Hello all,
The S4 kit (the Secure System Setup Script) is now available
(first public release, version 1.23) on the anonymous FTP site ftp.digex.net,
in the directory /pub/security/s4. MD5 signature for the tar file
sfour1.23.tar should be b35421c19cbc0dd949d07f0bc3c49ec5.
Many thanks to the software authors (I won't name them, they know who
they are, and I fear forgetting someone) who allowed their software packages
to be included in the S4 kit. Please remember that each such package retains
its own licensing terms (details on this are included in the S4 kit). The parts
which I have written from scratch are put in the public domain (details
are also included in the kit). Also many thanks to Digital Equipment for
lending the equipment that allowed S4 to exist...
Several warnings are in order:
1. Many sites seem to wish to mirror the software. It may be proper
to contact the site administrator to request permission before
starting a regular mirror. I am checking with the site administrator
to see his preference on this issue.
2. The S4 kit AS IS is very platform-specific. It will only run on
Alpha systems running Digital UNIX 3.2 -> 3.2D-2. All source is included,
so if enough volunteers are available, porting to other platforms should
be reasonably smooth.
3. If you intend to try installing S4 "as is" on a Digital UNIX system,
please make sure you do that on a system where the operating system
has just been installed from scratch. Running S4 on top of a system
that has many applications running is ALMOST GUARANTEED to destroy
the configuration of these applications. You have been warned!
S4 is intended for people who make system backups, and who are
capable and willing to restore full system backups when things go
wrong...
4. I have some friends (they know who they are :-)) who are running S4
configurations already. They should be aware that version 1.23 only
supports incremental upgrade from version 1.22. They probably should
contact me before attempting an upgrade (I don't trust the upgrade code,
I wrote it :-)).
5. The patched sendmail version (for nonprivileged chroot operation) as
included in the S4 kit is pretty dismal (I mean the patches :-)).
Eric Allman (who kindly took the time to review the first version
of the patches and prevented something even worse from being published)
has not even had time to review the final version of the patches.
Thanks again to Eric for his help. I PROMISE to do a better job on
sendmail 8.8.x (hopefully good enough to integrate directly in the main
release, so that there is no need for patches anymore).
6. For those who will dive headlong in the sources and who will complain
about the "crystal kitchen sink" that S4 is, please let me say:
a) my coding quality on this kit is indeed very poor. I hope that
collective work may improve this :-)
b) the ultimate goal of S4 is to be a complete system security solution
that can be installed quickly over a large number of machines.
A lot of good tools and techniques exist now, but sysadmins everywhere
are constantly asked to do more work in less time, and cannot reasonably
be expected to install by hand 32 security tools. Anything that
contributes to achieve this goal is good. The current S4 kit includes
no binaries and compiles everything as it goes. An important change
to be done in future versions of S4, for example, is to ALSO include
binaries so that a sysadmin can reduce install time by choosing not
to compile selected tools.
Sincere regards,
Marc Chatel
mchatel @
dial .
oleane .
com
Follow-Ups:
|
|
