IBM: Linux software can secure an entire network

An IBM report that tested the suitability of Linux software to secure an network its entirety has come to light months after it was originally published.

Tested over three months at IBM's Linux Test Integration Center (LTIC) by a seven-person team, the 87-page report set out to test a wide range of open-source Linux products supported by IBM to see whether they could adequately protect a middleware environment. Only open source products were used.

The answer to this question was a resounding "yes", backed up by detailed technical description of the specification and configuration of the systems used in the testbed. Where alternative products were available to do a similar job, the report makes technical comparisons and comes up with judgments on their respective merits.

Security functions looked at included network, web and host-based intrusion detection system (Snort, Hogwash, ModSecurity, PortSentry Port Scan Attack Detector), Firewalling (iptables/netfilter), logging/auditing (Lire and Swatch), authentication (OpenSSH, MIT Kerberos), remote scan (nmap and Nessus), and system hardening (Bastille Linux).

Originally posted to an IBM FTP server in August, the report seems to have fallen off the company's internal radar since then, which might explain why it was not more heavily promoted. To some it will read like a clever piece of IBM propaganda -- after all, IBM sells support and services for Linux installations -- but to others, it will be further evidence that open-source technologies are now setting the standards for software security.

The report makes useful if sometimes obvious security recommendations -- a reader familiar with Linux would be unlikely to learn any new tricks from this report. Nevertheless, it is still confirmation that an end-to-end Linux security system is possible and can guard sensitive assets across a "real-world" network setup.

One weakness of the report it that while it gives copious information on how to set up named software products, it doesn't actually test whether these systems then withstand attacks so configured. The systems were mainly assessed for their ability to integrate within the test-bed network and the ease with which security settings could be configured using best practice.

Despite its earnest attempt to proselytize Linux on behalf of IBM, the report is a reminder of a disappearing age before the technical white papers was taken over by marketing departments and stuffed full of empty jargon about "solutions".

An IBM spokesperson commented that one element referred to in the report, the "integrated Server for eBusiness on zSeries", was no longer available. Likewise, the WebSphere, DB2 and zVM software are now sold separately rather than bundled together.