EnGarde Secure Linux v2 Out

Chuck writes "I came across EnGarde Secure Linux about two years ago when it was first released, and I see they just released the newest version. Improved Mandatory Access Control using LIDS, awesome web-based manager, code from the Openwall Project and winner of the Network Computing Hardened Linux product of the year. I love EnGarde."

Commercial?

[Anonymous Coward]

I thoght EnGarde was strictly commercial nowadays?? No?

Oh Engarde

[Anonymous Coward]

Oh Engarde Linux,
We stand on guard for thee...

Advertising shmadvertising...

[CoolVibe]

Guess this is one of those slashdot sponsored "advertisement" advertising stories huh?

Anyway, LIDS is great. Played with it, and deemed it cool. Now I wish FreeBSD had something that cool (since that's my main OS of choice), but LOMAC comes pretty close.

Heck, I just might give this a whirl on one of my testboxes...

Re:Advertising shmadvertising...

[DASHSL0T]

Heck, I just might give this a whirl on one of my testboxes...

So, the advertising worked, is what you're saying. :-D

--
Have you taken the SCO poll?
Linux-Universe [linux-universe.com]

Re:Advertising shmadvertising...

[CoolVibe]

I never use VMware. I have used it once or twice, but I never really have a use for it. And it's way to expensive for me.

*shrug*

Re:Advertising shmadvertising...

[BSDevil]

At least Chuck is a real [slashdot.org] user, unlike last time (I don't remember the exact story) where no one could find any record of the user in the database and his domain belonged to an advertising company.

Re:Advertising shmadvertising...

[caluml]

I prefer the GRSecurity patches [grsecurity.net] to LIDS. They contain a lot more than just ACLs.

Re:Advertising shmadvertising...

[pacman on prozac]

I wish FreeBSD had something that cool

I understand filesystem ACL's are coming in fbsd-5.

I'm not sure how they compare to lids but if you have fbsd 5.0 you can read about them in /usr/src/sys/ufs/ufs/README.acls.

this page [lucq.org] describes the openbsd port so might be useful.

And of course theres always trusted bsd [trustedbsd.org]

Alternatives

[schroet]

We like Astaro a lot.

http://www.astaro.de/php/statics.php?action=asl& la ng=gb

Could anyone compare the 2?

Re:Alternatives

[warez]

Astaro is a hybrid firewall (stateful packet filter, application proxy), with a bunch of other nifty features. I 'discovered' it a couple of months ago on freshmeat when I was about to put together my own security box. After playing with it, I am nothing short of impressed, and its FREE for home use. it is a refined product. Engarde is a hardened linux distro; it's most practical use is turning it into a secure pubic server. The two actually goes hand in hand, as they aren't competing products.

Re:Alternatives

[feldy]

it's most practical use is turning it into a secure pubic server.

Oh man, that's exactly what I need 'cause right now my pubic server is anything but secure.

What a great idea

[The Tyro]

"turning it into a secure pubic server"

That's truly a noble endeavor... From my experience, most insecure pubic servers are loaded with viruses and trojans.

"I love EnGarde."

[MacOS_Rules]

Quoth the poster: "I love EnGarde."

The best part: it automatically uses protection! Just don't try a backdoor!

---OWWW! Stop hitting me!---

Wait

[Anonymous Coward]

Isn't this kinda risky? Shouldn't they have waited to see what happens with SCO first?

Re:We were considering implementing it

[RedOregon]

What? You decided not to implement because it requires you to configure it? And if you don't, it gives a benign error?

(Link points at an advisory stating that log check emails will bounce by default if not configured)

Re:We were considering implementing it

[freuddot]

OVERVIEW

--------
A bug was recently discovered in the default configuration of the
daily log summaries. The default address is set incorrectly causing
daily summaries to bounce until the system is ran through the initial
configuration process or the admin e-mail address is changed.

Err. That's probably the mildest bug/security problem I've ever seen. Care to explain me what is the problem of either

- applying the update ?
- running the initial configuration process ?

Or were you simply googling for a defect to post and that's the ony one you found ?

Distro Consolidation

[The Monster]

wouldn't it be more competitve to merge certain distros?

They tried that. It's called UnitedLinux. And one of the partners in that enterprise has decided to serially sue everyone else in the Linux business, based on an exotic theory of IP violation. You may have seen [slashdot.org] something [slashdot.org] about [slashdot.org] this [slashdot.org] recently [slashdot.org] here [slashdot.org] on [slashdot.org] Slashdot [slashdot.org]

Re:Distro Consolidation

[The Monster]

So your point is

I'm old. I don't have to have a point.

(See if you recognize that one.)

You ask why people keep reinventing the wheel?

[CQ]

Because there are too many distros and add-ons!

Linux is in danger of losing direction much as UNIX did 20 years ago! Everyone can and does write Yet Another Add-On:

"Yaooooooooooo! I'm going to be rich!"

And they do this before they learn what is already out there, identify the good and bad parts (PROPERLY), and document what makes their solution worth the effort.

Properly: It is amazing how many people are willing to "take a look at" something and consider themselves versed enough to criticize!

No skills required?

[IO ERROR]

No Linux administration skills required.

HUH? This is supposed to be an uber-secure system and you don't have to administer it? Somebody explain this to me like I'm a two year old, because I just don't get it.

Re:No skills required?

[questamor]

All ports are turned off by default, with no way to turn them on. Also, networking hasn't been compiled into the kernel.

Not only that, no users are allowed. not even root.

It's supplied preinstalled on a PC with no powerswitch. hell, no PSU even.

They think of everything...

Re:No skills required?

[Anonymous Coward]

What they mean is you don't need to be a Linux guru to set up the box. Everything is using web browser with a few clicks, even updating your system. The only thing is you have to sign up with GDSN to keep up with updates and support. I believe they have 30 days trial for it on the new version just released few weeks ago. Originally one could update the system without signing up for GDSN account (they publish updates through ftp) but that doesn't seem like gonna happen with this new release. I could underst

Good stuff!

[sokkelih]

I hope these guys do some co-operation with thingies like OpenBSD. I would love to see outcome of that. Great!

Something Different

[Ween]

Offtopic, but along the same vein, I would like to find a distribution of linux or *bsd that provides out of the box support for virtual mail hosting (many domains, 1 ip), name based virtual hosting, and the like. All with a simple to use console configuration. I've built my own several times, but thats time consuming. Anyone got any suggestions?

Re:Something Different

[3.5 stripes]

Have a look at e-smith

http://www.e-smith.org

Re:Something Different

[notestein]

I use this Mail Toaster [simerson.net] for FreeBSD.

Re:Something Different

[mchallis]

You might try This is qmail, vmailgr, courier, and squirrelmail on RH 7.3
Icon's rpm's for Redhat 7.3 and his guide will get you what you want in about 25 minutes. Just remember to install the rpm's before you run up2date or the updates will break parts of it.

Re:The debian server could use it!

[c.derby]

beware the goatse.cx link in the parent.

EnGarde Linux Flavors

[Anonymous Coward]

Engarde comes in two flavors: commercial and community. Community is the free version.

Re:EnGarde Linux Flavors

[jroysdon]

From http://www.guardiandigital.com/downloads/ [guardiandigital.com]:

"EnGarde Secure Linux Community Edition ...
Limited virtual Web, DNS, e-mail domain support"

WTF does that mean? Two domains? Five? Ten?

Hehe... slashdot effect

[GC]

Let's see how this baby performs against a Distributed Denial of Service attack....

Braino

[wowbagger]

While reading the summary, I misread

Openwall Project

as

Orwell Project

which, I personally feel would be an interesting name for a security enhancing project - right up there with Big Brother [bb4.com].

ENOCAFFINE

Re:Braino

[Anonymous Coward]

Hey pal... Americans built this website. Hell, americans built the internet, just ask Al Gore.

Sounds like..

[o1d5ch001]

OpenBSD lite. For the only interested in a partial code review...

Re:Sounds like..

[Anonymous Coward]

code review != security

it just helps reduce bugs/vulnerabilities

LIDS etc OTOH protect when a bug is found, something OBSD does not.

furthermore, OBSD audits the base intall, which is essentially usefull.

Secure by default only, 'cept noone only runs default.

Pricing.

[Qbertino]

What's this supposed to be?
Is this such a big fat hairy deal that you have to charge a minimum of 800$ for a "oh-so-extra-special-secure-Linux" distro?
Ok, if it's so easy to install that any Webdesigner could get it on right out of the box I say ok, let them Dreamweavers pay the price if they're to cheap for hiring a sysadmin to their team.
But I seriously doupt that this one pulls the trick better than a securepatched SuSE, Debian or OpenBSD.
Does anybody have solid expierience with this distro and can they testify that its bizar retail price is justified?

Re:Pricing.

[div_2n]

At a place I used to work we had two Engarde boxes sitting in a DMZ acting as DNS servers. In two years I was there they NEVER went down and as far as we could tell had never been cracked. Our IDS did record quite a few attempts though.

I can't say the same for our Citrix servers . . .

IMHO the price is definitely worth it. I have spoken with the CEO Dave Wreski many times and he has helped me through several tough problems. Hands down their tech support has been unbelievable. I recommend their product

"Pioneering OpenSource Security"?

[Fefe]

Ah, so these are the people OpenBSD learned everything from, right?

Has it occured to anyone that...

[Spleen]

"Improved Mandatory Access Control" would be iMAC ?

EnGarde is a good step forward

[jzarzosa]

It's good to see a distro that focuses on security. I've used version 1.0, and it did a decent job "out of the box". It'll be interesting to try out this latest version since some of the new features look very appealing.

Is there anyone out there that uses EnGarde in their production environment?

Re:EnGarde is a good step forward

[Koatdus]

Is there anyone out there that uses EnGarde in their production environment?

I have been using the community version of Engarde's last release as a 10 user email server for about a year. It has run flawlessly. The only downtime I have had the whole time was for a reboot after a kernel up grade.

Engarde has a very nice HTML front end that will get you started. I found however, that after I had been using the system for a little while I had modified things to the point that I didn't trust the HTML front e

LIDS vulnerability :)

[sneakybilly]

The installation howto for LIDS [lids.org] says that you can turn it off by appending security=0 as a kernel parameter in your boot loader. This seems silly since they go to a lot of trouble to ensure that even the root user can't kill its processess and stuff. What is stopping the root user from just editing the boot loader conf and rebooting with these parameters.