Fedora Core 2 Test 2 Quicky Review

Had a good lunch with Dana today and in the ensuring (computer security related) discussion he mentioned that someone, somewhere had compared Windows 2000‘s defaults services to those of Redhat‘s Enterprise Linux, and found them to have the same number of attack vectors (that’s “vulnerabilities” to normal people 🙂

Since I have no access to Enterprise Linux, but Fedora Core 2 Test 2 was released today, I decided it’d be as good as any a candidate for a check to see how Linux does in that area.

Now I could be mean and say that I’m comparing the latest from the Linux camp with the latest available from the Microsoft camp, but I won’t be. XP was written many years ago while Fedora is using the latest and greatest technologies from the open source community. Sadly we’ll have to wait for another few years for the latest to come from Redmond (unless you’ve got a couple of thousand to get an MSDN membership and get some of the latest things). However, I could quite easily say I’m looking at the latest available from both the Linux and Microsoft camps, and be completely honest. Well, ignoring Windows Server 2003 that is, but that’s not a “consumer” OS IMHO.

Anyway, the first thing I want to address is what services are on by default, which is the whole point of this.

phoenix root # nmap 192.168.2.109

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-03-29 22:18 PST

All 1659 scanned ports on 192.168.2.109 are: filtered
Nmap run completed — 1 IP address (1 host up) scanned in 71.819 seconds

Well how about that. I believe I detailed what was on the default install of a Windows 2003 system a while ago.

However, when I installed I did so choosing the defaults for a workstation and let the install script do everything else. Just to be fair I’ll go back and re-install as a server and compare.

While I wait for that, some of the details of what’s included in Fedora Core 2.

Gnome 2.6

(actually 2.5 as 2.6 is due to be released on the 31^st). The latest and greatest in the GNOME graphical user interface. I don’t know if I like the new “spatial nautilus”, but I’ll give it a bit of use before I decide.

SELinux

Security Enhanced Linux… a mandatory access control system built right into the kernel.

Kernel 2.6.3

Almost the latest and greatest kernel…. 2.6.4 is the latest released as I write this.

Diff X11 Server

Based on XFree86 4.4, but without the licensing issues I’m guessing. Looks and acts the same, which is what is wanted I guess. No hardware accelleration or transparancy yet though 🙁

Other…

Full acpi, nifty apps, etc etc etc…

Install

Install was pretty easy, just clicky clicky clicky. The first time as I said above I configured it as a workstation and did everything default…. ie: what would Joe Average do. It wasn’t perfect of course, it’s a beta.

• While the install worked fine, when rebooting I had no GUI because I was under VMWare. Turns out the default setup is for 16bit color and because it’s VMWare it wants to have the same color depth for the vmware client as the host, and my desktop is set to 24bit color. A quick fix as I knew what I was doing, I doubt Joe could have. Of course, chances are Joe would be running VMWare 🙂
  
• It also asked me a strange question when I first logged in as root to the console, something about creating something. I hit the default. I assume this was some SELinux thing.
  
• A question about if I wanted to choose a different context than root:sysadmin_r:sysadmin_t came up when I first logged in as root. Something to do with SELinux I’m sure. I hit the default cause I had no idea what it is talking about.
  

The second install I did as a server and did as Joe Sysadmin would do, selected some servers (mail, web, dns, webmail), and went with only a very small level of configuration. I even tried to turn off the firewall (enabled by default on install) and it warned me not to be an idiot. I left it off anyway to see what would happen when it came up.

phoenix root # nmap 192.168.2.109

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-03-29 22:53 PST

All 1659 scanned ports on 192.168.2.109 are: filtered
Nmap run completed — 1 IP address (1 host up) scanned in 71.172 seconds

Well how about that. Still nothing on by default.

Now granted, because Dana is using Debian stable for his server, he’s installing on software of about the same age as Windows 2000. Granted it’s really stable software, but come on, it’s way out of date (2.2 kernel on the latest stable release of a Linux distro? Hello 1999 wants it’s kernel back!).

So in conclusion, Fedora Core 2 Test 2 starts with 0 services running (or at least, exposed to the net), and even with the firewall disabled nothing shows up on a portscan. I had to run /etc/init.d/iptables stop to even get it to show up anything, and when it did it was port 22 and port 111 (portmap, used for FAM).

I downloaded the ISOs of Mandrake 10, maybe I’ll try this on them tomorrow. Heck, maybe a website dedicated to what stuff is enabled by default on OS installs should be setup?

Just FYI, my fully updated and patched Windows XP system (enabling IIS opens up another 4 or 5 ports):

phoenix root # nmap 192.168.2.102

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-03-29 23:10 PST

Interesting ports on orbit (192.168.2.102):

(The 1650 ports scanned but not shown below are in state: closed)

PORT     STATE SERVICE

135/tcp  open  msrpc

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS

3389/tcp open  ms-term-serv

5000/tcp open  UPnP
Nmap run completed — 1 IP address (1 host up) scanned in 0.402 seconds