> Any security checklist should start with a description both how the machine is to be used and the expected threats models.
It states right at the top that the target audience is Linux sysadmins and their workstations.
> It has some good advice, but is certainly not comprehensive.
"This, by no means, is an exhaustive "workstation hardening" document, but rather an attempt at a set of baseline recommendations to avoid most glaring security errors without introducing too much inconvenience."
Re:Linux workstation security checklist
by sandworm101 on Friday August 28, 2015 @02:43PM
(#10137190)
Ya, all of a paragraph. Any security document, even something as basic as an internal policy statement about passwords, should begin with a thorough discussion of the threats that were in the minds of the drafters. Security is heavily a matter of opinion and perspective. The background on which those are based is therefore as important as the individual recommendations.
Re:Linux workstation security checklist
by syntheticnature on Saturday August 29, 2015 @06:33PM
(#10141580)
Make sure you check the regs for China before modifying machines for said travel; a few years back I was supposed to head there (didn't due to a snafu), and encrypted my normal stays-at-work laptop's drive (among other measures), but it turns out that I'm not allowed to bring an encrypted device in without advance permission. Might be able to get away with it, but what happens should it be detected?
If I was going to China and really needed to bring a machine, I'd bring a Chromebook with some means to run Linux and the minimum needed to pull critical items... and it would get binned upon return, preferably without being powered up anywhere near any means to connect out (though I'd probably want to ensure it was wiped).
For instance: I see no mention of Tor or VPNs. So this workstation isn't concerned with APT-style threats, or anyone else with the ability to manipulate network connections at a high level. And my quick read sees no talk of memory encryption or any of the physical measures for countering cold-boot scenarios.
This is not a workstation for international (China) travel or for protecting against surveillance. It has some good advice, but is certainly not comprehensive.