Subject: Re: Preventative security features?
To: None <tech-security@netbsd.org>
From: Dmitri Nikulin <setagllib@optusnet.com.au>
List: tech-security
Date: 11/13/2004 20:32:58
On a related note, here is a comparison of nmap against a Linux 
2.6.9-gentoo-r1 machine and a NetBSD 2.0rc4 machine both running OpenSSH 
on port 4222.

# nmap -O -sV -v -p4100-4300 -T5 dirk

Starting nmap 3.75 ( http://www.insecure.org/nmap/ ) at 2004-11-13 20:22 EST
<you all know this part>
PORT     STATE SERVICE VERSION
4222/tcp open  ssh     OpenSSH 3.8.1p1 (protocol 2.0)
MAC Address: 00:10:B5:12:EA:FA (Accton Technology)
Device type: general purpose
Running: Linux 2.4.X|2.5.X|2.6.X
OS details: Linux 2.4.18 - 2.6.7
Uptime 0.240 days (since Sat Nov 13 14:36:34 2004)
TCP Sequence Prediction: Class=random positive increments
                         Difficulty=4079068 (Good luck!)
IPID Sequence Generation: All zeros

Nmap run completed -- 1 IP address (1 host up) scanned in 2.115 seconds

Versus:

# nmap -O -sV -v -p4100-4300 -T5 odin

Starting nmap 3.75 ( http://www.insecure.org/nmap/ ) at 2004-11-13 20:22 EST
<you all know this part>
PORT     STATE SERVICE VERSION
4222/tcp open  ssh     OpenSSH 3.6.1 (protocol 1.99)
MAC Address: 00:06:5B:01:C1:05 (Dell Computer)
Device type: general purpose
Running: NetBSD
OS details: netbsd 1.6ZH - 2.0RC4
TCP Sequence Prediction: Class=random positive increments
                         Difficulty=10365408 (Good luck!)
IPID Sequence Generation: Incremental

Nmap run completed -- 1 IP address (1 host up) scanned in 3.072 seconds

NetBSD is a clear winner of course, but it still found the OS pretty 
accurately. On another note, it's an interesting thing that the NetBSD 
box took longer to scan, even though it's much faster and under less 
load. Even scanning localhost on NetBSD takes a long long time, but 
under Linux it's instant (possibly an nmap hack since I doubt NetBSD is 
slow at loopback sockets)

I don't have a FreeBSD box available to comment on, but in all of my 
previous investigations it was not identifiable and the Difficulty was 
maximal (all 9's). IPID had something good to say but I forgot what. 
This is a Damn Good Thing. I can only assume OpenBSD behaves the same 
way if not better.

Another idea could also be to import the new OpenSSH. Looks like 
NetBSD's base package is behind in this regard. OpenBSD put in some new 
features in the latest release which could be handy.