Date: Fri, 23 Oct 2015 19:20:40 -0400 From: "Michael B. Eichorn" <ike@michaeleichorn.com> To: Karl Young <karly@kipshouse.org>, "O. Hartmann" <ohartman@zedat.fu-berlin.de> Cc: freebsd-questions <freebsd-questions@freebsd.org> Subject: Re: replace uname -a informational string Message-ID: <1445642440.13154.38.camel@michaeleichorn.com> In-Reply-To: <20151023225524.GJ31202@mailboy.kipshouse.net> References: <20151023090805.5484ce9b@freyja.zeit4.iv.bundesimmobilien.de> <1445622325.1169.29.camel@michaeleichorn.com> <20151023225424.49220466.ohartman@zedat.fu-berlin.de> <20151023225524.GJ31202@mailboy.kipshouse.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Fri, 2015-10-23 at 15:55 -0700, Karl Young wrote: > > O. Hartmann(ohartman@zedat.fu-berlin.de)@2015.10.23 22:54:24 +0200: > > Am Fri, 23 Oct 2015 13:45:25 -0400 > > "Michael B. Eichorn" <ike@michaeleichorn.com> schrieb: > > > > > > First of all: Thank you very much for your concerns and answers. > > > > > On Fri, 2015-10-23 at 09:08 +0200, O. Hartmann wrote: > > > > For security purposes, I need to replace the informations given > > > > by > > > > "uname -a" > > > > to hode the kernel build system, name et cetera. > > > > > > I presume you intendend 'hide' here? > > > > > > If you want to scrub a binaries of _all_ information about the > > > building > > > system this is a problem Debian is actively working on called > > > 'reproducible builds' but is not possible today. > > > > > > https://reproducible.debian.net > > > > > > If you want to hide the hostname, why not just build with a > > > different > > > hostname set? > > > > Because it is not only the hostname, uname reveals the target host, > > date and OS version. > > > > In our case, the image ist built on a dedicated host for a security > > appliabce based on > > NanoBSD and I'd like to hide the OS type, the OS name, the build box' > > name and the build > > date. > > Perhaps you could mv or rm /usr/bin/uname and replace it with your own > script or binary that outputs whatever you want it to. > > -karl To make that work you would need to do a lot of work to prevent the user from using a copy of the original uname (or something similar). The information is actually in the kernel itself, uname is just mechanism to report it. And then there are tools like strings... [-- Attachment #2 --] 0 *H 010 `He 0 *H 000]0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 150613202446Z 160614003550Z0H1 0 U ike@michaeleichorn.com1%0# *H ike@michaeleichorn.com0"0 *H 0 UՀ,k9D %Z|Y6J<rrK g;&|uNlUE9)V.[ט̊:qS](#v SYDz* CpugYݔ,v<`j(w aS#ڒ6n(K5'KVLåErv< J=[}W bLA%gޭnVb| I?M7D :$׃bM_T[,ƃ\ 00 U 0 0 U 0 U %0++0 U jj: γ+39啖0 U #0Sr풜\|~5NԸQ0!U 0ike@michaeleichorn.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H x+ȐF}pw.X vF?rg P]EOp)L˻yA ;hi0u2]m [Sbp$_ gr Xm*YP3 #H>mKAǠt)HO|=@} 3ӝ'iO81> 03 v'h5U "H;ECZtpҗ4rWHu^6+i*kJL8shAV|5;?HMc\ j[j|+000]0 *H 01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0 150613202446Z 160614003550Z0H1 0 U ike@michaeleichorn.com1%0# *H ike@michaeleichorn.com0"0 *H 0 UՀ,k9D %Z|Y6J<rrK g;&|uNlUE9)V.[ט̊:qS](#v SYDz* CpugYݔ,v<`j(w aS#ڒ6n(K5'KVLåErv< J=[}W bLA%gޭnVb| I?M7D :$׃bM_T[,ƃ\ 00 U 0 0 U 0 U %0++0 U jj: γ+39啖0 U #0Sr풜\|~5NԸQ0!U 0ike@michaeleichorn.com0LU C0?0; +70*0.+"http://www.startssl.com/policy.pdf0+00' StartCom Certification Authority0This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.06U /0-0+)'%http://crl.startssl.com/crtu1-crl.crl0+009+0-http://ocsp.startssl.com/sub/class1/client/ca0B+06http://aia.startssl.com/certs/sub.class1.client.ca.crt0#U 0http://www.startssl.com/0 *H x+ȐF}pw.X vF?rg P]EOp)L˻yA ;hi0u2]m [Sbp$_ gr Xm*YP3 #H>mKAǠt)HO|=@} 3ӝ'iO81> 03 v'h5U "H;ECZtpҗ4rWHu^6+i*kJL8shAV|5;?HMc\ j[j|+040 0 *H 0}1 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1)0'U StartCom Certification Authority0 071024210155Z 171024210155Z01 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA0"0 *H 0 -).2AUGo#G B|NDRpM-B=o -we5JQpa>O.#._<V [~**pz~3WG .ᘟMlr[<Ce6fqO"uxfWN#uicgkv$Lb%y`_{`xK'GN 00U 00U 0 U Sr풜\|~5NԸQ0 U #0N @[i04hCA0f+Z0X0'+0http://ocsp.startssl.com/ca0-+0!http://www.startssl.com/sfsca.crt0[U T0R0'%#!http://www.startssl.com/sfsca.crl0'%#!http://crl.startssl.com/sfsca.crl0U y0w0u +70f0.+"http://www.startssl.com/policy.pdf04+(http://www.startssl.com/intermediate.pdf0 *H }x,\c^ #wMq}>UK/^yX֏y frMIŲB61ymQҨݬZ0& ;@#13qۑ& ̢o 6r_;GO>*I( 74XS1r3)!LJy6Kotˆ# _wSr ;B ADp(fs 䰷6%.W0J3:bC<8t X1<Cn=t==wST~\wkBf|15zUP)(IjVB!OfI=bb\4-*em/нSJm7N[]'@ڽ D9Kr>R7/|o^I@ټ'Pa $ z9a'L)( I}vcH]۸D*W} m>Q|C.(,lQ10001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 `He 0 *H 1 *H 0 *H 1 151023232040Z0O *H 1B@krZPb\PlH]p/o~!^^߯`^2(WFYh9$? ܈0 +71001 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 *H 101 0 UIL10U StartCom Ltd.1+0)U "Secure Digital Certificate Signing1806U/StartCom Class 1 Primary Intermediate Client CA]0 *H #(EzboUSٔCM~ww_4-FH{J ʔ5ئ:&qp`mIGXNȸ8BzE"_pCLa"J}thLcPή!EV TF- ^Aa nd>`}B5#u%q):vSm>S0 oVV 7qu9 @iOW%ٱOՆU(=(GqllHA
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1445642440.13154.38.camel>