Archive for the 'Security' Category


Linux Security: Practically Bulletproof (pt. 2) - Swap

By Jason DyokBy Ded Ryzing: How much swap space should you set aside? This is a good question and one that seems not to have an answer. You’ll see it debated all over the Internet with many varying opinions on what is correct. How much is a matter of preference and experience, but most importantly, it’s a matter of system use.

I don’t profess to have the definitive answer, but here is a breakdown of what I’ve found works for me.

1-511MB RAM Swap 2.5 x physical RAM
512MB-1GB RAM Swap 2 x physical RAM
1GB-2GB RAM Swap 1.5 x physical RAM
more than 2GB RAM Swap 1 x physical RAM

These are general guidelines and the actual use of the system should be taken into account when allocating space. For example, a system used for intensive graphics rendering would benefit from swap space signifigantly larger than that listed..

It should also be noted that if you find your system is using swap space frequently, you may want to consider increasing the amount of physical RAM. RAM is cheap these days and your system performance will benefit greatly.

Finally, if you have multiple hard drives in your system, you may want to consider spreading your swap space over all drives. This will also help increase system performance as it will accomodate simultaneous disk reads/writes.

Tags: , ,

Posted on 17th November 2008
Under: Bulletproof System, Help and HOWTO, Operating Systems, Security | No Comments »

Linux Security: Practically Bulletproof (pt. 1) - Partitioning

By Jason DyokBy Ded Ryzing: By the very nature of it’s design, the GNU/Linux OS is a very secure and stable platform. However, there are still things that can be done to make the system almost bullet proof. I say almost because, let’s be honest, nothing designed and built by man is perfect. These are things that typically don’t require the installation of 3rd party packages or freeware applications.

The first and most basic task one undertakes with an OS, any OS, is it’s installation. Building a rock steady system begins here and decisions you make during install will have a large impact on the reliability and security of the end system.

Linux SecurityAccording to the *nix gospels, for a reliable and secure system the more partitions the better. This is, in fact, true. A good rule of thumb is to have a seperate partition for each file system that will contain user created files. Your partitioning scheme will also depend a lot on the main purpose of the system. For example (and I do mean example as partitioning schemes can be quite complex or very simple depending on taste):

  • Http Server: Create a seperate partition for the web server log files. Each time there is a failed connection, it is logged and having a seperate partition will help protect the system from a DoS attack. In Debian/Ubuntu, default Apache log location is /var/log/apache2/ and for RedHat/Fedora/CentOS it is /var/log/httpd/
  • FTP Server: Create a seperate partition for the pub folder or whatever location you use for user uploaded files.
  • E-mail Server: It’s a good idea to create a seperate partition for the e-mail spooler. On many systems this is located at /var/mail or /var/spool/mail. Consult your distributions help files for exact locations of incoming and outgoing mail spools.
  • NFS or Samba Server: It is always a good idea to create a seperate partition for shared file/folder storage. This location can be of your choosing. I personally prefer to create an entirely new directory for this (preferably on a seperate hard drive which also helps with system performance).
  • Home Shares: If multiple users will be connecting to your machine and storing data, it is advisable to create a seperate partition for /home. I like to do this anyways, even if it’s just for my use.
  • Other partitions I like to create include /boot for easier kernel recovery and /tmp to help guard against rogue processes filling a drive with temp files.

The question of how large to make these partitions is a matter of personal opinion, intended system usage and experiences. For example, for a LAMP server you would want to allocate more space for Apache and MySQL databases and little for /home. With the extremely large size of modern hard drives and their relatively low cost, be liberal when allocating space.

Tags: ,

Posted on 4th November 2008
Under: Bulletproof System, Help and HOWTO, Operating Systems, Security | No Comments »

Insurers Mining Consumer Data: Who Owns You?

By Jason DyokBy Ded Ryzing: This article was posted on Securosis. It’s highly recommended that you read and contemplate what it means. I’m guessing that those out there who follow blindly and firmly believe that Government and “big business” have your best interest at heart will not understand this. For the rest of you with a clue…be aware.

…insurance companies are able to save money by gathering health care records electronically, make more accurate analyses of patients (also saving money) and be able to adjust premiums (i.e., make more money) based upon your poor health or various other things. You know, like ‘pre-existing’ conditions… Full Story

Tags:

Posted on 13th October 2008
Under: Activism, Security, The Internet | No Comments »

Chinese Have Key To Backdoor In Cisco Gear

By Jason DyokBy Ded Ryzing: This is a rather old story that doesn’t seem to go away. It is speculated that Chinese hackers have programmed a backdoor into Cisco gear manufactured in China and destined for the U.S. and other western nations.

It has also been reported that U.S. and Canadian authorities have seized counterfeit Cisco gear coming from China that may contain backdoor code. Here is a quote from an article posted at Slashdot this past February:

“The IDG News Service is reporting that US and Canadian authorities have made more than 400 seizures of counterfeit Cisco hardware from China in an ongoing investigation that started in 2005. The most recent seizure was last Friday in Toronto, where the RCMP charged two people and a company with distributing large quantities of counterfeit network components to companies in the US through the Internet.” MORE

Now, I have not heard or seen any reports that a backdoor has been found or used. Some have argued that because we have yet to find one of these backdoors, they must not exist and this is just a bunch of paranoid conspiracy theory. Well, someone once said, “Just because you deny it doesn’t mean it isn’t true.” Why wouldn’t the chinese put backdoors into products they manufacture for western use? It seems pretty cunning and shrewd to me. And, let’s be honest, I’m sure the U.S. and other western nations would do the same.

One would also have to consider all the little gadgets and gizmos and doohickies that we attach to our computers. The MP3 players, cell phones, cameras, picture frames, printers, etc…all potential spawning grounds for nasties.

Do I think we all need to live in fear? No, not at all. What I would suggest, though, is that we all become a little more cautious, vigilant and critical about data and computer security. After all, everyone could be watching.

Posted on 10th October 2008
Under: Hardware, Security | No Comments »

‘Net Neutrality, Robber Barons and a “Free” Internet

By Jason DyokBy Ded Ryzing: A very recent post on PCMech.com touched on something that every Internet user needs to take notice of…’Net Neutrality.  While the article, “Metered Bandwidth = Bad Idea” was well written, it only scratches the surface of this important subject.

‘Net Neutrality is the notion that Internet users have the RIGHT to determine what content they view, and the applications they use to view it, on the Internet. Seems pretty logical, but this basic freedom is being threatened by ISPs and  Big Telco companies…the very companies YOU use to access the Internet.

While not directly a ‘Net Neutrality concern, metered bandwidth is a symptom of the bigger concerns at hand.  So what exactly is the problem?  Let’s illustrate it with an example.Net Neutrality

Let’s say you are a small or home business owner about to launch a new product.  Traditionally the Internet provided an even playing field on which your products had an equal opportunity to reach the same customers (and potential customers) as the big players in your market.  Now suppose your big competitors could pay ISPs to control the amount of data / traffic being routed to them.  Increasing their bandwidth and slow. Or cut, traffic to you.  This effectively kills the level playing field and equal opportunity.  On the Internet this can mean death for a website.

“Who cares?  I’m not a small business owner.”.  Traffic shaping also has freedom of speech and democratic implications.  Potentially ISPs could be paid to “bury” the Internet voice of social activism, independent voice and democratic thought.  Your very freedom is threatened when economic and political agendas of Government and Big Business is forced on you and they decide what information you can see.

In simple terms, it is no different than your telephone provider telling you who you can call and at what time you can call them, or your power company specifying what devices you can plug into the wall and if you use something different, it will not work properly.  Just think about that.

Why would an ISP do this?  Simple…greed.  ISPs collects money from these traffic shaping contracts, and they also continue to collect from YOU every month to access filtered content. This can not happen. I urge you to contact your local government representative and tell them this is not acceptable. You can also visit http://www.neutrality.ca/ or Save The Internet for more information and to sign their petition. Will Pate has a great article on “3 Easy Ways to Support Net Neutrality in Canada“.  While specific to Canada, these 3 steps can be applied anywhere:

1.Talk about it.  Get the word out any way you can
2.Lobby your politicians.  Remember, they are public servants that are supposed to work for you.
3.Complain to your regulatory authority.  In Canada it is the CRTC or the FCC in the U.S.

“Ah, this is all just conspiracy talk.  It doesn’t happen…my Internet connection is fine.”  Let me tell you, it IS happening and will happen more and more.

On October 31, 2007, Bell Sympatico (Bell Canada), one of the largest ISPs in Canada, admitted to using traffic management systems to specifically target peer-to-peer (P2P) traffic. This, in effect, reduced the speed at which this type of data could transfer or blocks it entirely. A Sympatico manager later added, “…Bell is using Internet Traffic Management to ensure we deliver bandwidth fairly to our customers…”.

This statement admits to traffic shaping and hints at the need for bandwidth metering.  In reality, there is more bandwidth available than you could imagine.  During the dotcom bubble of the late 90’s, thousands of miles of fiber optic cabling was laid for Internet use.  Most of this bandwidth was never used and remains dark to this day.  The fact is your ISP would rather take more from you then spend a little more to increase capacity, by lighting this fiber, to meet demand.

However, not all hope is not lost.  On May 16, 2008 the Globe and Mail reported that Bell Canada must prove ‘Net shaping is needed. “Federal regulators have ordered Bell Canada to provide tangible evidence that its broadband networks are congested to justify the company’s Internet “traffic-shaping” policies. “ 

While this article may be heavily Canadian leaning, I can assure you that this is happening all over the world.  I know there are similar stories to be told from everywhere.

Tags: , , , , ,

Posted on 4th September 2008
Under: Activism, Security, Software, The Internet | 1 Comment »