Advanced

Linux Security Basics, Part 1: Authentication (Distrowatch Weekly #321)

Posted by caitlyn on · 8 comments
DistroWatch; By Caitlyn Martin, Chris Smart and Ladislav Bodnar 		Mail this story
Print this story

Before I get into describing basic Linux authentication, the recent discussions made it abundantly clear that I need to first define what I mean by security. I also have to answer the most basic question which is why we need to bother with security at all. Some DWW readers claim to have all but ignored security without a single problem for many years. Those claims are undoubtedly true. That doesn't mean the potential for real problems isn't present. Kurt Seifried, in his Linux Administrator's Security Guide, writes: "You only need to make one mistake or leave one flaw available for an attacker to get in. This, of course, means that most sites will eventually be broken into." He adds: "All technical security measures will eventually fail or be vulnerable to an attacker. This is why you must have multiple layers of protection."

Full Story

  Nav
» Read more about: Story Type: Tutorial; Groups: Linux

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (8)

tuxchick ·
Too many concepts! Too technical! I don't have anything to hide anyway. Typing a password is work! How can I be expected to remember?

There, got that out of the way.

While Ubuntu's implementation of sudo generates some controversy, the thing that bothers me is their disregard for a good personal firewall. Sure it ships with no open ports/running services, but no system is static and users make changes. Layered defenses is a fundamental principle. Duh :)

The horrid passwords I have encountered... I just helped a friend with his computer and his login was his first name, password last name. Help meeee.

Thanks Caitlyn, I hope this opens a few eyeballs.
gus3 ·
Probably not, TC. The most likely to read it, are already aware; those who aren't aware, don't care.
caitlyn ·
If the DistroWatch comments are any example many who do read won't care either or will try and nitpick to prove that it really should all be ingnored.
tuxchick ·
Oh I think there are a lot of readers who will enjoy and learn from it. The smart ones will know better than to duke it out with trolly commenters.
Steven_Rosenber ·
TC, I worked on a box last week on which the root password was set to NOTHING. Meaning you boot it, type login: root, then just hit return at the password prompt and you're logged in as root. ... this was a Solaris box, and it wasn't in production, but still ...
tracyanne ·
Excellent advice. I never let my clients create their own passwords. I talk them through the process, explaining why a strong password is necessary, and create a strong password as we go, and give that to them, usually something along the lines of

A-5tr0nG-Pa5sW0rd

krisum ·
Quoting: the thing that bothers me is their disregard for a good personal firewall. Sure it ships with no open ports/running services, but no system is static and users make changes.
This looks to be common feature across many distros including Debian.
tracyanne ·
I'm pretty sure Mandriva has a fire wall, it certainly did last time I installed a test of 2010.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post