Distribution Development Security Jeremiah Yongue

Linux Distribution A Unix-like operating system built on top of the Linux kernel which includes various collections of software packages. Well known examples include Ubuntu, Fedora, and Red Hat. Solaris is not Linux, it is Unix, according to the single Unix specification.

Development Process 1.Software updates come from upstream. 2.Software is patched or forked according to distribution- specific standards. 3.Software is packaged. 4.Software is distributed to users. The key issue with this process is ensuring that the software is “safe” at every step of the process.

Fuduntu “Fuduntu is a light hearted and fun Linux distribution that earns its name by its design to fit somewhere in-between Fedora and Ubuntu.” Founding member. Quick Stats: users software packages #25 on Distrowatch.com’s popularity metrics for the past 12 months.

Security at Fuduntu Build-Hosts Dedicated servers for building software packages. Access restricted by SSH public keys. Root access/login disabled. “Lives” behind a firewall. Can’t modify system without sudo rights. Access to repository rsync restricted by separate account and password.

Security Continued GPG package signing GNU Privacy Guard (GnuPG or GPG) is a GPL Licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with RFC 4880, which is the current IETF standards track specification of OpenPGP. Package is signed with a private key at build time. Package manager downloads public key to check against packages. YUM, our package manager, will NOT install unsigned packages or packages that fail the key check.

Sources