Novell Adding to OSS ' SUSE gets more secure

Printable View

February 16th, 2005, 06:51 AM
gore

Novell Adding to OSS ' SUSE gets more secure

http://news.com.com/Novell+taps+open...3-5575225.html

Quote:

For Novell, security and open source belong together.

The Waltham, Mass.-based company said Monday that it will submit the programming interfaces for eDirectory to two open-source projects, allowing developers to use Novell's directory program to authenticate network access. Novell also detailed a partnership with Linux security company Astaro to create a security appliance that runs Novell's SuSE Linux operating system.

The announcements were made in conjunction with this week's RSA security show in San Francisco and LinuxWorld conference in Boston.

The submitted code is required to use security-related services in Novell's eDirectory, which forms the basis for Novell's suite of identity management software. The contributed software will be managed by the FreeRadius and Samba open-source projects.

Quote:

Novell has a well-established portfolio of network security-related products, which it sells under the Nsure brand. In 2003, it acquired open-source companies SuSE Linux and Ximian in an effort to tap into growing interest in open-source software.

Heh, hey there RedHat, hear that? I think it's a bell. Someone is getting schooled. ;)
February 16th, 2005, 04:46 PM
Maestr0

Quote:

The fourth version of Red Hat's software uses the 2.6 kernel for the first time. This improves general performance, I/O functions, networking, memory and storage. It also includes "Security-enhanced Linux" developed with the US' National Security Agency. The firm is also extending support from five to seven years in response to customer requests.

:)

-Maestr0

http://www.theregister.co.uk/2005/02/14/redhat_four/
February 16th, 2005, 05:10 PM
zencoder

I was gonna say...SE Linux is, IMHO, a much bigger deal than OSS for Suse. Not trying to knock Suse, but SE Linux opens up the potential for Linux to be used in a hell of a lot more Government and restricted environments.

Just my $0.02. I think they all suck. BSD FOREVER! YYYAAAAAAAAaaaaaaaaaaaaa.............(mmphhhh) <<sounds of ZC being eaten by the unwashed Linux heathens!>>
February 16th, 2005, 10:04 PM
gore

Maestr0, Does RedHat use a Custom compile on the Kernel to prevent Buffer Overflows like SUSE has not got in 9.2?

and ZenCoder, This is somewhat secret, but SUSE from what I've seen, is in more Government installs than SE Linux. I can verify it's used in the DoD, and in both federal and local. And so is BSD.
February 16th, 2005, 11:33 PM
Maestr0

Suse 9.1 supported the NX (No execute) for x86_64, and Suse 9.2 has added that support for the x86. RedHat has supported NX,stack protection (called ExecShield), and PIE (Position Independent Executables) since Red Hat Enterprise Linux 3 - Update 3. :) That being said, I do prefer Suse to RH, but I'll take Debian over both of them. :)

-Maestr0
February 16th, 2005, 11:39 PM
gore

But I'm not talking about Enterprise here. For the price of RedHat Enterprise, I could get about 5 copies of SUSE Enterprise.

Which SUSE Enterprise was given the highest award in security of any Linux. That was last year sometime?

In this part though, I was talking about the Desktop versions. Not Corporate. Which yes RedHat has quite a few things for their customers, but in terms of which is most secure, well, can you update RedHat before it's even been booted up? Is X listening on Redhat by default? SUSE has harden_suse and Bastille. And has nothing that can be accessed by default. The firewall is on by default.
February 17th, 2005, 12:16 AM
ss2chef

Quote:

Originally posted here by gore
and ZenCoder, This is somewhat secret, but SUSE from what I've seen, is in more Government installs than SE Linux. I can verify it's used in the DoD, and in both federal and local. And so is BSD.

As someone that daily interfaces with both the DLA (Defense Logistics Agency) as well as DLIS (Defense Logistics Information service) (both under DoD), I can't say I have seen ANY specific official preference for any Linux. The IA (Information Assurance) control publishes an IT solutions document which names approved software for workstations and servers among many others.
For workstations NO Linux is approved and for servers, any "hardened" Linux used as specified by NSA guidelines. Of course any Linux with SE Linux fittings can make the grade as SE being an
NSA pet.

That being said, I have seen many flavors of both Linux and BSD in use but usually in association with heavily contracted projects.

Will be interesting so see if there are even any STIGs for Linux or BSD.
February 17th, 2005, 12:53 AM
gore

http://www.antionline.com/showthread...hreadid=265249