*BSD News Article 43653


Return to BSD News archive

Path: sserve!newshost.anu.edu.au!harbinger.cc.monash.edu.au!bunyip.cc.uq.oz.au!munnari.oz.au!news.hawaii.edu!ames!pendragon!news.msfc.nasa.gov!bcm!cs.utexas.edu!howland.reston.ans.net!news.sprintlink.net!cyberspace.com!cyberspace.com!not-for-mail
From: valko@cyberspace.com (Jack Valko)
Newsgroups: comp.unix.bsd.freebsd.misc
Subject: Re: Is FreeBSD's security level C2
Date: 1 May 1995 17:00:41 -0700
Organization: C y b e r S p a c e - (206) 505-5577
Lines: 25
Message-ID: <3o3sn9$ng3@case.cyberspace.com>
References: (none) <3o1h2f$1ae@mekab.usc.edu> <wgbD7w4L6.Fxs@netcom.com>
NNTP-Posting-Host: case.cyberspace.com
X-Newsreader: TIN [version 1.2 PL2]

Bill Bosacker (wgb@netcom.com) wrote:
: chihjenc@mekab.usc.edu (Chih-Jen Chang) wrote:

: >I intended to build a small scale Internet Provider and
: >am looking for proper public domain UNIX.
: >One of my concern is security. Is FreeBSD's security level C2?

: >Currently Linux's standard release of kernel do not have 
: >shadow password or other. Nor quota ... etc.
: >I hope old BSD have everything....... :)

: I don't believe any public domain UNIX system would be certified for
: many reasons.  One, the cost of certification would be prohibitive and
: two, the source changes every day which would invalidate any previous
: certification.

: Now, they may be compliant with a specific specification, but that does
: not give you any garauntee.  Remember, if its in the public domain and
: the source code is available, some one will find a way past the
: security.

While FreeBSD is not C2, it does come stock with a shadowing password 
scheme. 

Jack