusion, that root login should not be allowed by default, the argument given in the previous section is FUD, wrong, void and makes me wonder if one can trust what else is said about BSD. To use John the Ripper you need read access to /etc/password _and_ /etc/shadow, where all modern linux´s keep the encrypted passwords. You need to be root to read /etc/shadow as it is always installed 0600 uid root. So if you can read /etc/shadow you already have root access, which means you have no reason to run the Ripper.
+
−
 
+
−
The reason not to allow root login is simple. You want the root´ing people to authenticate as an ordinary user first, in order to track the su´ing people down in the logs (assuming they do not remove
+
−
themselves from the logfiles ...).
+
  
 +
Furthermore, because only users in group [[wheel]] can [[su]] to root, even if a remote attacker knows root's password, the attacker is powerless if he cannot access the account of a user in group [[wheel]].
 
[[Category:Why FreeBSD?]]
 
[[Category:Why FreeBSD?]]

Latest revision as of 20:57, 22 January 2008

Security redirects to this article about FreeBSD's security record. For information on securing FreeBSD, see Securing FreeBSD.

FreeBSD has a significantly better security record—particularly out-of-the-box security—than most Linux distributions. For example, a default FreeBSD installation includes OpenSSH configured to disallow root logins—a potential attacker must first know the account name of a user in the wheel group (because only users in group wheel can use su), log in as that user, and then su to root. Most Linux distributions instead install OpenSSH configured to allow root logins, which is more insecure because it allows a cracker to use an automated program to attempt dictionary or brute-force attacks against the root account.

Furthermore, because only users in group wheel can su to root, even if a remote attacker knows root's password, the attacker is powerless if he cannot access the account of a user in group wheel.

Retrieved from "http://freebsdwiki.net/index.php?title=Security_(Why_FreeBSD%3F)&oldid=9835"
Personal tools