From owner-freebsd-security Fri Sep 17 19: 7:43 1999 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id 7E083154D4 for ; Fri, 17 Sep 1999 19:07:38 -0700 (PDT) (envelope-from brett@lariat.org) Received: from mustang (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id UAA17036; Fri, 17 Sep 1999 20:07:30 -0600 (MDT) Message-Id: <4.2.0.58.19990917162715.047cbb10@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Fri, 17 Sep 1999 16:29:27 -0600 To: "Matthew D. Fuller" From: Brett Glass Subject: Re: Securing a system that's been rooted remotely (Was: BPF on in 3.3-RC GENERIC kernel) Cc: security@FreeBSD.ORG In-Reply-To: <19990917171656.H4975@futuresouth.com> References: <4.2.0.58.19990917155850.047bd680@localhost> <4.2.0.58.19990916232349.047c27a0@localhost> <4.2.0.58.19990916185341.00aaf100@localhost> <19990917134343.P16305@futuresouth.com> <4.2.0.58.19990917155850.047bd680@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org The problem is similar to that of having a standard "administrator" password that has to be changed during installation of a hardware/software product. A certain percentage of people -- no matter how smart -- will neglect to change it. Just as a general rule of thumb and guiding principle, things that make the system more insecure should be off by default. --Brett At 05:16 PM 9/17/99 -0500, Matthew D. Fuller wrote: >You missed my main thrust. >Why would you go to all the trouble to enable securelevels (usefully. >read; flagging everyone and their mother), and still be running GENERIC? >If you're not running GENERIC, you're running a custom kernel. If you're >running a custom kernel, you're customizing stuff anyway, so you can take >out/put in bpf or whatever you want. Where's the problem? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message