Front cover - IBM Redbooks

364 Lotus Security Handbook
problems as other operating systems. The major security issues for Linux are the
following:
► Root account: The one major rule that is regularly ignored is that “the root
account should not be used unless absolutely necessary.” The reason for this
rule is found in the power that root access offers to the person who uses it.
Like the Administrator account in Windows NT®, root is the highest-level
interactive login account that exists in Linux. The danger lies in the fact that
most exploited programs run with the permissions of the user who activated
that program. In other words, if the root account is being used while surfing
the Internet and a script is inadvertently executed on a Web page, this script
would then have root access, and could conceivably access any file or even
delete the entire file system. Worse, some distributions (such as Lindows)
require the use of the root account during installation and operation.
► Complexity: By far the most threatening issue regarding Linux is a complex
set of commands, concepts, and programs that must be understood for
security to be properly implemented. In fact, this can easily be seen when
Linux is installed for the first time by the newbie system administrator. While
some Linux distributions (versions) have started making decisions on behalf
of the person installing them, many Linux operating systems require the
installer to choose between cryptically named programs – contained
generally in packages and installed with rpm – or just installing the entire
operating system. Unfortunately, the list of several hundred programs is often
overwhelming. As a result, the person ends up installing the entire operating
system, including the HTTP daemon, FTP daemon, mail daemons, and so
forth – none of which are secure by default.
► Networking OS: As Maximum Linux Security states, “Although Linux is well
suited to personal use (even in non-networked environments), it is still
inherently a network operating system. Default Linux installations run many
Internet services, and unless you take proper precautions, attackers can
target these services remotely throughout the duration of your online
session.” This pretty much says it all.
► Open source updates: Much of the software created for Linux is written by
students, research groups, or software companies who are trying to find a
way to make Linux software profitable. When this is combined with the fact
that Linux is open source, it means that all the software is open to
examination by the world, and there exists a potential security nightmare. The
problem is not that open source software is any more insecure than
proprietary software. In fact, Linux vendors are known for having updates or
patches within hours of a reported security vulnerability. Instead, the problem
is that system administrators never receive word about these updates. For
example, Red Hat releases as many as five security bulletins a day that need
to be reviewed by a system administrator to see if they're applicable. While