Subject: Re: Ask a question.. Thanks..
To: None <netbsd-advocacy@netbsd.org>
From: None <CaptnZilog@aol.com>
List: netbsd-advocacy
Date: 06/20/2001 11:28:44
>> I'd be appreciated if you can tell me which one of 
>> these operating systems is more secure in general and 
>> why.
>
> "Security isn't a tangible thing, it is applied > psychology."
>
>     Alec Muffett [author of "Crack"] 

Have to agree on this one, the queston is too general.
Its like asking, which is more secure "in general", a
Chevy or a Ford?  It really depends on what you put into
it in terms of security... a Chevy with a car alarm and
a "club" on the steering wheel is far more secure than a
Ford with neither, but does that make it more secure 
"in general"?

Having been with a ".com" with a million credit card
numbers in the database (Oracle/Solaris) and with both
FreeBSD and Linux boxes as well as Solaris, I can tell
you that on a fresh install, NONE of them were very 
secure.   As Bob so aptly put, any system in the hands of someone with no clue will not be secure.  Even with
OpenBSD, and its claim of "secure in its default install" will not be very secure if you decide to open
up telnet, ftp, and a host of other services.

Our basic strategy was to lock out every service with the exception of SSH, and open up what was needed.. so
a web-server would have ports 22(ssh), 80(http), and 
443(https) open...  and nothing else.  Use TCP-wrappers everywhere (installed PKG on Solaris 2.7)...

networks were layered...

the-world <-> firewall <-> load balancer <-> webservers <-> database

with no connectivity between layers... a hacker would have to break through the firewall, hack the webserver, and then hack down to the database.  Not that someone
will never find a way, but it'll be more difficult and 
more likely that we'd get alerted by the firewall or 
audit log monitoring by then.

As the quote says, its a mindset.