Lazy Linux sysadmins make systems insecure
SOME LAZY Linux administrators are living in a dreamworld where they believe their systems are secure just because they use Linux, according to an insecurity expert.
Peter Hansteen claims that a third round of low-intensity, distributed bruteforce password attacks is now in progress because of sloppy admin practices on Linux systems. So far about a thousand servers have been compromised.
Writing in his blog, Hansteen said that many systems administrators seem to believe that they cannot be attacked successfully because they are not running a bug-ridden proprietary operating system.
He said the latest wave of attacks is quite easy to stop, if systems admins pay attention.
The likely culprit is a piece of Linux malware known as dt_ssh5.
The attack depends on systems admins who have a maintenance regime that's disorganised enough that it lets weak passwords exist and software with known and exploitable bugs is left in place.
Then all it takes is at least one common userid like root with a guessable password.
Weak passwords are words that appear in the dictionary, for example. Strong passwords are not words that appear in the dictionary and typically are at least eight characters long and include both uppercase and lowercase alphabetic characters along with both numeric and symbol characters.
Hansteen said that systems admins might have oversold the security of Linux in a bid to interest "the suits" in using it, and that a downside of this in careless admin habits might be showing.
While bugs are easier to find and fix when the source code is available and the Linux security model is far better than the security nightmare that is Windows, there are always security worries.
For example one of the hosts now trying to gain illegitimate access to one of his systems was originally set up as a "spam washer".
Setting up a Linux box to filter spam is likely a good idea, but when your spam washer has been hijacked and tries to break into other people's systems, you urgently need to get your act together, he said.
While there are no self-propagating worms on Linux and the operating system is secure enough that there might never be any, Linux systems are potentially just as vulnerable as others to slow bruteforce password attacks.