Dear List, Not sure this has been shared here: https://vez.mrsk.me/freebsd-defaults.txt Some good points, others not so? Nevertheless a good read and food for thought and discussion. Sincerely, -- Steve Clement https://www.twitter.com/SteveClement mailto:steve at localhost.lu .lu: +352 20 333 55 65 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 842 bytes Desc: Digital signature URL: <http://lists.freebsd.org/pipermail/freebsd-security/attachments/20160713/9256592a/attachment.sig>
Steve Clement wrote on 07/13/2016 09:38:> Dear List, > > Not sure this has been shared here: > > https://vez.mrsk.me/freebsd-defaults.txt > > Some good points, others not so? > > Nevertheless a good read and food for thought and discussion.I read it in the past and I think some things are easily fixable on FreeBSD release side and should be fixed. Some things we modified on our installs. Miroslav Lachman
On Wed, Jul 13, 2016 at 09:38:59AM +0200, Steve Clement wrote:> Dear List, > > Not sure this has been shared here: > > https://vez.mrsk.me/freebsd-defaults.txt > > Some good points, others not so? > > Nevertheless a good read and food for thought and discussion.Most points is just inconvenience w/o security. IMHO, yes.
On 13.7.2016 9:38, Steve Clement wrote:> https://vez.mrsk.me/freebsd-defaults.txtThis document is based on premise I can't agree with. I will not dispute each argument in the document, but there are two main ideas. Features compiled in and features turned on by default. According features compiled in ... I'm administrator responsible for a computer configuration. If OpenSSH devs have publicly said threads are too risky and won't be added, I'm hearing their opinion and taking them seriously, but final decision shall be mine. I wish I will be allowed to decide I wish to use threads, NONE cipher and so on. In short, no features should be removed/disabled at compiled time because if "security" (assuming the "insecure" feature can be disabled by configuration). According features turned on by default ... To say true, I don't care them so much. Performance, backward compatibility and security require trade offs all the time. There are no generic answers. I assume the virgin installed system will be ready to be remotely configured (e.g. sshd running, no firewall). Particular system needs to be tuned according local environment, goal and requirements. Thus I don't care install-time defaults so much. Just $0.02 ... Dan