This week, perhaps the most interesting articles include "An Illustrated Guide to Cryptographic Hashes," "," and "SELinux Policy Editor: Removing micromanagement from administrative control."


Earn an NSA recognized IA Masters Online - The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.


LinuxSecurity.com Feature Extras:

EnGarde Secure Community 3.0.8 Released - Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.8 (Version 3.0, Release 8). This release includes several bug fixes and feature enhancements to the Guardian Digital WebTool, several updated packages, and several new packages available for installation.

pgp Key Signing Observations: Overlooked Social and Technical Considerations - While there are several sources of technical information on using pgp in general, and key signing in particular, this article emphasizes social aspects of key signing that are too often ignored, misleading or incorrect in the technical literature. There are also technical issues pointed out where I believe other documentation to be lacking. It is important to acknowledge and address social aspects in a system such as pgp, because the weakest link in the system is the human that is using it. The algorithms, protocols and applications used as part of a pgp system are relatively difficult to compromise or 'break', but the human user can often be easily fooled. Since the human is the weak link in this chain, attention must be paid to actions and decisions of that human; users must be aware of the pitfalls and know how to avoid them.

Bulletproof Virus Protection - Protect your network from costly security breaches with Guardian Digital’s multi-faceted security applications. More then just an email firewall, on demand and scheduled scanning detects and disinfects viruses found on the network. Click to find out more!

Take advantage of our Linux Security discussion list! This mailing list is for general security-related questions and comments. To subscribe send an e-mail to This email address is being protected from spambots. You need JavaScript enabled to view it. with "subscribe" as the subject.

Earn an NSA recognized IA Masters Online - The NSA has designated Norwich University a center of Academic Excellence in Information Security. Our program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Using interactive e-Learning technology, you can earn this esteemed degree, without disrupting your career or home life.

Security on your mind?

Protect your home and business networks with the free, community version of EnGarde Secure Linux. Don't rely only on a firewall to protect your network, because firewalls can be bypassed. EnGarde Secure Linux is a security-focused Linux distribution made to protect your users and their data.

Guardian Digital Makes Email Safe For Business - Microsoft 365, Goo....

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.


LinuxSecurity.com Launches New Web Site
21st, August, 2006

Allendale, New Jersey, August 21, 2006-LinuxSecurity.com, the definitive source for Linux and open source security news, today launched its new website. Founded by Guardian Digital CEO Dave Wreski in 1996, LinuxSecurity.com has become the pre-eminent information resource for IT professionals and open source community members alike. The site, which is supported and maintained by Guardian Digital staff members, employs a global network of expert and volunteer contributors to develop feature articles, commentaries and reviews as well as compile extensive collections of the latest security updates to help readers keep up with the latest advancements in Linux and open source security.

Vincenzo Ciaglia - Guardian Digital, Inc.
21st, August, 2006

Guardian Digital, Inc. takes great pleasure in welcoming Vincenzo Ciaglia of Eboli, Italy to its team. Vincenzo is the creator of Netwosix Linux, a highly-secure Linux distribution, and a long-time student of open source networking and security technologies. Netwosix has been downloaded by more than 60,000 users around the world.

Virtual ID card could pose problems
23rd, August, 2006

A virtual ID card designed to improve children's net safety has been launched in the UK, US, Canada and Australia. The NetIDMe card can be swapped by children online when using chatrooms, instant messaging and social networks. Parents and children can apply for the card using credit card details and a form countersigned by a professional who knows the child concerned.

IBM to pay $1.3B for security provider
23rd, August, 2006

IBM announced today that it has entered into a definitive agreement to purchase Internet Security Systems (ISS), a publicly traded Internet security provider based in Atlanta.

Swiss developers start rolling Your Own Linux Distribution
25th, August, 2006

Ark Linux project developers operate on a "no-frills" policy when it comes to deciding what features will be included in their distribution. They strive to provide only the tools necessary for a typical desktop user, creating a lean, mean Linux. When some users came asking for more features, rather than violate their policy of simplicity, the developers launched a completely new company called YOLD (Your Own Linux Distribution).

An Illustrated Guide to Cryptographic Hashes
23rd, August, 2006

With the recent news of weaknesses in some common security algorithms (MD4, MD5, SHA-0), many are wondering exactly what these things are: They form the underpinning of much of our electronic infrastructure, and in this Guide we'll try to give an overview of what they are and how to understand them in the context of the recent developments.

A "hash" (also called a "digest", and informally a "checksum") is a kind of "signature" for a stream of data that represents the contents. The closest real-life analog we can think is "a tamper-evident seal on a software package": if you open the box (change the file), it's detected.

news/cryptography/an-illustrated-guide-to-cryptographic-hashes-30240
Ethics and Virus Testing
21st, August, 2006

How come discovering vulnerabilities and writing exploits is "research," but viruses for testing is a crime against humanity? The anti-virus community is abuzz in controversy over the tests performed recently by Consumer Reports on anti-virus products. CR went out and did what many of us have considered in the past, but not actually done: With the help of consultants at ISE (Independent Security Evaluators), they created a test bed of 5,500 new viruses in order to test the products. There's an old joke about Consumer Reports, that nobody respects their work for their own field, just for others. So a carpenter will scoff at their review of circular saws, but trust them for gas grills and washing machines. I've heard a lot of this in the discussions about virus testing.

Why Was Linux Successful (and Will It Stay So)?
21st, August, 2006

Internet News reported on a panel discussion of the reasons why Linux was successful. I had been thinking about that myself recently, and had earlier found an older but more detailed article on the same subject. That timing had a lot to do with this is obvious: the hardware was at the right power/price point, the Internet made communication possible, and even the BSD lawsuits added impetus by at least temporarily spreading FUD over BSD efforts and perhaps even moving a developer or two from that camp.

Real life: My battle with spyware
27th, August, 2006

This is not your typical article on spyware. Instead, it's a modern-day parable of my own recent experience with a crippling spyware infestation, with some important lessons for systems administrators to learn as a result of my somewhat embarrassing mistakes.

SSH Tunnels: Bypass (Almost) Any Firewall
24th, August, 2006

The goal of this article is to present a few effective methods to revamp the way you work in a restricted corporation-like network. In order to achieve it we