Here are my reflections on Linux security in 2002 and predictions for 2003. All statements not otherwise attributed are my opinions.

I think that the major change in 2002 over 2001 in Linux security was that major heavily-deployed subsystems continued to get more hardened. The recent versions of Sendmail, LPD (Line Printer Daemon), and the commercial (ssh.com) version of SSH suffered no vulnerabilities. This may be a record for these subsystems.

Non-Windows Apache did suffer the first discovered vulnerabilities in five years with Chunk and SSL. DNS suffered one that would be hard to use if one's firewall is properly configured. While OpenSSH suffered a number of problems, I do not yet consider it secure enough to deploy in "Production" environments. The ssh.com version is free for Linux, more secure, and easier to use - so use it.

Most Linux Distributions moved to automatic security patch download and installation options. This is a most welcome move to reduce the "window of opportunity" and hence risk of breach from days or months down to a few hours. Those with more critical systems still will want to do manual updates. This will allow testing to ensure that nothing is "broken" in the process.

Red Hat, SuSE, and other Distributions still turn on too many insecure unneeded services by default, with NFS, port, and friends heading the list. There were yet more vulnerabilities discovered in 2002 in this set of "weekend kludges" that still is heavily used.


The biggest risk taken by Linux users in 2002 was the failure to harden their systems by turning off unneeded services, using stricter permissions

on files, using good passwords, and failure to offer different services on different boxes. Most people merely answer questions asked by the installation software and have no idea of what is running on their systems. Invoking "netstat -anp | more" and "ps -axlww | more" will reveal what is running.

As problems, recreational hackers are being pushed aside by criminals obtaining credit card numbers and bank account details and by ever-increasing levels of spam.

Turning my crystal ball on 2003

As the worldwide recession continues in 2003, budget pressures will help move the world from expensive SysAdmin-intensive proprietary solutions to Linux. Even the last two holdouts, Sun and Microsoft, have grudgingly started to embrace Linux.