Subject: Re: Preventative security features?
To: Dmitri Nikulin <setagllib@optusnet.com.au>
From: Brett Lymn <blymn@baesystems.com.au>
List: tech-security
Date: 11/15/2004 15:47:52
last for this thread... I promise :)

On Mon, Nov 15, 2004 at 03:42:02PM +1100, Dmitri Nikulin wrote:
> 
> -You can move the Right Partition to the Right Place in the drive. swap 
> should be towards the start of the disk, lesser-written partitions 
> (home) should be towards the outer tracks.

Yes, but there is nothing stopping you putting the swap at the start of
the disk - you can put partition b from 0 - 100 cyls and then have a go
from 101 to the end of the disk.  In actuality, this is exactly what 
current installs of Solaris will do.

> 
> -Corruption of a partition doesn't affect other partitions.

I don't buy this one much - murphy will always make sure it is your most
precious partition that was skipped unaccountably from the last 10 backups
will be the one that gets munged.  I much prefer a reliable backup system
over partitioning and hoping my data does not get splatted by a random
nasty event.

> 
> -Re-installation with formatting (the expected way for significant 
> restructures of a base system) can easily affect only the system parts 
> and not /home. Backing up a large /home for a reinstall can be a severe 
> pain, especially if you don't have an external hard drive.
> 

I do agree with this one - personally I much prefer just to upgrade than
nuke and reload.

> -Read-only'ing partitions is more granular.

Yep.

> 
> -More partitions allows you to specify partition-optimized mount/newfs 
> flags.

Yep.

> 
> -Different file systems (of course). Now that NetBSD has UFS and a solid 
> LFS and both can be used for any partition without functioanl difference 
> (that NFS slowness bug got fixed, right?), users can choose between the 
> two. LFS could be useful for write-intensive partitions like /var to 
> provide a boost in performance and reliability.
> 

Yep.

You forgot exporting file systems - it is more secure to export just a
partition, no nasty traversing up the directories on the server fs if you
export a subdir.  Or maybe using cgd to secure your data.

All well and good, but I never said that you must only ever use one partition
what I do urge is that you THINK about what the machine is doing.  For most
people who just want to load up and play around there is little need for
a complex partitioning scheme - it may actually be a hinderence to them.

The old /, /usr, /var, /home scheme started back when disks were relatively
small - you did not have much choice but to chop things up, it just seems
odd that a lot of the drivers for that scheme have gone away but people just
keep doing the same thing because that is what they always did.

If you need extra partitions to help lock something down, sure, do it but
for me, these days I rather just stick with one partition because I have
been down the path of filling up one partition and then scrounging space
from another one using sym links - that quickly becomes an unmanageable
mess.

-- 
Brett Lymn