≡ Menu

security system

Red Hat Open Sourced Identity, Policy, Auditing Management Security Framework Tool

Red Hat has open-sourced its identity-management and security system to promote its assertion that open-source software provides the most secure infrastructure. From the press release:

Red Hat Certificate System was acquired from AOL three years ago as part of the Netscape technology acquisition. In keeping with our commitment to open source software, today Red Hat has released all of the source code to Red Hat Certificate System. Much of the technology in Red Hat Certificate System was already open source, including the Apache web server, Red Hat Directory Server and the FIPS140-2 level 2 validated NSS cryptographic libraries, but today’s move further demonstrates Red Hat’s belief that the open source development model creates more secure software.

I think the freeIPA project is really good addition. It provides central management of identity, policy, and auditing for Unix and Linux using open-source and open-standards technologies.

freeIPA under Fedora Linux
(Fig. 01: freeIPA running under Fedora Linux [Image Credit freeIPA project])

Chroot in OpenSSH / SFTP Feature Added To OpenSSH

For regular user accounts, a properly configured chroot jail is a rock solid security system. I've already written about chrooting sftp session using rssh. According to OpenBSD journal OpenSSH devs Damien Miller and Markus Friedl have recently added a chroot security feature to openssh itself:

Unfortunately, setting up a chroot(2) environment is complicated, fragile and annoying to maintain. The most frequent reason our users have given when asking for chroot support in sshd is so they can set up file servers that limit semi-trusted users to be able to access certain files only. Because of this, we have made this particular case very easy to configure.

This commit adds a chroot(2) facility to sshd, controlled by a new sshd_config(5) option "ChrootDirectory". This can be used to "jail" users into a limited view of the filesystem, such as their home directory, rather than letting them see the full filesystem.