Ubuntu QA:
BlogBrainstormPackage status
Log in
Ubuntu QA
Network Manager
Idea sandbox Idea sandbox
Popular ideas Popular ideas
Ideas in development Ideas in development
Implemented ideas Implemented ideas

Contributor chill on Network Manager

Security and stability centre  
No information about this blueprint
Information is updated every 5 minutes.
Please wait till the next update.
spec
Written by Auzy the 29 Feb 08 at 11:25. New
What we need is an application which centralises security. I'd like to think of it as "Security and Stability". It should monitor the following in a centralised location:



- Track system crashes/unclean shutdowns of applications and make it easily accessible. If apache has never crashed except the day a server was compromised for instance, it may provide a clue about how it was hacked.

- Firewall status. No IPtables enabled = insecure

- Show all security updates. Users should be informed when there are updates available specifically targetting security (in addition to the applet currently present).

- User rights. If the user is running as root, they should be told the risks.

- Anti-virus. There should be integration with Anti-virus here, or a one click means of listing various versions of anti-virus. Integration should also allow a one click option to start scanning, and an indication if automatic scanning is enabled. It could also offer an easy way to install rootkit detectors and anti-virus. Its better for us to get ahead of viruses, and make sure people don't pass existing ones on (I believe ClamAV is an example of a free one?)

- Rootkit detection. There are lots of Rootkit detection systems out there. I suggest that users be able to click a button and run a quick test.

- Permission checker, Use information from APT to identify changes in permissions to system files. Many newbies do stupid things like change the permissions on a config file so they can access it via gui. Lets make sure they have an easy way to fix it.

- Identify if your network is broadcasting everyones traffic to everyone (ie, hubs, not switches). Maybe not easy, and not really neccessary.

[....]
490
votes
up equal down
Solution #1: Auto-generated solution of idea #1282
Written by Auzy the 29 Feb 08 at 11:25.
Ubuntu Brainstorm was updated in January 2009. Since the idea #1282 was submitted before this update, its rationale and solution are not separated. Please vote accordingly, and if you have the necessary rights, please separate the rationale from the solution. Thanks!
4
votes
up equal down
Solution #2: a professional tools all in one
Written by etusha the 22 Jan 09 at 22:22.
i suggest
a professional tools all in one ,IPS, IDS, brute force detection ,Anti-virus real time protection ( CLAMAV not good slow poor ), firewall , port scanner detection , etc etc

it will be good to for server it will give UBUNTU big PLUS
9
votes
up equal down
Solution #3: Create a "Security" section in software repositories for synaptic
Written by kpeiruza the 11 May 09 at 16:26.
It is really hard to find out which software do you have to increase / test your security.

Just adding a new section to the repositories might increase the average level of security and show Ubuntu a bit more robust as operating system.

You don't need to add new packages at all, as it's only an extra tag on some packages!!!!

Also vote for #1 :D
68
votes
up equal down
Solution #4: A simple GUI with bullets that summarize the checks and results.
Written by Bryan Harris the 5 May 09 at 17:18.
Various easy things to do:
- Check to see if the firewall is running: sudo ufw status
- Maybe check for iptables directly?
- Look for processes listening: lsof -i|grep -i listen
- Look for SUID root applications which shouldn't be and fix them.
- Look for default passwords or weak passwords, especially on anything that could become web facing.
- Check to see if the user is running as root explain how to fix it.
- Run something like chkrootkit and grep for problems. (sanitize for new users)
- Run rkhunter and look for problems. (sanitize for new users)
- Run clamav and look from problems
- etc, etc, etc

I think I could hack this together in a few hours for a prototype, but want some feedback.
4
votes
up equal down
Solution #5: A SIMPLE tool wich ummarize the checks and results.
Written by chill the 23 May 09 at 14:13.
PLEASE Tiger is a very nice tool but it leaks on dev's and support. Last release was published in september 2007.

At first the code should be reviewed and maybe reimplemented in an other language. Then the Idears of Bryan Harris and chkrootkit.org should be implemented

Then the dev's should talk to the dev's of debians own security tool. So that one day Tiger replace the default security tool on Debian. And gets in the Base install of ubuntu.

At the end use your brain and the code of SUSE's Seccheck + Mandrake's msec to keep Tiger uptodate.

Contect the dev's of Tiger and work togather with them.
It would be nice for the hole security and openSource community.

http://www.nongnu.org/tiger/
http://packages.debian.org/sid/checksecurity
www.chkrootkit.org
http://www.openbsd.org/cgi-bin/cvsweb/src/etc/security
2
votes
up equal down
Solution #6: We need a centralizing security center in ubuntu
Written by ncfiedler the 14 Jun 10 at 21:29.
Here is some outcome of the discussion on the ubuntu-hardened list, which took place a few weeks ago:

1) Summarized insights & conclusions on the issue of a security center in Ubuntu:

1. Trust SELinux despite its NSA history, because Linus audits the code (Sir Conquer)
2. Documentation / Wiki is important before a GUI, that also goes beyond the already implemented default security features in ubuntu, because a little technically understanding of functionalities is needed prior to recognizing security problems and taking action (Kees Cook and Christopher Warner )
3. Technically less skilled users could benefit from an easy to use GUI of a „security-center“, combined with an excellent, eye-catching documentation → Psychology!
4. Existing security oriented distributions are no appropriate alternatives, because for example BackTrack Linux runs as root permanently, etc.

2) What information should a documentation provide?:

1. LVM encryption
2. Creation, alternation and usage of secure passwords with different security levels
3. Risks of monopolists services (email, social networks, search engines, etc.)
4. Installation, usage, risks of tor, privoxy, ntp

3) What features should a security-center provide?:

1. Password strength tester (maybe with an updatable online database to check password-lists and international dictionaries → blackhats already have those lists for bruteforce attacks)
2. Starting a popup, telling the user the risks of running as root at the moment
3. moblock for ip-list blocking (maybe also for blocking known insecure tor exitnodes)
4. tripwire for integrity
5. aide for file changes
6. logcheck
7. checksecurity
8. denyhosts
9. Email aencryption like Enigmail or Seahorse
10. Bleachbit for deleting log, temp and chache files, etc.
11. Deborphan for deleting obsolete
12. Wipe to delete files safely (maybe implemented by default in the context menu)
13. User-agent and language switcher for Webbrowsers (Firefox, Epiphany)
14. Permission check, using information provided by apt to identify changes to system files
15. Check whether a keylogger is running (like lkl)
16. rkhunter / chkrootkit for rootkits, backdoor, exploits
17. John and rainbow tables
18. ClamAV / clamtk
19. Truecrypt for easy encryption of containers
20. GUFW Firewall (sudo gufw status) / iptables / port management

4) References:

1.https://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened
2.http://www.debian.org/doc/manuals/securing-debian-howto/
3.https://wiki.ubuntu.com/Security/Features#Matrix
4.http://packages.ubuntu.com/de/karmic/denyhosts
5.http://www.debuntu.org/intrusion-detection-with-aide
6.https://help.ubuntu.com/community/MoBlock
7.http://brainstorm.ubuntu.com/idea/1282/
8.http://brainstorm.ubuntu.com/idea/19648/
9.http://www.nongnu.org/tiger/
10.http://savannah.nongnu.org/project/memberlist.php?group=tiger
11.http://savannah.nongnu.org/projects/tiger
12.https://lists.ubuntu.com/archives/ubuntu-hardened/2010-April/date.html

See the 14 comments or propose a solution (latest comment the 18 Jan 11 at 22:29) >>

More informations from broadband connections in the Network Manager Applet  
Written by icarosaurus the 12 May 09 at 09:52. New
Connecting to internet through my USB HSDPA Modem works fine for me. I just have to click in the Network Manager Applet.
But I miss some important things.
- the signal strength on the Network Icon, just as a wi-fi connection;
- which Mobile Operator I'm connected to: sometimes you get charged if you are in Roaming;
- the ability to force the connection with one operator;
- statistics about the present connection, at least, or on a daily basis: you should be able to check if you're inside your time/bandwidth limits.
22
votes
up equal down
Solution #1: Include the ability to manage some simple at+c commands
Written by icarosaurus the 12 May 09 at 09:52.
You could be able to check the battery status, signal strength and operator carrier by sending to the phone at+c commands. Linking Network Manager to Wammu could be a good idea: you could be able to manage the phone features (sms, phonebook) from the Network Manager Icon directly.
45
votes
up equal down
Solution #2: Include statistics
Written by icarosaurus the 12 May 09 at 09:58.
Include and store statistics about the present connection, on a daily base, on a weekly base and so on, showing the Outoing/Ingoing data volume and the sum of them, how much the connection is lasting... and so on.
You should be able to chose if you want to show the data in the notification area or just checking them by going over/ clicking with the mouse.

See the 1 comments or propose a solution (latest comment the 24 May 09 at 21:55) >>

No BSSID displayed in network manager  
Written by alimahmoudy the 30 Apr 09 at 01:09. New
Where I live, some access points have the same name, so when I try to connect to my access point, which is dlink, I have trouble because of this conflict.
I have to use the iwconfig command and try to find the right BSSID, and then assign it to the wireless card via the iwconfig command in order to connect successfully.
64
votes
up equal down
Solution #1: Show BSSIDs in network manager
Written by alimahmoudy the 30 Apr 09 at 01:09.
I would like to see this option in the network manager, if it could show the BSSID of each access point, this would help a lot.

See the 4 comments or propose a solution (latest comment the 30 Apr 09 at 12:48) >>

Network Manager Need Connection Profile Priorities  
Written by gmendoza the 26 Apr 09 at 23:47. New
Connection profiles in Network Manager should be able to be configured to have preference over others, and rules regarding preemptive connection actions should be established.

For example, one wireless SSID should be preferred over another, regardless of which was connected last. Wireless connections should also be able to be configured with higher priorities over wired, or vice-versa.
156
votes
up equal down
Solution #1: Implement Concept of Priorities and Preemtive Connection Actions
Written by gmendoza the 26 Apr 09 at 23:47.
As described in my bug report / enchancement request on NM's bugzilla tracking system:

http://bugzilla.gnome.org/show_bug.cgi?id=580018

1.) I'd love for NetworkManger to use priorities that can be managed for both
system wide and user specific connection profiles.

For example...

If a user has two or more available wireless networks defined, one could always
be given preference for an automatic connection. This priority could be a
numeric value, and NM should compare the priorities across all network types.
e.g. A wireless connection could be given priority over a wired connection.

2.) Along with priorities, there should also be a concept of preemption or
automatically re-connecting to a more preferred network based on certain
classifications of events.

For example...

A wired or wireless connection is defined as a system profile, and which
authenticates the machine using 802.1x before any user logs on. This provides
basic connectivity for centralized authentication, etc. But upon user desktop
login, a user specific profile can be made to force NetworkManager to
preemptively re-authenticate as the user's profile. NetworkManager would then
automatically switch back to the system wide profile after the user logs off.

Preemptive event classifications could be a number of things:

1. Simply the higher of two or more priorities.
2. Better encryption options WPA2 vs WPA vs WEP vs Open
3. Interactive Desktop Logon / Logoff
4. Successful connection of another network profile. For example, a VPN
connection could automatically connect based on the event of a successful
connection being made to any (specific or non-specific) wired, wireless, or
PPPoE connection.
70
votes
up equal down
Solution #2: Same as #1, but with connection stregth triggers.
Written by Darwin Survivor the 27 Apr 09 at 11:46.
Windows has a system like what #1 is proposing (though EXTREMELY limited), and I hated being switched to a preferred network when the new connection was only 50%. There should be an option to reduce a connection's priority by 3 (or something) points when the connection starts to drop.
14
votes
up equal down
Solution #3: Manual mode
Written by Psycho_zs the 28 Apr 09 at 05:11.
When click on specific network, it just turns this one network on/off, and does not act on its own.
25
votes
up equal down
Solution #4: A do-not-connect-to-this-anymore-button
Written by cybert the 10 May 09 at 11:18.
There should be a button in the wireless-login-window
that gives you the possibility to say:

"Don't try this network again!"

So you don't have to disable your network every time,
or to click 25 times "break off" every time,
if there is no network you want to get in.
23
votes
up equal down
Solution #5: Easy way to switch on/off Network Manager
Written by kpeiruza the 10 May 09 at 23:34.
IMHO it's a nice feature for users and a headache for sysadmins.

When doing network testing, Network Manager interfers into normal operation of tools such as airmon, tcpdump.... with wireless and ethernet, also while trying to manually setup new ip's and so on. As these are standard Ubuntu packages, it's really frustrating to see how they don't work at all...

Why can't I use my Ubuntu Desktop to make networking tests or clustering experiments?

It's pretty common to listen sysadmins blaming NM for the weird behaviour. It's really scary to realize iwconfig or tcpdump don't work anymore :S

It gets too tricky to get it ready to sniff into a wire, change an IP or do whatever we learned to do and isn't possible any more!!!!

This solution should keep current settings, so, it also implements solution #3.

Add a button, link, menu, whatever wherever, but make it visible and easy to completly shut down Network Manager.

Bring us the choice of the command line back!
17
votes
up equal down
Solution #6: Improve support for multiple simultaneous network connections
Written by cyberix the 18 May 09 at 15:41.
From time to time I need multiple network connections. The most typical use case would be that I need wireless for connecting to the Internet, but I'd simultaneously need to reach some computer over ethernet. Or the other way around.

This does not solve the whole problem, but Mac OS X seems to be able to handle this. At least in a case where you use Internet over wireless and connect two computers to each other directly with an ethernet cable.

See the 1 comments or propose a solution (latest comment the 27 Apr 09 at 02:29) >>