Is it Okay to Disable SELinux or AppArmor?

I am flabbergasted at what some so-called, self-anointed 'Linux Experts' offer in the way of sound technical advice.

Take Igor Ljubuncic (aka Dedoimedo) for example.  He seems to be a smart guy and many look to him for reviews of Linux Distributions.  But, I tend to disagree with him about as much as I agree.

His latest story, Linux Mint vs. Ubuntu Security, spurred me to write this post and as it is more than a bit problematic and misguided, I take exception here to disagree with his security recommendation.

As we, in the IT business, should know, security is a process, not a thing.  The effectiveness of one Distro's security implementation may or may not be as good as another's.  And, how each Distro's developers choose to configure security isn't necessarily guided by good decision making.  In fact, I have written, many cookie-cutter clones, or spins if you will, inherit the bad design decisions of their parent Distro, which is one of my pet peeves for why cloning is not necessarily good for Linux at large.

It was causing problems so we disabled it

A response to resolving Linux Security Modules (LSM) issues often heard is the advice given to disable the 'offending' module entirely, when such errors arise.

Igor writes:

Aha, I knew it. There you go. Linux Mint does not ship with AppArmor or any profiles. Well, interesting, not. The thing is, security tools like Apparmor or SELinux are much like HIPS software in Windows. In other words, not necessary. Moreover, they usually cause more harm than good by blocking legitimate software from running. What we like to call the false positive, or fail publicly (FP).

Here, Igor takes it upon himself, despite the considerable design efforts put forth by Canonical Ltd. to provide enhanced LSM sandboxing technology, to marginalize the importance of such technology.  I find that rather irresponsible, given today's situation, what with world-wide rampant security exploitation and surveillance on the Internet growing by leaps and bounds.

No, I am afraid Igor is giving bad advice and has no business telling readers to disable a service provided by software vendors, backed by good justification and years of experience.  

Igor goes on to say:

Indeed, if I look at the history of my involuntary use of Apparmor and SELinux in various distros, I have seen the former kick in only once, and the latter about three dozen times, and each example was a case of a legitimate program being mislabeled. In theory, yes, they might prevent exploits, but you're not running a commercial Web server, so relax.

So, on the one hand, he's admitting that LSMs do indeed prevent exploits, yet on the other he's suggesting (paraphrasing) there was a bug in mislabeling a legitimate application.

So, why, then, did Canonical choose to include LSM AppArmor with Ubuntu and Fedora choose to include LSM SELinux for their several Desktop spins?  

Evidence like Stuxnet, Identity Theft, Ransomware, Malware, Bots, Keyloggers ought to be good clues as to the gravity of the situation.  This clearly isn't sensational.  It is real and happening to the unwary every day.  Igor, strangely, minimizes the seriousness of the situation.

What should be done in the case of a reproducible LSM sandbox error?

If you are experiencing a reproducible error (verses a 'one-time' intermittent error)  using a signed application in your Distro's software repository, do open a software support call ticket on their website so that the vendor can take immediate corrective action.

Don't disable your LSM sandbox.  Go directly to your software vendor for support.  Your issues will be resolved expediently with revisions to your security software. 

-- Dietrich

Related articles

• Configuring and Managing selinux in Red Hat Linux
• Introduction to AppArmor
• An introduction to security models in Linux

Read More

Linux Systems Administrator Tools to Die For

by Dietrich Schmitz

You are the 'go-to' Linux Systems Administrator for your organization.

The fact is, you have a lot to do and there are only so many hours in a day.  So, you are always looking for new ways to leverage the use of your time.

Here is a list of popular tools which should be in every Admin's toolbox that provide time-saving functions and features that will help in all manner of troubleshooting and problem-solving situations.

Nmap/Zenmap

Nmap is one of those tools that simply cannot be overlooked and will save hours of guess work when troubleshooting a network.  Used to discover hosts and services on a network from the command line an accompanying graphical package can be installed, called ZenMap.

Command Line Utilities

These command line tools are some of the most commonly-used system utility programs for every-day system administration.  To get help, read the respective man page for each.

ssh, screen, vim, awk, sed, Perl, Netcat, Nslookup, ping, whois, traceroute, Netstat, dig, dd, tcpdump, rsync

WireShark

Wireshark is an open source packet analyzer.  It is simply indispensable when it comes to troubleshooting network connections and provides visualization in a Gtk graphical display of every minutiae for the protocol being traced.

BitDefender System Rescue CD

System Rescue CD provides a Live bootable CD for performing Anti-Virus scanning of any volume.  It's advantage comes from being able to bootstrap (pen drive or CD) into Linux on a Windows PC and scan the Windows NTFS drive partition for virus detection off-line.  Doing a full scan off-line ensures the persistent signature of a virus will be detected.  Quite often, Viruses evade detection by on-line Windows AV software, so this is a good security tool to have for a network having both Windows and Linux PCs.

Virtual Network Computing (VNC)

VNC, was released as open source and licensed under GPL.  It has several derivative versions, including RealVNC, TightVNC, UltraVNC, all of which allow remote desktop access and control over a network.  This free tool is popular for performing IT support in an organization for obvious reasons.

FreeNX

FreeNX is a subset of the commercial NX thin client protocol for remote desktop computing.  FreeNX is open source and licensed under GPL and offers free NX-based thin client terminal access to a Linux Server.  NX has programming optimizations which reduce the amount of X Windows metadata semantics which must travel across a connection by only sending the 'delta' portion of a screen change.  This effectively results in near-local machine performance over long distances and even on low-bandwith 56K dial-up connections. NX by default is secured and running over a tunnel-encrypted secure shell (ssh) connection.

OpenVPN

OpenVPN is an open source GPL licensed Virtual Private Network (VPN) solution.  Linux NetworkManager plugin architecture provides an OpenVPN module for easily setting up Client PCs with access to a corporate-firewalled VPN private subnet.  VPNs by default expose both TCP and UDP port ranges for all ip-ranges defined in the OpenVPN configuration.  This effectively means a remote PC can see and use all corporate resources while tunneled over a VPN secure encrypted connection the same way as a locally connected PC.

Chrome Remote Desktop

Popular Google Chrome web browser has become an indispensable tool for so many reasons.  One need only visit Google's Chrome Web Store to see the array of applications and plug-in extensions available for download.

Among these extensions is found Chrome Remote Desktop.  Chrome Remote has become a popular easy way to provide remote PC assistance.  It is free and the only requirement is that both end-point PCs be running Chrome with the Chrome Remote extension loaded.  Chrome Remote doesn't require special firewall pass-through rules and uses it's own Google server tunnel encrypted protocol (middle-man) to bridge across any firewall for unimpeded access.

Kernel-based Virtual Machine (KVM)

Kernel-based Virtual Machine (KVM) is built into the Linux Kernel and free.  KVM is a type 1 hypervisor providing 'bare metal' performance and is competitive with other Virtual Machine host software vendors such as Citrix ZenHost, VMware, ProxMox, and most recent Linux Containers (LXC).

Virtual Machines offer many benefits not the least of which is quick deployment of servers as resource loads on a VM host without the need to procure additional server hardware.  All hardware is emulated in the virtual machine.  Many IT shops are trending with collapsing down racks upon racks of rack servers into a consolidated high-performance host virtual machine 'farm'.  The multi-core VM host handles the processor overhead of the former bare-metal hardware based processors transparently, reduces power consumption, increases 'high availability' (little or no down-time).  These features increasingly make transitioning to virtual machines a 'hot' technology, and a very competitive one.  Knowing a modicum about KVM will give the Linux System Administrator a sharp technical edge and automatic advantage in today's cost-cutting tight-budget IT environments.

SELinux/AppArmor

SELinux, a Linux Security Module (LSM) is at the very core of Linux's security design, originally developed with assistance from the National Security Agency.  SELinux essentially defines Mandatory Access Control for each application running in its sandbox.  Applications must adhere to a profile of expected or allowed normal behaviors and any deviation from those policies is automatically undefined and will be rejected by the SELinux kernel module.  The Mandatory Access Control is quite effective and you will find SELinux present in Red Hat Linux, Fedora Linux, and an LSM called AppArmor running by default in Ubuntu Linux.  Learning either SELinux or AppArmor is an imperative for today's Linux System Administrator to gain a competitive advantage in the IT job market.

Samba

Samba is an open source free software application which re-implements the  SMB/CIFS networking protocol for sharing files across a network.  SAMBA4, recently released, now includes support for acting as a wholesale replacement for a Windows Active Directory Primary Domain Controller (PDC).

If you watch technology trends as closely as I do, you will realize the implications of Samba4 are quite big.  Already there are Samba PDC stack vendors competing to sell Windows AD PDC implementations replacing Windows Hardware and unencumbering buyers of Windows Licensing restrictions and cost.  Learn as much as you can about Samba.  You'll definitely score high the more you know and IT retention usually takes into consideration those who have the most important skills.  Catch my drift? ;)

Nagios System Monitor

Nagios may not be the newest System Monitor on the block, but, still, its reputation precedes it.  That means its deployment will greatly lower some of the inherent risks that every IT department faces.  Nagios when properly configured will monitor your entire network of services and based on its rule set notify you if/when a service goes down.  That can keep your down-time vulnerability to just minutes when you are sitting at home and get an SMS text message that one of your servers is off-line.  Quickly responding from anywhere with remote corrective action might mean that no one will even know there was an issue or you will have a chance to act before reaching work on a Monday as opposed to having a down system during production hours--an IT manager's worst nightmare.  It's just good business practice in today's world to set up and configure a system monitor for your IT shop.  It will pay over and over for itself.  I promise.

Clonezilla

You know, in the proprietary software world, you can spend a lot of IT dollars without blinking an eye.  Every time you turn around Symantec has another License renewal that must be paid for.

Ghosting machines doesn't have to cost money.  In fact, Clonezilla does everything Symantec Ghost does for free.  So if you pre-image your PCs using Ghost, switch to Clonezilla and get those software license IT dollars back into the budget by doing the job for free.  This is another cutting edge skill you will want to get under your belt.

So, that's it.  I think that covers the range of skills areas over which a Linux System Administrator will want to have maximal efficient control.  Stay smart.  Use the 'best of breed' tools you can find and run a tight IT shop with open source Linux tools 'to die for'.

-- Dietrich

Related articles

• How to graphically control a remote machine
• VNC Viewer for Google Chrome
• Linux Foundation is looking for an awesome sysadmin
• Linux Jobs in 2013, a Q&A with Dice's Alice Hill
• Install and Configure Nagios in CentOS 6.4 / RHEL 6.4

Read More

Pwn2Own: Why are Software Vendors Responsible for Security?

By +Dietrich Schmitz

(tap tap....is this mic on?)

Windows 8 (x86) Security
A veritable leaking collander.

Each year Pwn2Own comes, I think about the current state of Vendor software development.

So far as I can tell, several hackers have succeeded in pawning Windows Legacy (x86).  And from my perspective security should not be part of the responsibility of third-party software developers, that is, to bolster their applications with security sandboxes.

No, this is a complete diversion from the real, ongoing, old story.  Microsoft's Windows 8 Legacy (x86) suffers from and inherits the circa 2000 WinNT kernel replete with all of its attendant security woes-- Windows is a collander.

Read More