deb is to RPM...
as apt-get is to yum

RPM is NOT a package management system. Is is a package format! Yum/up2date is a package management system...

Study Finds Windows More Secure Than Linux:
cfelde writes "A Windows Web server is more secure than a similarly set-up Linux server, according to a study presented yesterday by two Florida researchers." In addition to the Seattle Times article, there is also coverage on VNUnet. From the article: "The researchers, appearing at the RSA Conference of computer-security professionals, discussed the findings in an event, 'Security Showdown: Windows vs. Linux.' One of them, a Linux fan, runs an open-source server at home; the other is a Microsoft enthusiast. They wanted to cut through the near-religious arguments about which system is better from a security standpoint."

Now the pullquote they didn't show you was this:

Ford said the idea was to represent what an average system administrator may do, as opposed to a "wizard" who could take extra steps to provide plenty of security on a Linux setup, for instance.

In my book, the "average" system administrator should definitely be taking any extra steps to ensure security on a box. If they don't, they shouldn't be administering systems.

One in five Unix houses expect to change operating system in the next three years. Four out of five of these expect to move to Linux.

Peerstone found two main barriers to widespread adoption of Linux: concerns of a higher total cost of ownership because of the high cost of Linux administrators; and fears raised by SCO's attempted "legal assault on Linux intellectual property".

Two points:

• High cost of Linux administrators: Don't these companies realize that their current Solaris expertise IS Linux expertise? There are of course little differences, but come on.... it's not like it's VMS or anything!
• We all know SCO is finished now, right?

chcon -R -t httpd_sys_content_t <path to web files>

Now for the meat:

So in Fedora Core 3 we now have SELinux enabled by default in the installation. I decided to leave it enabled because security is a "Good Thing" (right?) and I knew I was going to have to get familiar with it at some point. So this was all fine and good until I ran into the first piece of the system I wanted to work with that was affected by the default policy that's called "targeted".

The "targeted" policy confines certain network daemons to run in their own specific "security domain". These daemons include dhcpd, httpd (apache), named, nscd, ntpd, portmap, snmpd, squid, and syslogd.

When I setup apache on a system where it wil be utilized, I have a habit of not using /var/www/html as my starting point for document roots, but rather create a dir at /home/websites and place my document roots in there. In the good ol' days of Discretionary Access Controls (DAC) just making sure that apache had the perms it needed to read the documents in there was enough (using chmod, chown, and the like).

Not so with SELinux enabled. In addition to the regular DAC we're all used to, we now have Mandatory Access Controls (MAC) that define security contexts for files/directories etc. Turns out it looks like by default, apache only has access to /var/www/html when it's fired up.... I'm guessing that and probably /var/log/httpd (which is exactly as it should be). To enable apache to view my files in /home/websites, I had to apply a new security context to these files. The answer to this is the chcon command. To be brief, the full command I executed was:

chcon -R -t httpd_sys_content_t /home/websites

After executing this, apache could read my files.

Important links I found in troubleshooting:

http://fedora.redhat.com/docs/selinux-apache-fc3
http://fedora.redhat.com/docs/selinux-faq-fc3/

http://lwn.net/Articles/105409/

I like where this SELinux thing is going. Permissions done right, for sure. This doesn't come with out growing pains though. It's complex (or so it seems to me after only working with it for a couple days) and will take some time to learn. I'm prepared for some frustration....

Now many of you are probably asking yourself why would anyone (let alone me) want to bother with this? Well I think a simple example of one of the cool things is that even though something like /etc/passwd has DAC octal perms of 644 (rw-r--r--), apache still can't read it because that file is not with in apache's security context. So any users on your system can't write a little script that reads your /etc/passwd file and basically posts it on a web page for the world to see (giving potential crackers a list of valid user accounts on the system).

UPDATE: Thanks for the updated link Bob.