Hi,
With the release of FC3 SELinux is now enabled by default on Fedora.
For more details see http://fedora.redhat.com/docs/selinux-faq-fc3/
This is a great method of adding granular security to Linux.
As no policies probably exists at this point (for Asterisk) I realize that
it's a good idea to start the design of the neccessary policies. However,
SELinux is not for the faint of heart, and with the limiting/crippling
abilities that it has, I thought it a good idea if we try to poll the
efforts.
Looking a bit further on this I also realize that a specific security related
list is a possible route to take. For nothing but keeping it more accessable
and focused.
I also realize that we have not really seen much noise from this particular
area, but as anyone with security experience can say that does not mean we do
not have potential holes. The Best Practice outlook suggests establishing
guidelines for any service running on a server.
To this end many of us take extra precautions as to limit a possible
violation. SELinux brings with it a long needed granular control over each
process, and in general makes a server much more secure. Thus making its
benefits obvious to anyone who has a server available online.
The sheer volume and noise in Users makes it a hard place to conduct such
coordination. Being forced to keep up with the volume just to see what might
relate to any particular needs and interests is, as you all know, very time
consuming.
The process and experience of establishing and using various security modules
and methods will obviously have it's own share of problems. As it is so
different and yet demands particular attention to details, I want to check
for interest in creating and working with a security list for Asterisk. One
could use the Developer list but I don't think that's really the best
place
either as it is not related to developing Asterisk.
(As it might require coordination with developers too, I have CC'd that
list.
Where they can put their thought on the subject stricktly from their point of
view as developers.)
A security list would obviously carry all issues related to securing an
Asterisk box, and as such ought to be with digium, but if some issues for
some reason makes that undesirable, I might entertain the option of hosting
it on a seperate server.
--
Steve Szmidt
"They that would give up essential liberty for temporary safety
deserve neither liberty nor safety."
Benjamin Franklin