Sthu Deus wrote: > Things I consider are these (during the installation): > . I have working connection Yes. But the simple presence of a network is not a security vulnerability. > . I have at least working kernel and later diver services that are > configured and started during the install Those are of the installer environment. The installer environment is clean when it starts. Again the presence of a running kernel is not a security vulnerability. > . At the same time no firewall rules are applied at the working > (starting to work) system (before it is going to be rebooted - that is > also is waited for the user attention - does not reboot itself). This may sound surprising but not having a firewall in place is also not a security vulnerability. It is a good additional safety net for a general purpose desktop. It is a good recommendation. But not having one on a unix-like system is not a security vulnerability by itself. I think I will go so far as to guess that most servers on the net do not run any firewall. Because they also don't run any extra programs and so don't need it. Unless a program with a vulnerability is listening there isn't anything to attack. For a crack to be successful other things would have to happen at the same time such as the presence of a program listening to the network AND that program having a security vulnerability. Since the installer is a minimum system it does not start up any extra programs. Since none are listening to the network there isn't an attack vector for them to be cracked. The strongest attacks would probably be if the installer used a kernel that included a known remote network exploitable security vulnerability. That isn't likely if you use a recent install image. But if there was a remote vulnerability then that vulnerability would need to be exploited in the installer environment in such a way that it was installed in the target environment. It isn't a normal situation and would need to be attacked specifically for the installer environment. Plus the normal thing for the installer to do is to DHCP an address. Therefore the IP address of the system would need to be found during the installation and attacked. That again makes this less likely. Not impossible if an attacker was constantly scanning every address. But scanning every address is a huge amount of effort and should be detected. The likelihood of all of those things happening during the small window of installation time is very unlikely. Plus most people install on a private network behind a firewall from the Internet. This protects them from network attacks from the Internet. As long as your local private network is not compromised then you will be safe even if the installer kernel contained a known remotely exploitable network security vulnerability. Because you would need an attacker to attack you from your own network. Breaking that chain prevents the attack vector. > That's what is of interest. Hopefully this sets your mind at ease. Bob
Attachment:
signature.asc
Description: Digital signature