Subject: Re: Preventative security features?
To: None <hockey@dialectronics.com>
From: Simon J. Gerraty <sjg@crufty.net>
List: tech-security
Date: 01/01/2005 07:31:02
>Brett Lymn <blymn@baesystems.com.au> wrote:

>> I just see too many problems and very few advantages to slicing up a
>> big disk into itty bitty parts.

I mostly agree with that, for my netbsd boxes I have /+swap+var and one 
other mount point that gets the rest of the storage - but _isn't_ /usr.
I want to be able to upgrade the OS without hosing my local stuff.

But the low end models of a  particular brand of router which I'm 
familiar with run chrooted into an ISO fs image, which gives 99+% of 
the system as an immutable read-only fs.  Specific files in /etc are 
symlinks to volatile or non-volatile storage so that the system can 
still be configured/customized, but beyond that...

My point is, that you can make a dedicated box pretty tight, but it isn't
as comfy to live with as a generic workstation.

Of course, with so much money being made these days by criminals 
"owning" other peoples systems, the days of vendors shipping boxes that are
wide open by default should be just about over...

--sjg