Download Securing Debian Manual

Chapter 12. Frequently asked Questions (FAQ)
122
• Debian’s standard installation is smaller (less functionality), and thus more secure. Other distributions, in the name of
usability, tend to install many services by default, and sometimes they are not properly configured (remember the
Lion (http://www.sophos.com/virusinfo/analyses/linuxlion.html) Ramen (http://www.sophos.
com/virusinfo/analyses/linuxramen.html)). Debian’s installation is not as limited as OpenBSD (no daemons are active per default), but it’s a good compromise. 2
• Debian documents best security practices in documents like this one.
12.1.2
There are many Debian bugs in Bugtraq. Does this mean that it is very vulnerable?
The Debian distribution boasts a large and growing number of software packages, probably more than provided by many
proprietary operating systems. The more packages installed, the greater the potential for security issues in any given
system.
More and more people are examining source code for flaws. There are many advisories related to source code audits of the
major software components included in Debian. Whenever such source code audits turn up security flaws, they are fixed
and an advisory is sent to lists such as Bugtraq.
Bugs that are present in the Debian distribution usually affect other vendors and distributions as well. Check the “Debian
specific: yes/no” section at the top of each advisory (DSA).
12.1.3
Does Debian have any certification related to security?
Short answer: no.
Long answer: certification costs money (specially a serious security certification), nobody has dedicated the resources
in order to certify Debian GNU/Linux to any level of, for example, the Common Criteria (http://niap.nist.gov/
cc-scheme/st/). If you are interested in having a security-certified GNU/Linux distribution, try to provide the resources
needed to make it possible.
There are currently at least two linux distributions certified at different EAL (http://en.wikipedia.org/wiki/
Evaluation_Assurance_Level) levels. Notice that some of the CC tests are being integrated into the Linux Testing
Project (http://ltp.sourceforge.net) which is available in Debian in the ltp.
12.1.4
Are there any hardening programs for Debian?
Yes. Bastille Linux (http://bastille-linux.sourceforge.net/), originally oriented toward other Linux distributions (Red Hat and Mandrake), it currently works also for Debian. Steps are being taken to integrate the changes made to
the upstream version into the Debian package, named bastille.
Some people believe, however, that a hardening tool does not eliminate the need for good administration.
12.1.5
I want to run XYZ service, which one should I choose?
One of Debian’s great strengths is the wide variety of choice available between packages that provide the same functionality
(DNS servers, mail servers, ftp servers, web servers, etc.). This can be confusing to the novice administrator when trying to
determine which package is right for you. The best match for a given situation depends on a balance between your feature
and security needs. Here are some questions to ask yourself when deciding between similar packages:
• Is the software maintained upstream? When was the last release?
• Is the package mature? The version number really does not tell you about its maturity. Try to trace the software’s
history.
• Is the software bug-ridden? Have there been security advisories related to it?
• Does the software provide all the functionality you need? Does it provide more than you really need?
2 Without diminishing the fact that some distributions, such as Red Hat or Mandrake, are also taking into account security in their standard installations
by having the user select security profiles, or using wizards to help with configuration of personal firewalls.