Security during an install?

Message

Fred Krogh · Post by **Fred Krogh** » Mon Mar 31, 2008 10:00 pm

Two bad hard drivers led to a need to install from a CD. Afterward, I got a complaint from postmaster@mslo.com in connection with the email address mom@mail.mslo.com. (I have no reason to think the complaint was due to me.) This led me to wondering just what kind of security gentoo has during the installation process. At least in my case it was a fairly long time until I had a firewall up and running. Thanks,
Fred

schachti · Post by **schachti** » Tue Apr 01, 2008 5:36 am

What kind of security do you think of? There are no services running during the install, so there is no need for a firewall.

Fred Krogh · Post by **Fred Krogh** » Tue Apr 01, 2008 1:40 pm

I was thinking primarily of the situation after I'm booting from the hard drive. But perhaps even then there are no services that allow for an attack. The first thing I did after this point was to install shorewall, but there was some sort of problem with the install and that took awhile.

schachti · Post by **schachti** » Tue Apr 01, 2008 2:31 pm

In most cases, a firewall for a linux computer is not necessary at all.

christsong84 · Post by **christsong84** » Fri Apr 04, 2008 5:16 am

Fred Krogh wrote:I was thinking primarily of the situation after I'm booting from the hard drive. But perhaps even then there are no services that allow for an attack. The first thing I did after this point was to install shorewall, but there was some sort of problem with the install and that took awhile.

Unless you installed and started up services at boot (via rc-update), there shouldn't be anything listening to a port on the network of your machine. Also, assuming you're running a fairly recent kernel, there should not be any known vulnerabilities to that either...

So for the most part, you won't be exposed to the vast majority of the stuff on the 'net (if you're behind a router that performs NAT, you're protected on yet another layer

).

The only obvious entry point I could see is a corrupt gentoo mirror serving up malicious packages/instructions, but I believe there are (or should be) checks in place for a mirror to be on the list. If this is the case, I suspect someone might notice...that or we're all hosed.