Hi Ted

SELinux is turned off by default in FC2, but turned on by default in

FC3. Unless a web site need C3 security, you could just turn SELinux

off in FC3. I read NSA (eg The National Security Agency) has worked

with Redhat for the past ten years in creating SELinux. NSA is

America's largest security agency number something like 20 people for

every 1 person in other agencies like the FBI, CIA, etc. It may now be

one of the 22 or so agencies under the homeland security umbrella. I

pulled this off the web, which is interesting:

######################################

The whole purpose of creating a secure OS is to protect against attacks

when connected to an insecure network like the Internet. If you don't

connect the system to the Internet, then you don't need a secure

computer. Even Windows is OK for security if it isn't connected to the

network. Microsoft boasted about C3 security certification for Windows

NT a while back - the problem was that the C3 security rating was

achieved only if Windows NT wasn't connected to the network. The moment

you connect a Windows PC to a network, the security rating goes to zip.

NSA created SE Linux to use on the Internet, other insecure networks,

and on the US military network of which the Internet is a civilian

version. In addition to using it for highest security US government

Internet and military network connected systems, NSA also uses SELinux

for honeypot servers to catch hackers. This is a server connected to the

Internet which has insecure services deliberately installed to lure

hackers, so that they can be traced, and arrested. The NSA demonstrated

an SE Linux honeypot server where hackers had broken into the trap, got

root access to the system but couldn't do any damage or gain access to

privileged data, allowing tracking of the hacker's activities without

the hacker knowing.

#######################################

Regards,

LelandJ

Ted Roche wrote:

> From my blog at

>

> The Fedora Core 3 Linux distribution includes a very powerful new

> security feature called SELinux. In my (very) limited understanding,

> SELinux overlays another set of policies and permissions over the

> basic UNIX-style security to produce a far more secure product.

> However, it can also trip up the unsuspecting. At last night's LAMP

> class, we got caught. Installing Virtual Hosts as we had with Fedora

> Core 2 threw permission errors, despite everything we could think of.

> As it was a beginner class, we just settled for placing the virtual

> hosts under the standard DocumentRoot at /var/www/html and continuing

> on with our exercise, with a promise that we'd investigate and explain

> to the students what went wrong at the next class.

>

> The Fedora web site provides guidance at "<a

> href="Understanding" target="_blank">http://fedora.redhat.com/docs/selinux-apache-fc3/">Understanding

> and Customizing the Apache HTTP SELinux Policy</a>." I was also

> pleased to see that a WebMin module is under development to simplify

> SElinux management at

> http://www.selinux.hitachi-sk.co.jp/en/tool/selpe/selpe-top.html

>

>

>

[excessive quoting removed by server]