The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


vulnerability in Linux Debian default boot configuration


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Thu, 3 Feb 2000 13:37:46 -0500
From: Ben Collins <[email protected]>
To: [email protected]
Subject: Re: vulnerability in Linux Debian default boot configuration

--LQksG6bCIzRHxTLp
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

Just a quick comment. This was discussed (if you call a flame fest a
discussion) to a great extent on Debian's list. To sum up the discussion:

a) The boot floppies were changed after this for potato to make sure the
   user knows about the default setup (the MBR that allows booting from
   floppy).

b) The vast majority of systems do not require physical security in this
   manner, and the benefits for rescueing failed systems using this
   feature outweighs the downside of the "issue".

c) It is felt that an admin who is first of all smart enough to setup the
   BIOS and LILO to disable floppy booting, and is in dire need enough to
   want this, should also be intelligent enough to know that the MBR is
   part of the boot process, and thus they should expect to make changes
   there aswell.

d) Given that 99.9% of computer systems are setup to not disable floppy
   booting (forsaking the obviously biased percentage of people on this
   list who do have it disabled), that it is not a problem to also have
   this as the default.

e) Anyone who wants true physical security will use physical measures to
   assure it. This means locked cases, locked racks, removing the floppy
   alltogether. Thus the MBR plays a minor role in this type of security.

f) RTFM. The mbr program docs, and the LILO docs explain about the MBR and
   security concerns dealing with it. Even disabling the floppy does not
   assure physical security in a public manner (such as the machines that
   the original poster is using...eg. publically accesable terminals).

Thanks,
  Ben

PS: I am not subscribed to BUGTRAQ at the moment, so please Cc questions.
concerns.

--=20
 -----------=3D=3D=3D=3D=3D=3D=3D-=3D-=3D=3D=3D=3D=3D=3D-=3D=3D=3D=3D=3D=3D=
=3D=3D=3D-----------=3D=3D=3D=3D=3D------------=3D-=3D------
/  Ben Collins  --  ...on that fantastic voyage...  --  Debian GNU/Linux   \
`     [email protected]  --  [email protected]  --  [email protected]     '
 `---=3D=3D=3D=3D=3D=3D=3D=3D=3D------=3D=3D=3D=3D=3D=3D=3D-------------=3D=
-=3D-----=3D-=3D=3D=3D-=3D=3D=3D=3D=3D=3D-------=3D--=3D---'

--LQksG6bCIzRHxTLp
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: Some people are fools, some are just foolish

iD8DBQE4mcr5fNc/ZB4E7C0RAVmMAKCOIo7xIj6h/V9zxzOcVeo4hU9hxQCcCW8K
VSE3LqLSvM02IhCyaW6QZfk=
=KzS7
-----END PGP SIGNATURE-----

--LQksG6bCIzRHxTLp--

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру