Users at LinuxWorld talk up security

[Rahul Sundaram]

Hi


"The company uses Fedora servers, the free, open source version of Red
Hat Linux, to run its production environment and Web presence. As a
precaution, Swanson uses the open source Mondo Archive tool to take
snapshots of its production server images, and keeps backup
configurations that can be brought online quickly in case of failures or
system problems."

"SE Linux has been terrific," Swanson said. In addition to vetting code
before deployment, SE Linux provides another level of assurance that the
code won't be exploited. "We deny everything and allow just what we
want" into and out of the servers via SE Linux policies, he said.



http://www.networkworld.com/news/2006/041006-linuxworld.html?page=2

[Jesse Keating]

On Sat, 2006-04-15 at 02:19 +0530, Rahul Sundaram wrote:
>  Swanson uses the open source Mondo Archive tool 
Interesting.  I used to be the packager for Mondo, but then it crumbled
as the lead developer moved on in his life.  Odd that people are still
using it.  Especially because I don't recall it using tools that support
backing up SELinux attributes.

-- 
Jesse Keating RHCE      (geek.j2solutions.net)
Fedora Legacy Team      (www.fedoralegacy.org)
GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)

[Toshio Kuratomi]

On Fri, 2006-04-14 at 21:34 -0400, Jesse Keating wrote:
>  On Sat, 2006-04-15 at 02:19 +0530, Rahul Sundaram wrote:
>  > Swanson uses the open source Mondo Archive tool
>  
>  Interesting.  I used to be the packager for Mondo, but then it crumbled
>  as the lead developer moved on in his life.  Odd that people are still
>  using it.  Especially because I don't recall it using tools that support
>  backing up SELinux attributes. 
Looks like a new developer has picked it up and its seeing active
maintenance again.  SELinux support via star is listed under the 2.00
release in June 2004.  2.02 says it added ACLs and xattr support to
afio.  All in all, it seems to have become more useful on Fedora now.

http://www.mondorescue.org/

-Toshio

[Bryan Smith]

Toshio Kuratomi <toshio(a)tiki-lounge.com&gt; wrote:
>  2.02 says it added ACLs and xattr support to afio. 
Oooh, I didn't see the xattr support in afio before.
That's my favorite archive tool, next to the filesystem's dump
utility.
(which is why I wish Red Hat would support XFS, but I won't start
that argument up again ;-).




-- 
Bryan J. Smith   Professional, Technical Annoyance
b.j.smith(a)ieee.org    http://thebs413.blogspot.com
--------------------------------------------------
I'm a Democrat.  No wait, I'm a Republican.  Hmm,
it seems I'm just whatever someone disagrees with.

[Jesse Keating]

On Mon, 2006-04-17 at 14:06 -0700, Toshio Kuratomi wrote:
>  Looks like a new developer has picked it up and its seeing active
>  maintenance again.  SELinux support via star is listed under the 2.00
>  release in June 2004.  2.02 says it added ACLs and xattr support to
>  afio.  All in all, it seems to have become more useful on Fedora now.  
Crazy.  I really hope that the code has gone some serious audits.  It
was not so hot back in the day.  Hugo was great, but he was new at
programming and security programming wasn't his forte.  Is this in
Extras anywhere?

-- 
Jesse Keating RHCE      (geek.j2solutions.net)
Fedora Legacy Team      (www.fedoralegacy.org)
GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)

[Bryan Smith]

Jesse Keating <jkeating(a)j2solutions.net&gt; wrote:
>  Hugo was great, but he was new at programming and security
>  programming wasn't his forte. 
You mean like when he was writing direct bytes directly to the CD/DVD
without a care about byte order and format?  ;->  But he's been
coding long enough on Mondo, he has to be a master by now (at least I
hope).

But what do I know?  How many projects have I founded and coded a
crapload for?  (HINT: 0)  Yeah, I've got a few credits here and
there, but I think I've contributed maybe 100 lines at the most to
any one project.



-- 
Bryan J. Smith   Professional, Technical Annoyance
b.j.smith(a)ieee.org    http://thebs413.blogspot.com
--------------------------------------------------
I'm a Democrat.  No wait, I'm a Republican.  Hmm,
it seems I'm just whatever someone disagrees with.

[Jesse Keating]

On Mon, 2006-04-17 at 14:47 -0700, Bryan J. Smith wrote:
>  You mean like when he was writing direct bytes directly to the
> CD/DVD
>  without a care about byte order and format?  ;->  But he's been
>  coding long enough on Mondo, he has to be a master by now (at least I
>  hope).  
There were things like that, and there were some awful things in mindi
that caught my eyes.  I fixed a number of tempfile vulns in the code.
Mindi got rewritten at some point from sh to perl, so some of that got
better, but there was still a lot of fugly stuff laying around.

-- 
Jesse Keating RHCE      (geek.j2solutions.net)
Fedora Legacy Team      (www.fedoralegacy.org)
GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)

[Rahul Sundaram]

On Mon, 2006-04-17 at 17:53 -0400, Jesse Keating wrote:
>  On Mon, 2006-04-17 at 14:47 -0700, Bryan J. Smith wrote:
>  > You mean like when he was writing direct bytes directly to the CD/DVD
>  > without a care about byte order and format?  ;->  But he's been
>  > coding long enough on Mondo, he has to be a master by now (at least I
>  > hope). 
>  
>  There were things like that, and there were some awful things in mindi
>  that caught my eyes.  I fixed a number of tempfile vulns in the code.
>  Mindi got rewritten at some point from sh to perl, so some of that got
>  better, but there was still a lot of fugly stuff laying around. 
Its under review in Fedora Extras. 

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187317

Rahul