AlmaLinux and Rocky Linux Talk Open Source Linux Security
Gregory Kurtzer from Rocky Linux and benny Vasquez from AlmaLinux explain their approach to security — how they keep their open source Linux distros secure and stable while allowing contributions from community members.
This video is from the webinar, “Exploring the Post-Centos Landscape with AlmaLinux and Rocky Linux” that took place on June 8, 2023. It was moderated by Javier Perez, Chief OSS Evangelist and Senior Director of Product Management at Perforce Software.
To watch the full webinar, click here: https://ter.li/1z4d5l
Looking for Enterprise Linux support? Click here to learn more: https://ter.li/tdifx5
- -
About OpenLogic by Perforce:
OpenLogic offers end-to-end enterprise support for organizations using open source software in their infrastructure. With support for over 400 open source packages, guaranteed SLAs, and direct access to highly experienced Enterprise Architects, OpenLogic customers benefit from 24x7 ticket-based technical support, professional services, and training.
Follow OpenLogic on LinkedIn, Twitter, and don’t forget to subscribe to our YouTube channel for more videos on all things open source!
- -
Transcript (lightly edited for clarity):
Javier: Obviously, top of mind is security. What are AlmaLinux and Rocky Linux doing around security – are there security features you can comment on?
Greg: benny, you want to go first this time?
benny: Sure, sure. So I'm going to say the defaults of security is absolutely where we've started. So things including SBOM stuff, that's just the default at this point, it has to be, because we all know that that's going to be there, infrastructure security as we're going through the build process, that kind of stuff. Obviously, signatures, that's almost not even worth saying because that's the kind of stuff that has to come by default in an operating system.
Javier: Table stakes, table stakes.
benny: The things that we're excited about are engaging additional ... They end up becoming sponsors almost always, but engaging additional companies and specifically security specialists in a way that helps us identify anything that we don't see by default. Obviously, we have the massive support of a number of companies that have huge investments in security. Obviously, CloudLinux is the first one that comes to everybody's mind because they've been dealing with hardening Linux for more than 10 years, but we've also got our other two platinum sponsors, Codenotary and CyberTrust. CyberTrust we just announced a couple of weeks ago and it's been a huge just validation for what we've been going through working with them as we continue to build that security for the entire project.
Javier: You want to comment on that, Greg?
Greg: Yeah, absolutely. So I'm going to go back again a little bit because I think as though some context is really important to know why we did some of the things that we did. Early CentOS, we didn't have a way of managing some of the security context. We weren't building things in the cloud. As a matter of fact, it was being built on personal systems, laptops, personal workstations, and then the artifacts of the builds were just being posted to various mirrors and then signed by the individuals that were developing those packages. So it means we had to have the keys, those private keys. The keys to the kingdom, in a manner of speaking, for the operating system was in the hands of numerous people. The way that you manage security in that environment is you keep that team very small and very, very, very trusted.
That created an initial culture of CentOS, which was always a small team, and that team has been, and really, I just want to give props to that team, the team that has carried the weight of CentOS going from inception all the way through Red Hat acquiring it, and then even beyond, CentOS had a number of hurdles that they had to get over and it survived and thrived, I'll even say, due to the dedication of those individuals. So big hand to those people. It's a huge amount of work that they put into this.
I also just want to now go back. That culture of the small team was because they didn't have the capabilities. We didn't have the tooling at that point to properly manage builds, operating system builds by a number of different people. So one of the things that we decided with Rocky is before we go and build the operating system, we're going to go build the infrastructure to build the operating system. We started from scratch, from nothing, and started building this up. We started the first version of our build system. We were leveraging the Fedora tools called Koji, Pungi, and Modular Build System, et cetera, and we replicated that.
We did this because we wanted to ensure that individuals can come and contribute packages, maintain packages, and add packages to Rocky Linux in a way that doesn't compromise security like what we had earlier with CentOS [...]