OESF Portables Forum

Everything Else => General Support and Discussion => Zaurus General Forums => Archived Forums => Security and Networking => Topic started by: Foxdie on December 16, 2003, 09:02:25 am

Title: We need CPR for this forum!
Post by: Foxdie on December 16, 2003, 09:02:25 am

Well this section of the forum has been here for quite a while and still it has cobwebs, time to brush them away I think.

The Zaurus, is it secure or not? Why is it/isn\'t it?

Comments please.

Title: We need CPR for this forum!
Post by: Mickeyl on December 16, 2003, 10:03:34 am

What is CPR ?

Title: We need CPR for this forum!
Post by: Anonymous on December 16, 2003, 10:16:21 am

it means die Herz-Lungen-Reanimation

regards,
xconduct

Title: We need CPR for this forum!
Post by: Foxdie on December 16, 2003, 10:47:12 am

http://depts.washington.edu/learncpr/ (http://depts.washington.edu/learncpr/)

Title: We need CPR for this forum!
Post by: Capt_Caveman on December 16, 2003, 10:58:35 am

Is it secure?

Not really, at least not the default configuration.  The 2 biggest weaknesses I can think of off the top of my head would have to be that there is not even a rudimentry firewall installed and the initial root password can only be a numeric string of, IIRC, 8 characters.  The fact that letters or punctuation aren\'t used reduces the amount of time needed to crack passwords by orders of magnitude.  I\'ve seen iptables packages available, but I\'m not sure if you can use it without recompiling the kernel to include netfilter support.  There\'s a boat-load of other security issues you could nit-pick about, but it really comes down to a trade-off between sacrificing usability for security.  How many newbies want to write iptables scripts just so they can get there Z to sync?  Not many.

Title: We need CPR for this forum!
Post by: Taim on December 16, 2003, 01:05:29 pm

I think part of the reason security really wasn\'t considered is because PDAs in general do not have security features other than a simple password to keep prying fingers off of them.  Keep in mind, up until recently, wired/wireless/mobile connectivity has not been a popular or affordable option for PDAs.  As more and more PDAs and wired/wireless/mobile solutions become available, PDA OSes  do have to change.

I also wonder if security is a \"size\" issue \'thang.  The more security you pack into a PDA, the more memory and FS space it takes up.

Title: We need CPR for this forum!
Post by: Capt_Caveman on December 16, 2003, 03:07:49 pm

True, especially when you think about all the necessary modules that come along with iptables.

Unfortunately a zaurus with wireless networking makes a nice springboard into a network; especially with nasties like samba shares and tFTP available.  Though it is possible to turn off some of the un-needed networking daemons.  I can\'t remember what the default config looks like, but I remember turning off a bunch of stuff when I first got my Z.

To be fair though, I don\'t think that it differs from any other PDA that I\'m aware of.  That just seems to be the industry standard, probably for the reasons you pointed out Taim.