From owner-freebsd-security Thu Dec 21 13:59:33 2000 From owner-freebsd-security@FreeBSD.ORG Thu Dec 21 13:59:31 2000 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from secure.smtp.email.msn.com (cpimssmtpu07.email.msn.com [207.46.181.28]) by hub.freebsd.org (Postfix) with ESMTP id 53F7F37B402 for ; Thu, 21 Dec 2000 13:59:31 -0800 (PST) Received: from x86nts4 - 216.103.48.12 by email.msn.com with Microsoft SMTPSVC; Thu, 21 Dec 2000 13:59:30 -0800 Message-ID: <003701c06b9a$3123a890$fd01a8c0@pacbell.net> From: "John Howie" To: "Brooks Davis" , Cc: References: <20001219114936.A23819@rfx-64-6-211-149.users.reflexco> <20001219120953.S19572@fw.wintelcom.net> <20001219211642.D13474@citusc.usc.edu> <3A40BED3.1070909@2cactus.com> <20001220174056.C22288@citusc.usc.edu> <20001220174129.F19572@fw.wintelcom.net> <20001220175931.E22288@citusc.usc.edu> <20001220231205.W96105@149.211.6.64.reflexcom.com> <20001221060108.B26775@citusc.usc.edu> <20001221140435.F25684@indifference.org> <20001221134824.A29237@Odin.AC.HMC.Edu> Subject: Re: Read-Only Filesystems Date: Thu, 21 Dec 2000 14:05:55 -0800 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1800 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org ----- Original Message ----- From: "Brooks Davis" To: Cc: Sent: Thursday, December 21, 2000 1:48 PM Subject: Re: Read-Only Filesystems > On Thu, Dec 21, 2000 at 02:04:35PM -0800, kj@indifference.org wrote: > > To be truly, anal. Couldn't one just put a bios boot password on every > > server reboot (really how often do we need to reboot). And have a serial > > console hooked up to the server. > > > > That way if the attacker drops the security level and reboots, he can't > > modify anything as the server never boots up. It's major downtime, but > > better then a comprimise. > > Unless the next boot is a CD or floppy which does an integrity test of > the entire system that don't do much because as soon as the system boots > the security level bypassing compromise occures. Unless you're sure you > protected everything related to the loader, modules, and kernel this > could even happen if you just boot to single user mode. The password > would mean things took longer but they wouldn't actually stop you from > being back doored. Isn't paranoia fun. ;-) To be truly paranoid who says that the hacker hasn't found a way to reprogram that FlashBIOS you have on your motherboard and disk controllers. You might not actually be running the integrity checks that you think you are running and you could potentially even remove any boot-password anyway. Heck, if you are running on TransMeta's Crusoe the hacker could potentially even re-program the microprocessor itself. john... To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message