On 08/12/10 17:10, Les Mikesell wrote:
> On 12/8/2010 4:04 AM, David Sommerseth wrote:
[...snip...]
>>> Agreed, and something that equally needs standardization.
>>
>> iptables is a de-facto standard on all Linux distributions nowadays. It
>> is not ratified by ISO, IETF or similar ... but how does that make the
>> real life scenario any different? That's just a piece of paper.
>> iptables works, and so does SELinux - when you learn how to use it.
>
> The real life situation is that iptables only works on linux and the way
> it works is distribution-dependent. So what you learn may lock you into
> a platform that may not always be your best choice.
Please educate me here. I've been using Novell SuSE Linux,
RHEL/CentOS/Fedora, Gentoo, Crux Linux, RootLinux, Slackware, Ubuntu and
my N900's maemo5 which is Debian based and OpenWRT based routers ... and
I have not seen iptables behave differently than expected on any of
these ... I don't completely understand your argument.
Some of these distroes does indeed have their own additional tools, like
YaST2, ufw, system-config-firewall, etc, etc ... That will be different,
but they all use iptables under the hood. I'm not talking about the
simplified iptables front-end, as that *is* expected to be different.
>> SELinux came as a result that someone found weaknesses and wanted to try
>> avoid security issues. Just like when firewalls began to become so
>> popular 20-30 years ago or so. There was a need to improve something,
>> and someone did the job. Nobody cared much about firewalls in the early
>> 80's. Why? Maybe because nobody thought anyone would abuse or misuse
>> the network infrastructure?
>
> Does that mean you would not be comfortable moving your applications to
> SUSE, Solaris, OS X, Windows, etc.? I don't want that kind of lock-in.
Considering Debian is on the move towards SELinux (Lenny installs
SELinux packages by default, just not enabled by default), openSuSE is
moving towards SELinux[1], Gentoo have hardened/SELinux projects going
on ... so moving from RHEL/CentOS to other Linux distros will not be an
issue in the future. Since I see that SELinux do begin to get some
traction in other distroes as well, so I am not worried about a
"lock-in" on SELinux.
When it comes to Solaris, OSX and Windows, that is not comparable, as
when you base your installations on Linux, you already at that point to
limit yourself somewhat. And those OSes got completely other security
mechanisms. If they are comparable, better or worse than SELinux, I
don't know - because I prefer Linux in general - as it is a F/OSS
product. But with the knowledge I now have with SELinux, I would be
reluctant to move over to a platform which do not have something similar.
[1]
<http://news.opensuse.org/2008/08/20/opensuse-to-add-selinux-basic-enablement-in-111/>
>> SELinux has been around for about a decade or so. And I believe that
>> the more widespread SELinux becomes, and the more users it gets, the
>> more people will not understand such discussions like this.
>
> Agreed - if it is as standard and cross-platform as Posix support you
> will be able to depend on it without the associated side effect of being
> locked to a particular OS distribution.
First of all SELinux is written for Linux. Or else it would probably
have been called SEPosix.
Second, iptables is a de-facto standard for Linux, just as pf is pretty
much the standard firewalling on BSD. Windows and Solaris got their own
firewalling methods as well. My point is, neither of them are any Posix
standards ... would you prefer to not use any of these firewall
implementations due to lack of cross-platform Posix support?
kind regards,
David Sommerseth
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
