Hot answers tagged

25

I have one specific package (moodle) which is not available on newer versions of aforementioned OS (last version of moodle was available on OpenBSD 5.3) which is more than 4 years old. In my opinion you ask the wrong question. The problem is less the old version of OpenBSD but more the old version of Moodle you want to run on this OpenBSD version. Although ...


20

No. OpenBSD has measures (specifically, malloc() guard pages and wiping of deallocated memory) that should have turned Heartbleed into a crash or a leak of a whole bunch of "0x0d" bytes. However, as noted in a blog post here, OpenSSL uses its own custom memory-management system which acts to defeat those measures.


11

A secure OS is an OS that is maintained by a sysadmin who knows his job. This trumps everything else. So, basically, when the sysadmin knows all the internal details of BSD, and not of Linux, then BSD will be more secure than Linux. However, if the converse holds (sysadmin knows Linux better than BSD), then Linux wins. In the quasi-mythical case where a ...


9

Virtualization offers some layer of isolation. In your "B" case, if (for instance) there is a remotely exploitable hole in the SMTP server, then an attacker who exploits it may gain full control of the virtual machine which runs that SMTP server, but he will still be "outside" of the two other machines (the guest with the Web server, and the host). This may ...


6

My understanding of the question is that you want to run a webserver and an ssh server only. First, I'm not sure why you wouldn't be able to able to do this with securelevel set to 2. Second, if you run qemu as a package/port and you use the kernel module you are adding a device, giving some superuser permissions and generally increasing the attack surface....


6

There is one major category of home hardening that you missed, at least in part. 'Vectors downloaded by the user' is a huge category. It is the most used attack vector today. A lot of attacks don't require any user interaction to run. See drive-by downloads for an example. While you are correct that safe browsing habits are a good way to address this ...


6

BSD has nothing to do with it (but it's a good choice). Running older software is quite possible if properly patched. Google and the CVE DB is your friend https://www.google.com/search?q=open+bsd+5.3+vulnerabilities https://www.cvedetails.com/vulnerability-list/vendor_id-97/product_id-585/version_id-121223/Openbsd-Openssh-5.3.html Determine the nine ...


5

Most of these security issues arise when a host accepts IPv4-mapped IPv6 traffic over the network, rather than accepting IPv4 traffic and presenting it to an application on an IPv6 socket with a mapped address. An application may have no good way to tell the difference and detect a potential attack in progress. Of course no host should ever be accepting ...


5

There seem to be some misconceptions here about how memory management in OpenSSL works. OPENSSL_malloc and OPENSSL_free by default just call the system malloc and free (there is some indirection, so an application can redefine these functions if it wants, but OpenSSL doesn't do that itself). However, for some data structures, notably input buffers, it keeps ...


5

The issue is now addressed in the paper signify: Securing OpenBSD From Us To You by Ted Unangst (BSDCan, 2015). In summary: Requiring mirrors to use HTTPS, and any other reliance on HTTPS, was rejected. As noted by other answers here, securing only the connection between users and mirrors does not secure the transit of artifacts from developers to users. (...


5

Yes, it's relevant, but you have to understand the context. There are several ways a platform can achieve a low rate of exploitation such as code quality, a hardened configuration, a limited feature set, and obscurity. There's no doubt that OpenBSD benefits from obscurity to some degree - if it were as popular as Linux or Windows, many more people would be ...


5

From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects. With KASLR, you make it harder for ROP gadgets to overwrite (e.g., heap spray) areas of memory that will eventually yield control to injected/known code. However, this being an arms race, counter moves such as JIT spray have ...


4

Running X.org as non-root is now possible as of Feb. 22, 2014 (my emphasis): In OpenBSD-current, after this commit users of Intel and ATI Radeon graphics which support kernel mode setting (almost all of them) can set machdep.allowaperture back to 0 in the /etc/sysctl.conf configuration and still run the X server. This means that the X server requires ...


4

Altough OpenBSD made some enhancement to improve the security of X11 the problem is the underlying architecture of the X11 system which has no real (i.e. secure) concept of screen locking. This means screen locking is mainly realized by a process which grabs input and has a full screen window and if this process exits (normally or by crashing) the screen is ...


3

Ideally, I'd like to be able to leave my laptop unattended, and know that after a few minutes, it'll screen lock itself, so it gets as safe as if the laptop had been powered off and full disk encrypted (all disks including swap). This is absolutely impossible. No matter how secure the screen lock is, as long as the computer is booted, it is potentially ...


3

(Note that I know nothing about the design of OpenBSD ntpd, I'm just answering the generic question about separating processes.) From your quote, I gather that the separation the UDP process from the DNS process was not motivated by security concerns, but by architectural concerns: “because... it's... it just didn't make sense”. The UDP process and the DNS ...


3

All other things being equal, simplicity is good for security. But let's not reverse the paradigm. Software is secure because it is maintained. Complex software is harder to maintain, but, on the other hand, Apache and Nginx have a huge market share, are very active project, and thus benefit from about the best level of maintenance that can be hoped for. ...


3

An important point about virtual machines is that they do not make any system more secure. The VM is all about protection between the host and the guest. A server with a security hole, running in a VM, still has a security hole; the only difference is that when the hole is exploited, the attacker gains control of the VM, not of the host. This "increases" ...


3

I did not find anything on that page that describes Systrace as insecure. Systrace was the result of groundbreaking research, described here: Improving Host Security with System Call Policies, Niels Provos, USENIX Security 2003. Later research reported vulnerabilities in system call monitoring tools (including Systrace): Exploiting Concurrency ...


3

OpenBSD has plenty of issues against the base system (see their patches section), past and present. It is not an obscure OS - it is exceedingly well documented, and very popular with people who build infrastructure. And others. But I suppose the text install program puts people off. It is my understanding that its standard services (not ports) are ...


3

You can leverage arpwatch to notify you the second it broadcasts on your network again and also use a tool like Wireshark to capture traffic and see what the device is communicating to (logging DNS queries sometimes works too). Sometimes IoT devices like thermostats, toys, equipment or even certain operating systems will call home on a regular basis looking ...


2

I refer you to the answer to this question, and will copy relevant parts below. I've also added a section or two at the end. Choosing a strong passphrase Yes, we've all heard it time and time again, but there is probably no easier way to improve your security. If you're a fan of passwords, make sure to choose something that contains enough entropy to be ...


2

If you set up your system so that only the guest listens on public network ports (those that are open on the firewall), then you win security in the sense that if someone manages to get into the guest and do some damage, it can be repaired more easily. Another advantage is that you may be able to limit the guest's resource usage, maybe even kill it off and ...


2

This was based on a paper presented at the USENIX conference entitled "“Exploiting Concurrency Vulnerabilities in System Call Wrappers" According to the author in a blog post: The key insight here is that the historic assumption of “atomicity” of system calls is falacious, and that on both uniprocessor and multiprocessing systems, it is trivial to ...


2

http://unix4lyfe.org/darkhttpd/ (no HTTPS) Also, custom compile of Nginx with no optional components, except for SSL, is also a very minimal server. Python SimpleHTTPServer source code is not 1 line long, you simply call it with one line.


2

There are a number of ways you could approach this, but the most direct would probably be to set up an intrusion detection system, such as Snort. It monitors all traffic to the server and can warn you of suspicious activity. https://www.snort.org/


2

As OpenBSD documentation clearly states it in bold red characters in their introduction about ports: The packages and ports collection does NOT go through the same thorough security audit that is performed on the OpenBSD base system. Although we strive to keep the quality of the packages collection high, we just do not have enough human resources to ...


2

OpenBSD does not require a "live" cd and if you want to err on the paranoid side you should consider creating your own "live" medium by following their own FAQs: It is very easy to create a bootable USB flash (or other!) drive that can be used as a "live" OpenBSD system without installing OpenBSD on the local hard disk of a machine. Obviously, the target ...


2

Let's assume that pledge doesn't exist (this design predates it, as I understand it). Obviously this design is pretty pointless on its own, as if the network-facing service is compromised the attacker has root on the system. Even without pledge the design isn't pointless. If the network-facing service is compromised the attacker does not have root on the ...


2

I would recommend changing the password for the admin page for your router along with the wireless passwords. Might be a bit of a pain since you have to reconnect any wireless devices but depending on the complexity of the original wireless password someone might've been able to capture the WPA handshake and crack the password. If you have WPS enabled on the ...


Only top voted, non community-wiki answers of a minimum length are eligible