** Simon Huggins <huggie@???> [2008-05-01 16:13]:
> On Thu, May 01, 2008 at 03:39:00PM +0100, Paul Tansom wrote:
> > ** Andy Smith <andy@???> [2008-05-01 14:14]:
> > > On Thu, May 01, 2008 at 01:54:54PM +0100, James Courtier-Dutton wrote:
> > > > Um??? So where is the question? I don't see any question marks at all
> > > > in that entire email!!!
> > > I think it was just a chance to say "I don't like ubntbuntntutntu"
> > > :-)
> > ** end quote [Andy Smith]
> > The question was in the first 3 lines, although I have to admit that for
> > some reason it didn't end up in a specific question format with a ? at
> > the end:
> > "I'm having trouble finding any reference to any directory/file
> > permissions changes that Ubuntu have made to Debian."
>
> > Which sort of implies the question "Does anyone have any
> > references/links to what Ubuntu may have changed in terms of
> > directory/file permissions?"
>
> I'm not sure it makes much sense as a question though. I mean you have
> the debs so you can compare them but that won't really help you work out
> the effects of the changes.
>
> Are there specific things you think are less secure?
>
> I think you'd be better off doing an audit for running services you
> don't want, things you can see as a normal user (i.e. not in any admin
> type groups) that you don't want to etc.
** end quote [Simon Huggins]
The thing that started me thinking was when I started looking at the log
files from the CLI on my Ubuntu install and suddenly realised that I was
viewing files that were restricted on my Debian box. That seemed a
security issue that I may consider addressing and started me wondering
what else had been tweaked in terms of file and directory permissions in
order to allow things to work with sudo without the need to use a su(do)
shell - so what else had been opened up to the standard user accounts
view that you may prefer not to be.
Doing a massive audit against the debs isn't practical, so I started
looking for some reference as to changes beyond 'simply' updating
packages, defining a clear set of packages and configurations, and
extensive testing. So sort of an overview of what Ubuntu did to Debian
to get to their own distribution. I guess it is partly a case of having
stopped to think "they've used Debian as a base which I've been happy
with, but what have they done that I should be aware of?" sort of thing!
--
Paul Tansom | Aptanet Ltd. |
http://www.aptanet.com/ | 023 9238 0001
======================================================================
Registered in England | Company No: 4905028 | Registered Office:
Crawford House, Hambledon Road, Denmead, Waterlooville, Hants, PO7 6NU
