whats most secure unix type os?

[zeusfaber]

which is most secure openbsd, netbsd, freebsd, or perhaps a flavor of linux? and whats your reasoning?

 

[Chaotic42]

I have no first hand experience with it, but everyone I've talked to about it says that OpenBSD is the most secure. They apparently spend lots of time and effort to create a very tight system. Even my FreeBSD book has a little section about it.

Check out openbsd.org.

 

[Barnaby W. Füi]

OpenBSD, I can't sit here and name off things that they've done but there's plenty of them.

http://openbsd.org/security.html
http://openbsd.org/crypto.html

Search archives at deadly.org and you'll see announcements about plenty of things.

 

[zeusfaber]

can i run somthing like kde or gnome or other xwindows over the top of openbsd?

 

[TheOmegaCode]

Originally posted by: zeusfaber
can i run somthing like kde or gnome or other xwindows over the top of openbsd?

Why would you want to put KDE on the worlds most secure OS?

Anyways, yes, you can...

 

[zeusfaber]

hey im just curious about what i can do. i didnt know until i asked...

 

[Barnaby W. Füi]

Originally posted by: TheOmegaCode

Originally posted by: zeusfaber
can i run somthing like kde or gnome or other xwindows over the top of openbsd?

Why would you want to put KDE on the worlds most secure OS?

Why not?

Beware though, NetBSD (and I believe OpenBSD) tend to be less responsive as desktops, and mozilla may or may not be stable on them.

 

[skyking]

whats most secure unix type os?

Any patched one.
Seriously, a "better" one will have plenty of problems if it is exposed to the net without keeping it up to date.
The rapid publication of discoverd exploits and patches is a double edged sword: If you do not patch your box, you are out in the cold, and the hackers know the nature of the latest discovered exploit. Kind of chilling, in a way.

 

[n0cmonkey]

Originally posted by: skyking

whats most secure unix type os?

Any patched one.
Seriously, a "better" one will have plenty of problems if it is exposed to the net without keeping it up to date.
The rapid publication of discoverd exploits and patches is a double edged sword: If you do not patch your box, you are out in the cold, and the hackers know the nature of the latest discovered exploit. Kind of chilling, in a way.

I'll go one step further: The one with the better admin.

Patches are all well and good, but if you leave a daemon wide open through a misconfiguration...

 

[yukichigai]

Originally posted by: n0cmonkey

Originally posted by: skyking

whats most secure unix type os?

Any patched one.
Seriously, a "better" one will have plenty of problems if it is exposed to the net without keeping it up to date.
The rapid publication of discoverd exploits and patches is a double edged sword: If you do not patch your box, you are out in the cold, and the hackers know the nature of the latest discovered exploit. Kind of chilling, in a way.

I'll go one step further: The one with the better admin.

Patches are all well and good, but if you leave a daemon wide open through a misconfiguration...

And I'll go one step further to say one used by a low-visibility user nobody will care about. Seriously, if you don't stick your neck out much nobody will really care to hack you. How many grannies have you heard of who've been hacked lately?

 

[n0cmonkey]

Originally posted by: yukichigai

Originally posted by: n0cmonkey

Originally posted by: skyking

whats most secure unix type os?

Any patched one.
Seriously, a "better" one will have plenty of problems if it is exposed to the net without keeping it up to date.
The rapid publication of discoverd exploits and patches is a double edged sword: If you do not patch your box, you are out in the cold, and the hackers know the nature of the latest discovered exploit. Kind of chilling, in a way.

I'll go one step further: The one with the better admin.

Patches are all well and good, but if you leave a daemon wide open through a misconfiguration...

And I'll go one step further to say one used by a low-visibility user nobody will care about. Seriously, if you don't stick your neck out much nobody will really care to hack you. How many grannies have you heard of who've been hacked lately?

Are you excluding worms or just ignoring the fact that you don't have to be a big name target to wear a bullseye?

 

[TheOmegaCode]

Originally posted by: BingBongWongFooey

Originally posted by: TheOmegaCode

Originally posted by: zeusfaber
can i run somthing like kde or gnome or other xwindows over the top of openbsd?

Why would you want to put KDE on the worlds most secure OS?

Why not?

Seems kinda trite. OpenBSD is the most secure OS out of the box, but the more you mess with it, the more you open yourself up. Just the way I look at it...

 

[n0cmonkey]

Originally posted by: TheOmegaCode

Originally posted by: BingBongWongFooey

Originally posted by: TheOmegaCode

Originally posted by: zeusfaber
can i run somthing like kde or gnome or other xwindows over the top of openbsd?

Why would you want to put KDE on the worlds most secure OS?

Why not?

Seems kinda trite. OpenBSD is the most secure OS out of the box, but the more you mess with it, the more you open yourself up. Just the way I look at it...

The less you "mess with it" the less useful it is.

 

[yukichigai]

Originally posted by: n0cmonkey

Originally posted by: yukichigai

Originally posted by: n0cmonkey

Originally posted by: skyking

whats most secure unix type os?

Any patched one.
Seriously, a "better" one will have plenty of problems if it is exposed to the net without keeping it up to date.
The rapid publication of discoverd exploits and patches is a double edged sword: If you do not patch your box, you are out in the cold, and the hackers know the nature of the latest discovered exploit. Kind of chilling, in a way.

I'll go one step further: The one with the better admin.

Patches are all well and good, but if you leave a daemon wide open through a misconfiguration...

And I'll go one step further to say one used by a low-visibility user nobody will care about. Seriously, if you don't stick your neck out much nobody will really care to hack you. How many grannies have you heard of who've been hacked lately?

Are you excluding worms or just ignoring the fact that you don't have to be a big name target to wear a bullseye?

1) The number of worms or other malicious crap that you'll get sent without handing out your e-mail addy is minimal. Unless you have AOL.

2) Most ISPs have virus filtering software on their e-mail anymore, which, while not perfect, will catch most of the random stuff.

3) Did I say big name? No. I said stick your neck out. If you keep away from warez and "free porn" sites you'll find that the number of viruses you get drops dramatically.

4) You never answered how many grannies you've heard of who've been hacked lately.

 

[TheOmegaCode]

The less you "mess with it" the less useful it is.

I'd say you get less functionality, not usefulness.

I'm just wondering why you would want to install KDE on it if your main concern is security out of the box. OpenBSD's claim to fame is "Secure by Default," so the more you mess with it (and by mess with, I mean experiment with things you don't a lot about. much like when I try to "fix a TV" ), the more vulnerable you become.

*if i had a point, it was that if you're like me, still learning, you're not going to have security the first time you install something. you're going to have to dedicate a lot of time reading about what you're doing, why you're doing it, etc. So, if you're still asking questions about can I install X on openbsd, you might run into a few roadbumps along the way. I know a few of my friends that tried linux thought that just because they ran linux they were untouchable, they found out that wasn't the case very quickly. I've been lucky enough to only have someone tag a website of mine over a year ago...

 

[n0cmonkey]

Originally posted by: yukichigai

...snip...

1) The number of worms or other malicious crap that you'll get sent without handing out your e-mail addy is minimal. Unless you have AOL.

I disagree. Remember Code Red? All you had to do was install Frontpage or IIS (I think frontpage installed IIS for you, I can't remember for sure. Don't shoot me if I am wrong, a well worded flame is good enough ). Definitely not sticking your neck out, just playing around/running a family page/whatever.

2) Most ISPs have virus filtering software on their e-mail anymore, which, while not perfect, will catch most of the random stuff.

I'll take your word for it. I don't use Virus protection at home at the moment and have never touched my ISPs email address.

3) Did I say big name? No. I said stick your neck out. If you keep away from warez and "free porn" sites you'll find that the number of viruses you get drops dramatically.

I'll take your word for it. I stay away from porn and warez, and so do most of the people I know. But a low-key developer managed to get slammer because there was not a good admin around.

Do you realize how valuable a single host is? Its potentially 128kbit/s of DDoS bandwidth, a great way to hide your identity, the perfect place to start an anonymous ftp server... No warez or porn involved, except for the stuff thrown up on your system for the downloading enjoyment of everyone in the know. I've gotten some great porn through random systems on the net.

4) You never answered how many grannies you've heard of who've been hacked lately.

I don't know many grannies. But I do know plenty of idiot users (I use the term idiot in the most kind way possible).

 

[yukichigai]

1) Code Red was an exception, but that was one out of who knows how many millions of other viruses out there. Like I said, the number is minimal.

2) *nod, etc.*

3) I think you're thinking in terms of higher-end users than I'm getting at. The average home user isn't nearly as visible as a low-end developer.

4) I reffer you to my original #3, also titled "warez and free porn is the devil"


Crimeny, all this because I was trying to insert some levity into the thread.

 

[n0cmonkey]

Originally posted by: TheOmegaCode

The less you "mess with it" the less useful it is.

I'd say you get less functionality, not usefulness.

Are you a lawyer or do you just want to argue semantics?

I'm just wondering why you would want to install KDE on it if your main concern is security out of the box. OpenBSD's claim to fame is "Secure by Default," so the more you mess with it (and by mess with, I mean experiment with things you don't a lot about. much like when I try to "fix a TV" ), the more vulnerable you become.

Have you looked at a default OpenBSD machine? What "functionality" can that machine provide, without changing anything? An SSH server... That's about all I can think of. It can't serve webpages, not even static ones. It can't relay mail for your network. It cannot be a firewall. It cannot be an IDS. Frankly, I don't think of it as usable, except in very strict circumstances. But, if you want to use the box for more than something to SSH into, you have to make changes. Enable Apache, allow mail relaying from 10.10.10.0/8, setup PF, configure X and use it for a workstation, etc all give you something useful for more situations than an SSH gateway. When setup with extra daemons, although it adds the chances of adding more security holes through code and administration nightmares, you get more out of your investment. A server running no daemons is useless, a workstation that is not comfortable for the user is worse than useless (I think it can be counter productive).

*if i had a point, it was that if you're like me, still learning, you're not going to have security the first time you install something. you're going to have to dedicate a lot of time reading about what you're doing, why you're doing it, etc. So, if you're still asking questions about can I install X on openbsd, you might run into a few roadbumps along the way. I know a few of my friends that tried linux thought that just because they ran linux they were untouchable, they found out that wasn't the case very quickly. I've been lucky enough to only have someone tag a website of mine over a year ago...

This comes back to being a good admin. A good admin will read the documentation thoroughly. He will do some testing before deploying the system. He will do research to find out what the skinny is on whatever product or project he is playing with at the time.

 

[n0cmonkey]

Originally posted by: yukichigai
1) Code Red was an exception, but that was one out of who knows how many millions of other viruses out there. Like I said, the number is minimal.

The "I love you" worm. You didn't need to hand out your email address to a lot of people, just your friends. Due to their friends, you might have found a copy of it in your mail box. Klez happened to spread itself through a variety of means (its been a while, so I may be mixing up some of my viruses here ). I got an email from my grandfather a while back explaining about this file on my system with a teddy bear icon and how it was the worst virus ever. He managed to delete it from his system before it did any damage though.

2) *nod, etc.*

3) I think you're thinking in terms of higher-end users than I'm getting at. The average home user isn't nearly as visible as a low-end developer.

I beg to differ. Its the internet, everyone is anonymous. I'll still take 3,000 cable modem connected machine as a part of my botnet over 2 T1 corporate machines any day.

4) I reffer you to my original #3, also titled "warez and free porn is the devil"

Crimeny, all this because I was trying to insert some levity into the thread.

Guess it wasn't too funny

 

[TheOmegaCode]

Are you a lawyer or do you just want to argue semantics?

Meant it as levity, forgot the emoticon.

Have you looked at a default OpenBSD machine? What "functionality" can that machine provide, without changing anything? An SSH server... That's about all I can think of. It can't serve webpages, not even static ones. It can't relay mail for your network. It cannot be a firewall. It cannot be an IDS. Frankly, I don't think of it as usable, except in very strict circumstances. But, if you want to use the box for more than something to SSH into, you have to make changes. Enable Apache, allow mail relaying from 10.10.10.0/8, setup PF, configure X and use it for a workstation, etc all give you something useful for more situations than an SSH gateway. When setup with extra daemons, although it adds the chances of adding more security holes through code and administration nightmares, you get more out of your investment. A server running no daemons is useless, a workstation that is not comfortable for the user is worse than useless (I think it can be counter productive).

No, I do agree with you. Obviously you need to install and configure packages to add features/functionality/whatever. The question I originally asked was specifically geared towards zeusfaber. I wasn't being condencending. It's hard to convey intent over the internet, emoticons only do so much. You said it beautifully, if a user isn't comfortable with is workstation, it can be more than useless, it can be counterproductive. So, go out and install FreeBSD, NetBSD, OpenBSD, Debian, RedHat, whatever, and find out what you're most comfortable with, and disregard everything I've ever said

 

[zeusfaber]

i suppose i should try to defend myself... i just figured i would try something new and different thats very secure, and "can" be used for day to day tasks (thats the kde/gnome part). i used linux and freebsd, but never openbsd or netbsd.

 

[n0cmonkey]

Originally posted by: zeusfaber
i suppose i should try to defend myself... i just figured i would try something new and different thats very secure, and "can" be used for day to day tasks (thats the kde/gnome part). i used linux and freebsd, but never openbsd or netbsd.

Depending on the task, you may not need KDE or Gnome. I haven't needed either in quite some time.

EDIT: And I saw no need for you to defend yourself

 

[skyking]

Originally posted by: zeusfaber
i suppose i should try to defend myself... i just figured i would try something new and different thats very secure, and "can" be used for day to day tasks (thats the kde/gnome part). i used linux and freebsd, but never openbsd or netbsd.

For what you are proposing, freebsd will work fine. I would stick with something you know, unless you want to try out the other distros for experience-sake. That is a noble quest unto itself, but freebsd is plenty secure.

 

[TheOmegaCode]

Originally posted by: zeusfaber
i suppose i should try to defend myself... i just figured i would try something new and different thats very secure, and "can" be used for day to day tasks (thats the kde/gnome part). i used linux and freebsd, but never openbsd or netbsd.

No need to defend yourself, well at least not from me I'm just bored and curious.

 

[n0cmonkey]

Originally posted by: skyking

Originally posted by: zeusfaber
i suppose i should try to defend myself... i just figured i would try something new and different thats very secure, and "can" be used for day to day tasks (thats the kde/gnome part). i used linux and freebsd, but never openbsd or netbsd.

For what you are proposing, freebsd will work fine. I would stick with something you know, unless you want to try out the other distros for experience-sake. that is a noble quest unto itself, but freebsd is plenty secure.

There are other distros of FreeBSD?! :Q

Hook me up!