Hi all This discussion is already past its sell-by-date so I don't want to prolong it any further unnecessarily. In my office (V Small Co.) I get very tired of anyone and everyone passing on the latest 'Virus Warning' or something so I have alot of sympathy with MJ. I have implemented a virus/security policy as follows :
Every Monday Morning I visit the website of our virus checker vendor and download the latest updates, then install them. I also visit www.securityfocus.com (good source of general info), www.cobalt.com (our webserver vendor) www.redhat.com (our in-house linux vendor) www.microsoft.com (our desktop/server vendor) and check all the security advisories, download any necessary patches and install them. Meanwhile, I subscribe to a couple of the (relevant) advisory newsletters from security focus and read them when they arrive. That's it. EOF If anyone can think of anything further needed please let me know.
It's probably time to compile a list "Charter" or FAQ, pointing people towards other more appropriate resources for common requirements like good security alerts. Anyone able to help on this?
ALUG Admin:, if you wish you can use this mail as the basis for an FAQ on posting security announcements/requests for all subscribers. Everyone: (especially home users/linux beginners) this is about all you need to do, and about all you need to advise anyone. Then if someone wants to get 'security-techie' they have a great start in the right places. Hope this doesn't sound condescending.
(aside : the point is valid that for beginners the idea of totally secure Linux has been hyped from somewhere (LINUX IS MORE SECURE THAN WINDOWS BY DEFAULT - TRUE - , but that's about it) you can get a bit shocked when you hear of a so called Linux Virus - and I do think that to a point the first port-of-call for any newbie who is unsure of something should be the local LUG - from where they can get pointed in the right direction - without feeling intimidated - agreed??)
Perhaps a "Securing Linux" talk or two at the next meeting? Any takers?
I would be glad to discuss security issues in more depth if people are interested, the concepts of hacking (cracking) etc and common methods + good prevention practice (If anyone feels better qualified please feel free - I'm not an expert, just forced into it by necessity). Just an overview with perhaps some handout info so that anyone who is completely new to it can at least get a handle on it. I would admit now though that I would only be using info gleaned from www.attrition.org, www.insecure.org and www.securityfocus.com as a basis! (but I could bring along some RPMs of nmap, tripwire and other stuff for people who want them (of course I could explain/demo them if needed)) I'll await feedback on this offer... Sorry I went on a bit. Best Regards Earl