Menu
▾
▴
Re: [Whonix-devel] OpenBSD gateway development
|
From: chiccofx <chi...@to...> - 2013-05-08 02:24:33
|
adrelanos: > Hi chiccofx! > > chiccofx: >> Hello Everybody, >> >> I am a new user to whonix, but an experienced *nix developer. I have >> read the faq about the question related with openbsd and security. I >> want volunteer myself to address many of those issues. > >> There have been >> some recent developments on the issues pointed by the faq. > > Will they get a secure package manager like apt/rpm? Unfortunately, as far as I am concerned, no. They still suggest to buy the dvd's/cd's which lead a trace back to the real identity. I have been a user of OpenBSD for hardened firewalling purposes for many years so there is a level of plausible deniability in my persona acquiring a set of cd/dvd. > >> Openbsd as a whonix gateway would not only decrease the attack >> surface, but the VM would required even less RAM than what is used >> currently. This would improve the overall user experience and allow >> more RAM to be assigned to the whonix workstation by default. >> >> Let me know what are your thoughts on this. I am planning to replace >> my current debian whonix gateway with an OpenBSD 5.3 (launched May 1) >> and see how it perform. Happy to share the result. > > Most interesting. As the FAQ says, I don't regard OpenBSD as very secure > myself in context of Whonix's threat model, especially due to the > OpenBSBD package manager not passing the TUF threat model, at least not > for ordinary users who don't run their own signed OpenBSD repository... > Since you use sourceforge for hosting and since users are already advised to not trust whonix, we could create a OpenBSD repository, signed initially with my key, and perhaps, in the future with the whonix project key. There cannot be hashes of the packages in the OpenBSD mirrors but, there is a hash of the ports file and some of the ports can be configured to get the source using https, and they do hash checking of the source, so it is secure in this manner (it gets the source from the official place and do check the hashes) > Anyway, other developers can come to different conclusions, that's fine. > It's quite interesting to see an alternative implementation of > Whonix-Gateway. I will support this effort with > questions/answers/comments, perhaps some code changes to prepare Whonix > source code better for such ports. > > So lets see where this goes. Whether you do this as a one shot or are > interested in merging this (so the builder can just switch an option in > build config), we'll see how it develops. If you share codes early, it > will be easier for me to follow how it develops. Looking forward to it. > Will start working on my free time as soon as possible. The OpenBSD project officially dropped sendmail in favor of OpenSMTPD. In your FAQ you stated that OpenBSD does not support PIE but, in facth, OpenBSD was one of the first mainstream OSes to support it. OpenBSD support complete ASLR support with PIE binaries since 2008. Also, it can be run in securelevel with not only prevents changes to the firewall ruleset as it does apply other restrictions, as not letting any kind of disk writing, among other things. Also, the tor package/port can be run on a chroot. All this will help to decrease the attack surface. I know that there are many criticisms to some of the security features of OpenBSD, but I have never had one machine compromised, either remotely or locally (using securelevel) > Cheers, > adrelanos Cheers, chiccofx > > ------------------------------------------------------------------------------ > Learn Graph Databases - Download FREE O'Reilly Book > "Graph Databases" is the definitive new guide to graph databases and > their applications. This 200-page book is written by three acclaimed > leaders in the field. The early access version is available now. > Download your free book today! http://p.sf.net/sfu/neotech_d2d_may > _______________________________________________ > Whonix-devel mailing list > Who...@li... > https://lists.sourceforge.net/lists/listinfo/whonix-devel -- GPG: 12E9 BCD6 5298 70B5 6C4C 7F1C 8C70 D6ED 188C AACE |
