88 reputation
18
bio website
location
age
visits member for 5 years
seen Dec 29 '09 at 17:55

May
2
awarded  Notable Question
Feb
22
awarded  Popular Question
Aug
18
comment SELinux in the Real World
Part of risk management is your security goals. Defining them is the hardest part. But once you have them you will take several courses of action. If SELinux is part of your solution then it would be wise for you to do analysis on applications and services of interest. 1) there are tools to do policy analysis (sesearch, sechecker, apol, sediff) 2) one of the advantages in the design behind SELinux policy is that it is centralized; ie only one place to do analysis. Is SELinux the answer? Depends on your goals. Does SELinux work? LSM hooks in the kernel are hit and enforced. Is security easy? no
Aug
18
comment SELinux in the Real World
This is the big problem, many vendors want their application or service to just work; they are not going to spend money on making sure it works with SELinux.
Aug
18
comment SELinux in the Real World
This is true. For example fedora and rhel5 are supported by red hat and they support their customers so policies like apache get a lot of attention.
Jul
30
answered SELinux in the Real World
Jul
29
awarded  Commentator
Jul
29
comment How do I make Apache Web Server listen on two different ports?
Or you could leave SELinux on, if you are on a modern SELinux system see how the ports are labeled with a semanage port -l. see danwalsh.livejournal.com/9275.html which is titled "I want my apache daemon to listen on a different port but SELinux is preventing it, What do I do?"
Jul
29
answered How does SELinux affect the /home directory?
Jul
24
revised Website Backup and Download
added 706 characters in body
Jul
24
answered Website Backup and Download
Jul
21
comment setting up freebsd kerberos key server windows client log in musts
I would like to have the windows login process authenticate against my Kerberos service.
Jul
21
awarded  Scholar
Jul
21
accepted How to get windows xp to authenticate against kerberos or heimdal
Jul
21
answered Best tools for keeping a FreeBSD 7.x system up to date?
Jul
16
comment setting up freebsd kerberos key server windows client log in musts
I will clarify a little more. I have a couple of XP workstations, is it known if the step by step would work on XP Home (or possible Pro).
Jul
16
comment setting up freebsd kerberos key server windows client log in musts
I have found lots of text describing how to have a *nix client authenticate against AD. However I want to have a *nix server be the authentication service. Clients may be windows but all my services run on *nix machines (usually free/openbsd and linux)
Jul
14
comment What kind of mail server do you use?
This is true, and I even will put my chips in with modern sendmail. However there is the on going problem that software is never perfect so to this day we are still dealing with stack overflows and similar problems. It seems there are two approaches to dealing with security and I believe both are correct and for an example I like to use OpenBSD and SELinux as the examples. OpenBSD attacks security from the angle of having the software engineered correctly, where SELinux assumes that software will fail (assuming it of course won't fail). I think both should be followed to a degree.
Jul
10
comment How to enable sshd on Fedora 11?
Also Fedora has seen a lot of SELinux attention, out of the box configurations tend to work well. As you deviate YMMV. However FC by default is a "targeted" policy which means it targets network facing services like ssh. However pretty much everything else is unconfined. see -Z options as in ps -Z ls -Z. Also sesearch is your friend. say you do ps -Z to get the context of a process, then ls -Z on a file of interest, does policy allow lets say reading? try sesearch --allow -s typeFromps -t typeFromls. If all else fails, drop to permissive if you feel it really is SELinux causing it
Jul
10
comment How to enable sshd on Fedora 11?
You don't have to turn off SELinux or put it in permissive to see if it is the problem. Even with limited knowledge of SELinux you can spot obvious SELinux related issues. For example grep "avc.*denied.*ssh" /var/log/audit/audit.log. or tail it for a "live" audit. tail -f /var/log/audit.log | grep "avc.*denied.*sshd". or to catch more generic SELinux related problems tail -f /var/log/audit.log | grep "avc.*denied. From a sysadmin point of view I find using tail/grep easy. For a more robust tool try seaudit from the setools package.