Linux.conf.au 2010 Presentation: Developing and Maintaining Linux SOE Environments 

A summary of the presentation:

An overview of Griffith Universities SOE Linux teaching environments and hopefully a guide to how to develop your own.

This talk covers:

• The Griffith environment
• How to configure Networked Home directories
• How to lock down changes to the Gnome GUI
• Managing changes to large environments
• WUBI, what it is, and how it can be useful for Debian based images
• Imaging and deployment issues

Presentation and documentation have been uploaded and can now be downloaded... so go on, hit the button.

Download Conference Pack (ZIP)

The purpose of this document is to educate how to set up remote unattended backups for Linux machines in managed environments. For this to be successful several requirements have to be met.

IP addresses must be static or DNS names must be used.
Machines must be configured to use remote logins over an authorized connection. (The process is explained)
You must have the account access to the local machine that you want the backup process to run at (ie your user, or root for complete backups)
Port 22 must be open for SSH connections.

Our Senario:

Setting up an Authorized Connection

Using rsync to backup data

Make the script automatic

I originally decided to keep out of the debate on internet censorship in Australia. Its been a touchy subject for a little while and there are good reasons too do it, and a much larger list of bad ones. In terms of the technical viability of filtering the internet, ill let the governments report speak for itself. What I am more concerned about is the lack of oversight on such a dangerous list, at the very least there should be some sort of public court proceeding to limit abuse of the system. Bruce Schneider continually reiterates that any security measure is a trade-off between the amount of security you gain compared with the freedoms you surrender and the power that gives.

Currently other than the Great Firewall of China several other countries have filters imposed by their governements. These countries amoung others include Denmark,  Finland, and Thailand. These three countries are the focus of my conserns at the moment and I will deal with each in turn.

The Danish filter: Case Study in Secrecy and Lack of Oversight

The Danish filter can be used to censor anything, but is meant to be for child pornography sites found by the Danish police and the Danish "Save the Children" group, so far looking much the same as the proposed Australian filtering scheme. The list is generated without judicial or public oversight and is kept secret by the ISPs using it, again this seems remarkably similar to the currently proposed scheme. Even though the filter is not in, just referencing the filter, or in some cases even other filters, is enough to have you blacklisted as recently happened to the popular telecommunication forum Whirlpool. The front page of the site is full of links to news stories regarding the filter and the problems its creating. Currently the top ISP's are refusing to participate and the Australian Senate is refusing to approve the filter. Even talking about the filter is an unpopular subject and a link to the filter itself will have the offending linker charged $11,000 a day for exposing the Governements dirty secret. The only way this filter can work is if it is public, not private and subject to public enquiry and peer review.

It is also worth noting most sites on the Danish list are still censored (i.e must be on the current list reported to WikiLeaks), even though many have clearly changed owners or were possibly even wrongly placed on the list, for example the Dutch transport company Vanbokhorst.

The Finish Filter: Case Study in Silencing Critics

The Finish filter is meant to cover Internet sites outside of Finland that publish child pornography. The list is generated without judicial or public oversight and is kept secret by the ISPs using it (Do you sense a theme?). Unaccountability is intrinsic to such a secret censorship system and indeed the list has already expanded to cover other sites.  Some fuss has currently been raised over the banning of well know internet activist Matti Nikki's website who began posting links to incorrectly cagetorised sites currently blocked by the filter. Suddenly attempts to access his website from inside Finland would report that his website was hosting child pornography, something blatantly wrong... and downright suspicious. 

Its worth noting the criminal proceedings have started over his 'aiding the distribution of child pornography' and in news articles, the police have been quoted saying that his site could be considered a "child porn portal". Using the filter to censor... starting to sound like 1984 to anyone?

The Thai Filter: Case Study in Silencing Political Protest

 Thailands Ministry of Communications has also implemented a filter, for the exact same reason as everyone else; the noble goal of stopping child pornography. However like the others, referencing the list is illegal and the list is a tightly held secret with no oversight. Like the others sites are added that shouldnt be, but unlike Finland they are more blatant about the reasoning behind the block: of the 1,203 sites censored this year, all have the internally noted reason of "lese majeste" or criticizing the Royal family. 

The one common thread with these filters is that the filter is private, the method to add to the blacklist is uncontrolled, and does not have judicial or public oversight. The only way this filter can work is if it is public, not private and subject to public enquiry and peer review.

Its also worth noting that the Australian filter is on WikiLeaks, but I just dont have the money to link it, however the truth is out there.

Now that CanSecWest has all but wrapped up were left with some surprises.

Firstly a brilliant analyst known only as nils managed to take all three major browsers; Safari on OSX, Firefox on Windows XP, and lastly cracked the new IE8 browser on the second day. The only browser to survive the week was Googles new Chrome browser, a feat credited both to improvements in Windows and its unique sandbox implementation. Effectively to exploit Chrome you need three linked exploitable flaws. Some have been found to break through the browser but the second two layers have proven a formidable challenge. It just goes to prove the defense in depth methodology again.

There were some encouraging comments on the improving security of Windows with researchers remarking on the randomized processes that made it harder to find where in memory their exploit would run, effectively making it harder to exploit the local OS. Many researchers were especially impressed with nils for his exploits for exactly this reason; Its getting harder to do. The focus is now switching to Safari and OSX. There are no protections available at this stage to protect users. Many of the security features in Linux and Unix were removed to make the OS more user friendly and permissions were made more lax. The result of this is that the Safari browser is easily exploited, and the OS has no further protections available to prevent malicious code from being executed on the local machine.

I was very surprised when reading the comments on some of the reporting done at ZDNet and ArsTechnica about how the desktop is the most valuable target to exploit and servers are irrelevant. Yes, browsers are the most common exploit point that people will see, and YES... its true that you do have a wealth of information on your local machine. However 99.9% of the time what the exploits are used for is to create botnets, phishing attempts, or anti-virus/anti-malware scans, not to steal your data. Exploited servers give much more control over what you do. You accept odd requests or errors from trusted sites and click ok without thinking. Usually exploited servers is howthe exploits get on your machines in the first place. Servers are almost always more valuable targets, just harder to hit.