Great Circle Associates Firewalls
(February 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Web server security
From: Pierre . Beyssac @ hsc . fr (Pierre Beyssac)
Date: Thu, 20 Feb 1997 19:18:45 +0100
To: long-morrow @ CS . YALE . EDU
Cc: cowboy @ home . byelex . nl, jeromie @ garrison . com, firewalls @ GreatCircle . COM
In-reply-to: <199702191521 . KAA05246 @ SPARKY . CF . CS . YALE . EDU>; from long-morrow @ CS . YALE . EDU on Feb 19, 1997 10:21:07 -0500
References: <199702191521 . KAA05246 @ SPARKY . CF . CS . YALE . EDU>

According to long-morrow @
 CS .
 YALE .
 EDU:
> because the server process or the Mac itself might crash during the
> night and stay down until morning.  Unix and NT machines -- though
> more likely to be broken into -- are more reliable at keeping server
> processes up and running (they can even babysit them and restart them

It might be understood that you're saying that Unix and NT are
_inherently_ less secure than MacOS (the same claim is made for Unix
vs NT).

But it should be made clear that this is _only_ a consequence of the
fact that many more services are available "out of the box" on Unix
than on NT, and on NT than on MacOS. A cracker can't login on a machine
if it allows no remote login. Even less it the OS doesn't allow that
because you didn't purchase the option, of course.

But if you want to secure a Unix machine as much as possible, you
can perfectly disable _all_ external services except the HTTP server,
making it as secure as MacOS. And much more reliable. You can even
remove rlogind, telnetd and the like if you're really paranoid.

Then you need to choose a secure HTTP server, which is a different
thing. Having a secure OS will not magically secure your HTTP server !
Bugs recently discovered on NT servers (for example the ../.. stuff)
have generally been fixed two or three years ago on Unix HTTP servers.
They're just 2 or 3 years more mature...
-- 
Pierre .
 Beyssac @
 hsc .
 fr


Follow-Ups:
References:
Indexed By Date Previous: ISDN and firewalls
From: aub @ atmsys . com (Alberto Begliomini)
Next: Re: A Comment on Content
From: "Fir E. Walls" <walls @ linux . silkroad . com>
Indexed By Thread Previous: Re: Web server security
From: Kevin McPeake <cowboy @ home . byelex . nl>
Next: Re: Web server security
From: Kevin McPeake <cowboy @ home . byelex . nl>

Google
 
Search Internet Search www.greatcircle.com