Re: Removing System Consoles from Fedora

Tom Horsley wrote:
> On Tue, 16 Sep 2008 10:20:06 -0700
> Rick Stevens <ricks <at> nerd.com> wrote:
> 
>> For example, PCI compliance says that you must render the
>> machines as physically difficult to get into as you can.
> 
> So, you let the Italian Communist Party dictate what you
> do? .

That's what I love about acronyms...they can mean anything! 
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer                       rps2 <at> nerd.com -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-   Errors have occurred. We won't tell you where or why.  We have   -
-                         lazy programmers.                          -
----------------------------------------------------------------------

--

-- 
fedora-list mailing list
fedora-list <at> redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

Re: Removing System Consoles from Fedora

Dave Feustel wrote:
[snip]
>> 1. Machines do not have X installed and boot to run level 3
> 
> Having spent some time running X on OpenBSD, FreeBSD, Fedora, and now SUSE 11,
> I am convinced that using X on any of these platforms enables exploits that
> cannot be disabled.  You cannot have both security and X. Take your pick. I do
> not log in as root in X for any reason since there are ways in X to listen in
> on keyboard communications and capture passwords. So far as I have been able to
> tell, this is not possible with non-X console io.

ANYTHING over the net can be hacked, given enough CPU cycles and time.
You can mitigate it requiring everything be heavily encrypted (including
X).  It's not perfect, but it's as close as you're going to get.  There
is such a thing as making a machine so secure it's unmanageable.

>> 2. /etc/inittab modified to NOT spawn gettys on the VTs
>> 3. /etc/inittab spaws serial port getty connected to a serial KVM
>> 4. grub configured to also use the serial port for its console
>>
>> This is in addition to them being in cage with a deadbolt lock on the
>> door, and the cage being in a data center with physical access
>> restrictions, cardkey access and video surveillance.  Yes, it's a bit
>> onerous, but it is required.  Whether you think they're "good reasons"
>> is irrelevant.
> 
> I have read that Congress passed a law in 1995 mandating undetectable
> hardware access to all computers connected to the internet.

The law, IIRC, was held unconstitutional and the US Attorney stated that

Re: Removing System Consoles from Fedora

Dave Feustel wrote:
> 
> Having spent some time running X on OpenBSD, FreeBSD, Fedora, and now SUSE 11,
> I am convinced that using X on any of these platforms enables exploits that
> cannot be disabled.  You cannot have both security and X. Take your pick. I do
> not log in as root in X for any reason since there are ways in X to listen in
> on keyboard communications and capture passwords. So far as I have been able to
> tell, this is not possible with non-X console io.
> 
This is much harder to do with current versions of X. Unless you
disable authorization, the X server will only talk to programs
started by the user logged into the console. This includes logging
into the cli as the user. (It is possible to do it as the user, or
root, with some extra work.)

As for reading a cli keyboard, you may want to look at the keybdev
as well as the different keyboard drivers. I am not sure if it would
be easier to modify one the keyboard drivers, or interface with
keybdev - both look promising.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

--

-- 
fedora-list mailing list