This directory provides parameters for particular devices on the system. Most systems have at least two directories, cdrom and raid, but customized kernels can have others, such as parport, which provides the ability to share one parallel port between multiple device drivers.
The cdrom directory contains a file called info, which reveals a number of important CD-ROM parameters:
Issue the following responses to the queries from the command:
n (create a new partition)
p (will make it a "primary" partition)
1 (starting cylinder)
w (write partition table and quit)
/sbin/mke2fs -b 2048 /dev/hdd
mkdir /mnt/dvd
mount /dev/hdd /mnt/dvd
You can create, delete, and edit files & directories under /mnt/dvd in the same way that you would for any other file systems
Unmount the disk with the command:
umount /mnt/dvd
(Make ATAPI CD/DVD Devices look like SCSI devices under Linux)
/sbin/modprobe ide-scsi
ln -sf /dev/scd0 /dev/cdrom
ln -sf /dev/scd1 /dev/cdrom1
cdrecord -scanbus
cdrecord -scanbus dev=ATAPI
cdrecord -dao -v speed=24 dev=ATAPI:0,0
mke2fs -b 2048 /dev/scd1
mke2fs -b 2048 /dev/hdd
mount /dev/hdd /storage/dvd
mondoarchive -L -s 2220m -E /web_disc -Oi -d /storage/dvd
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -g -Oi -d /storage/dvd
mondoarchive -L -E /web_disc -Oi -d /storage/dvd -g -B "mount /storage/dvd" -A "umount /storage/dvd" -s 2220m
mondoarchive -L -g -E "/web_disc /web_logs" -Oi -d /web_disc/ccp14/temp
mondoarchive -S /tmp -T /tmp -L -E "/web_disc /web_logs" -S /web_disc/ccp14/temp -Oi -d /web_disc/ccp14/temp
mondoarchive -Oi -d /mnt/zip -g -B "mount /mnt/zip" -A "umount /mnt/zip" -s 100m
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -Ow -d 1,1,0
mondoarchive -S /tmp -T /tmp -Ow 1 -d /dev/scd1 -L -s 2220m -E "/web_disc /web_logs"
Verify an existing archive (16 is speed):
mondoarchive -Vc 16
mondoarchive -S /tmp -T /tmp -L -s 2220m -E "/web_disc /web_logs" -Oi -d /tmp/isos
cdrecord dev=1,1,0 -v blank=fast
cdrecord -dao -v dev=1,1,0 -data -eject 1.iso
Mount and view an ISO image:
mkdir /mnt/isoimage
mount -t iso9660 -o loop 1.iso /mnt/isoimage
information on MATSHITA DVD-RAM LF-D310
Panasonic LF-D311 IDE DVD-RAM/R
http://www.cdrinfo.com/hardware/panasonic-lfd311/page2.shtml
Burn Baby Burn - Setting up and burning DVD-Rs on your linux workstation
http://www.comet.ucar.edu/strc/wes/documents/dvd-r_setup.htm
If you are experiencing pop-ups generated by one of these malicious programs, you may want to remove the pop-up program from your computer. One program that attempts to detect and to uninstall pop-up programs is available at http://download.cnet.com/downloads/0-10106-108-63806.html. We have no relationship with the individuals who created this software and cannot vouch for it ourselves.
> HOW do I "set the sticky bit" of /tmp?
It is indicated by a t in the executable bit of the ls listing
drwxrwxrwt 6 root root 1024 May 28 00:04 /tmp
^ small `t' mean sticky and executable
and you set it chmod as usual.
chmod o+t /tmp
See the chmod man page for more information.
To enable plain-text passwords:
1. Start->Run.
2. Type regedit.
3. Add the DWORD value to the Registry entry EnablePlainTextPassword (reg Dword) 1 in the following Registry location:
Win98: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSETUP
WinNT: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters
NOTE: In the string "EnablePlainTextPassword"there are no spaces and case is important.
A system of simultaneous linear equations is written
Ax = b
where A is the coefficient matrix, b is the right hand side, and x is the solution. A is assumed to be a square matrix of order n, but some of the individual routines allow A to be rectangular. If there are several right hand sides, the system is
AX = B
where the columns of B are the individual right hand sides, and the columns of X are the corresponding solutions. The basic task is to compute X, given A and B.
djbdns is a DNS package by DJ Bernstein that consists of
From: werner@visaw.rus.uni-stuttgart.de (Andreas Werner)
Newsgroups: comp.sys.sgi.admin
Subject: Re: sshd
Date: 8 Apr 2000 19:42:51 GMT
Organization: Comp.Center (RUS), U of Stuttgart, FRG
there are lots of ways to do this, but the SGI typical way is:
1. Create a file /etc/init.d/sshd containing the following:
====================================
#! /bin/sh
#
# start up ssh server at boot
#
case "$1" in
'start')
if /sbin/chkconfig sshd ; then
if test -x /usr/local/sbin/sshd; then
/usr/local/sbin/sshd
fi
fi
;;
'stop')
/sbin/killall sshd sshd1
;;
*)
echo "usage: $0 {start|stop}"
;;
esac
#
====================================
2. Create two links:
# ln -s ../init.d/sshd /etc/rc0.d/K01sshd
# ln -s ../init.d/sshd /etc/rc2.d/S99sshd
3. Create a config variable:
# chkconfig -f sshd on
That's all, including the possibility to configure the daemon
on or off woth the 'chkconfig' command.
For the experts: Yes, I know that the 'killall' command will
kill user ssh daemons, too, but that's exactly the thing I want
when the machine shuts down ;-)
To: Exploit-Dev
Subject: Re: ssh-1.2.27 remote buffer overflow - exploitable
Date: Mon Nov 08 1999 21:24:17
Author: Daniel Jacobowitz
Message-ID: [19991109112417.A30046@drow.res.cmu.edu]
On Tue, Nov 09, 1999 at 01:48:53AM -0000, Frank wrote:
> This is submitted to the Freebsd bug tracking system, although there
> are doubtless other vendors who leave this package, despite the
> existence of the ssh-2.X. While Debian appears to be immune, I was
> able to crash my ssh daemon (much to my dismay), and there appears
> the potential to execute arbitrary code, as long as you encrypt it
> first...
>
> Here is the freebsd report.. it describes the method to crash a
> remote Ssh daemon (lets hope you ran sshd from your xinetd, etc).
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=14749
>
And here's a patch. Not tested, as I don't use the rsaref glue on any
machine here.
Dan
/--------------------------------\ /--------------------------------\
| Daniel Jacobowitz |__| SCS Class of 2002 |
| Debian GNU/Linux Developer __ Carnegie Mellon University |
| dan@debian.org | | dmj+@andrew.cmu.edu |
\--------------------------------/ \--------------------------------/
--- rsaglue.c.orig Tue Nov 9 11:12:32 1999
+++ rsaglue.c Tue Nov 9 11:17:58 1999
@@ -139,6 +139,10 @@
input_bits = mpz_sizeinbase(input, 2);
input_len = (input_bits + 7) / 8;
+ if(input_bits > MAX_RSA_MODULUS_BITS)
+ fatal("Attempted to encrypt a block too large (%d bits, %d max) (malicious?).",
+ input_bits, MAX_RSA_MODULUS_BITS);
+
gmp_to_rsaref(input_data, input_len, input);
rsaref_public_key(&public_key, key);
@@ -172,6 +176,10 @@
input_bits = mpz_sizeinbase(input, 2);
input_len = (input_bits + 7) / 8;
+ if(input_bits > MAX_RSA_MODULUS_BITS)
+ fatal("Received session key too long (%d bits, %d max) (malicious?).",
+ input_bits, MAX_RSA_MODULUS_BITS);
+
gmp_to_rsaref(input_data, input_len, input);
rsaref_private_key(&private_key, key);
So you can install the bzipped JDE, obtain bzip2 and install this extraction software.
Summary posted on the WGET Mailing List
SUMMARY:
Any strength encryption can be exported without a license to anybody
except governments in all countries but the terrorist 7 (Cuba, Iran,
Iraq, North Korea, Libya, Syria, Sudan).
"Government" is limited to entities performing governmental functions or
producing munitions.
"Retail" products can be exported to Governments without a license.
"Retail" products now include web-based products with equivalent
functionality to those you would traditionally consider to be retail
(generally available, and not easily morphed into something or so
complicated that you need a service agreement--but this standard
doesn't apply to web-based products, so long as the functionality is
equivalent)
Publically available source code can be downloaded without restriction
(you have to give the Bureau of Export Administration (BXA) the url),
but if you enter into an license to allow someone to commercially
develop a product based on the software AND you charge a royalty or
license fee, you have to report the name, address and description of
the intended product to BXA.
You can sell anything to ISPs and telcos without a license, and they
can provide services based on this to all entities except governments.
A license is required if the ISP or telco wants to provide a non-retail
service specific to government end-users.
There are certain review and reporting requirements, which should be
reviewed with the full text of the regulation at:
http://www.bxa.doc.gov/Encryption/pdfs/Crypto.pdf
Most companies implement a Reverse DNS check to see where the download
is coming from and compare that against a Restricted Countries and Parties
("terrorist" countries and known terrorists). This mechanism can certainly
be spoofed, but it is a best effort approach. Kinda silly in some cases,
but it is U.S. Export Law.
|
5.6. Can I use ssh to protect services like FTP or POP?If you want to avoid sending FTP passwords in cleartext over the net, you can use ssh to encrypt your command channel. This will still leave your data channel open to all attacks on TCP, and will not work through a firewall. You can either use ftpsshd by Per-Erik Martin at http://www.docs.uu.se/~pem/hacks/ for SSH1, or you can do this by hand. SSH1: Suppose you are on a host called myhost and want to initiate a ftp connection to ftphost. On myhost, you do myhost$ ssh -L 1234:ftphost.example.com:21 ssh-serverThis logs you on to ftphost and also forwards connections to 1234 on myhost to ftphost. Note: You need to use -g if you're forwarding to localhost (SSH1 only). Then, in another window, you do myhost$ ftp localhost 1234 220 ftphost FTP server (Foonix 08/15) ready. Name: (myhost:yourname): 331 Password required for yourname Password: 230 User yourname logged in.This works if the remote ftp daemon accepts PORT commands which specify a different host from the one the command channel appears to come from, and if the ftp client always uses PORT. This is true for vanilla UNIX ftp client and ftpd servers; it may not work for more advanced ftpds, such as wu-ftpd. For servers which do not accept this, you can see wether you ftp client supports passive mode, and wether the ftp server accepts PASV. Note, however, that unencrypted ftp data connections are still vulnerable to session hijacking and snooping. SSH2: Just use sftp instead. :-) For POP, Stephane Bortzmeyer (bortzmeyer@pasteur.fr) has written a script which protects the mail transfer and passwords ussing ssh. It requires no modification to existing POP servers or clients, and is available from ftp://ftp.internatif.org/pub/unix/gwpop/ . Or, you can use similar means for secure POP: myhost$ ssh -L 1234:popserver.example.com:110 ssh-server Other services could be secured by similar means.
5.7. Can I use ssh across a Socks firewall?
Socks 4 and 5 support should work in 1.2.16 or later. Socks support in version 2.0.11 and later should work.
|
Newsgroups: comp.security.unix Subject: Re: secure pop from sniffing From: [bglbv@my-deja.com] X-Newsreader: Gnus v5.7/Emacs 20.6 Date: 06 Jun 2000 20:29:54 +0100 "Bernd Dürrer" [duerrer@ika.ruhr-uni-bochum.de] writes: > "kukulkan" [isman@fsksm.utm.my] schrieb im Newsbeitrag > news:393C65B2.5A676C14@fsksm.utm.my... > > any software/methods to secure pop(esp. Eudora users) from being sniff?I > > have ssh here to protect remote login and file transfer, but still it > > has no meaning If I cannot have the pop to be secure .. > You want to use the port forwarding capabilities of SSH: Have a look at > http://www.employees.org/~satch/ssh/faq/ssh-faq-5.html#ss5.6 > > If this doesn't help you, please post what SSH implementation on what OS > your pop users are using. I don't think Eudora supports the SSH protocol at all. What it might support is: (a) APOP (Authenticated POP), which involves transmitting a (non-replayable) hash of the POP password and of a challenge sent by the POP server. The POP password is distinct from the password used for interactive logins. (b) POP over an SSL tunnel (to port 995 rather than 110). If I remember correctly, Eudora can do (a) but not (b), while Netscape Messenger can do (b) [but not (a)?]. It's probably wise to support both. And to make the POP passwords different from the login passwords in any case. Also make sure your POP server has no known security holes. (Some versions of Qpopper are to be avoided, for example.) |
From: eitz@weh.rwth-aachen.de (Holger Eitzenberger) Newsgroups: comp.security.unix Subject: Re: secure pop from sniffing Date: 7 Jun 2000 09:22:00 GMT Organization: RWTH Aachen Lines: 16 On Tue, 06 Jun 2000 10:45:06 +0800, isman@fsksm.utm.my (kukulkan) wrote: >any software/methods to secure pop(esp. Eudora users) from being sniff?I >have ssh here to protect remote login and file transfer, but still it >has no meaning If I cannot have the pop to be secure .. You may want to use APOP (authenticated POP3), which i use also. Both QPopper (on server side) and fetchmail (on client side) support it. APOP uses an encrypted one-time key to get mail. Holger -- + GnuPG Public Key -> finger eitz@jonathan.weh.rwth-aachen.de + |
|
Using APOP at NCSA - What is APOP?
|
http://www.cert.org/incident_notes/IN-99-01.html Automated Scanning and Exploitation http://www.cert.org/incident_notes/IN-98-06.html Probes with Spoofed IP Addresses http://www.cert.org/incident_notes/IN-98-05.html Advanced Scanning http://www.cert.org/incident_notes/IN-98.04.html New Tools Used for Widespread Scans http://www.cert.org/incident_notes/IN-98.02.html The most frequent reports involve well-known vulnerabilities in mountd, IMAP, and POP3. These services are installed and enabled by default in some operating systems. See the following advisories for more information: sunrpc (TCP port 111) and mountd (635) http://www.cert.org/advisories/CA-98.12.mountd.html IMAP (TCP port 143) http://www.cert.org/advisories/CA-98.09.imapd.html POP3 (TCP port 110) http://www.cert.org/advisories/CA-98.08.qpopper_vul.html
(23) telnet (53) dns (79) finger (80) web (110) pop (111) SunRPC & NFS (UDP and TCP) (143) imap (1080) socks (2049) nfs (UDP) (6000) X
From: Barry Margolin [barmar@bbnplanet.com] Newsgroups: comp.security.unix Subject: Re: Port Numbers List. Enjoy. In article [37de9d3b.528020403@news1.cal.metronet.ca], Jim Hutchison [Jim Hutchison] wrote: >There's a few posters wanting to know what services are associated >with certain port numbers. Here's a list I've been working with that >has been a great help. What's the Yes/No at the end of each line? >0 ICMP Click attack Yes ICMP doesn't have a port number, since it's not TCP or UDP. >19 UDP Chargen Yes >21 TCP Detects if someone is trying to FTP to you. No >23 TCP Detects if someone is trying to Telnet to you. No >53 TCP DNS Yes >129 TCP Password Generator Protocol Yes >137 TCP Netbios name (DoS attacks) Yes >138 TCP Netbios datagram (DoS attacks) Yes >139 TCP Netbios session (DoS attacks) Yes >555 TCP Stealth Spy - Beta 3 No >666 TCP Attack FTP No >1027 TCP ICQ Yes >1029 TCP ICQ Yes >1032 TCP ICQ Yes >1080 TCP Used to detect Wingate sniffers. Yes >1243 TCP Sub Seven (Also see TCP 6776 and TCP 6711) No >1981 TCP Shockrave No >2140 UDP Deep Throat No >2989 UDP Rat No >3150 UDP Deep Throat No >5000 2 TCP Detects & blocks Sokets de Trois v1. Yes >5001 TCP Detects & blocks Sokets de Trois v1. Yes >6711 TCP Sub Seven (Also see TCP 1243 and TCP 6776) No >6776 TCP Sub Seven (Also see TCP 1243 and TCP 6711) No >6969 TCP Gate Crasher No >7300 TCP Net Monitor No >7301 TCP Net Monitor No >10067 UDP Portal of Doom No >10167 UDP Portal of Doom No >12076 TCP GJamer No >12345 TCP Netbus No >12346 TCP Netbus No >20000 TCP Millennium No >20001 TCP Millennium No >21554 TCP GirlFriend No >23456 TCP EvilFTP No >30100 TCP NetSphere No >30102 TCP NetSphere No >31337 UDP Backorifice (BO) No >31337 TCP Netpatch No >31338 UDP Deep BO No >31785 TCP Hack'a'Tack No >31789 UDP Hack'a'Tack No >31791 UDP Hack'a'Tack No >40421 TCP Master's Paradise - Hacked No >40422 TCP Master's Paradise - Hacked No >40423 TCP Master's Paradise - Hacked No >40425 TCP Master's Paradise - Hacked No >50505 TCP Detects & blocks Sokets de Trois v2. No >54320 TCP Backorifice 2000 No >54321 UDP Backorifice 2000 No >65000 TCP Devil No
7777 Unreal, Klingon Honor Guard 22450 Sin 26000 Quake 26900 Hexen 2 26950 HexenWorld 27015 Half-life 27500 QuakeWorld 27910 Quake 2 28910 Heretic 2
"You can diagnose most memory leaks with Performance Monitor and several Microsoft Windows NT Server 4.0 Resource Kit utilities. (For a list of resource kit tools, see the sidebar "Resource Kit Tools for Diagnosing and Monitoring Memory Leaks.")"
The TNEF implementation defines several TNEF-specific attributes, each of which corresponds to a particular MAPI property. These attributes are used to encode their respective MAPI properties into the TNEF stream. In addition, a special attribute is defined that can be used to encapsulate any MAPI property that does not have a specific attribute corresponding to it. The reason these attributes are defined instead of simply using a uniform encoding method for all MAPI properties is to enable backward compatibility with non-MAPI-compliant software that is using TNEF such as Microsoft Mail 3.x and its transport providers.
The remainder of this appendix describes the structure and syntax of a TNEF stream, the mapping between MAPI properties and TNEF attributes, and important considerations for certain TNEF attributes."
12,248,097
The attacking Windows machines generate maximum-size 64k byte UDP packets, but only the first 1500 byte "fragment" of each packet carries the packet's port "666" destination. Therefore, for every identified "666" packet blocked, approximately 43 additional maximum-size "packet fragments" were also blocked. We therefore estimate that our filters running in Verio's router blocked at least 538,916,268 malicious packets that night.
May 17/18/19/20th - Attack 6. The exact dates and times are unknown because we were completely shielded by the configuration of Verio's router. But when we checked the router's "UDP/666" hit counter on the morning of Monday May 21st we found that the blocked "666" count had jumped from its previous value of 12,248,097 to a whopping 54,528,114 packets, leading us to conclude that the filters had weathered, by this time, at least :
2,399,237,016 malicious packets.
- nearly 2.4 BILLION malicious packets.
1. Thank God someone's finally exposing this charlatan
2. You both make good points, but we're still leaning in Steve's direction
3. Steve walks on water; you're a moron, and so's your old man
> Is there a way to completely fool (or block) OS detection from scanners (like nmap, queso, > etc.) using the Linux OS? What about Windoze? Under linux try iplog ( http://ojnk.sourceforge.net/ ) with -z as option. I've been using it for a while, and it works like a charm. Under windows, i have absolutely no idea.
If you describe your intermediate forms using Zephyr's Abstract Syntax Description Language (ASDL), we can generate data-structure definitions in C, C++, Java, Standard ML, and Haskell."
Adding Shortcuts to Windows 95
If you would like to add a shortcut to your program in the Start Menu,
you can use the undocumented API call that is used in the setupkit.
Declarations
You must declare the following in the declarations section of a project.
Declare Function fCreateShellLink Lib "STKIT432.DLL" _
(ByVal lpstrFolderName as String, ByVal lpstrLinkName _
as String, ByVal lpstrLinkPath as String, ByVal _
lpstrLinkArgs as String) As Long
Use
To add a shortcut to the Start Menu, you call the function with these parameters:
Where to place the link in relation to the Programs folder on the Start Menu.
Name or Text to appear in the link.
Path of the file to link to.
Arguments for the file.
For instance, to add a shortcut to the desktop, you would use the following code:
lngResult = fCreateShellLink("....Desktop", _
"Link to my program", "C:\Path\Program.exe","")
Tip by James Limm
Visual Basic
Adding shortcuts in Windows 95
It's easy to create your own shortcuts. The secret to creating shortcuts with Visual Basic
lies in this VB 4.0 setup kit declaration:
Declare Function fCreateShellLink _
Lib "STKIT432.DLL" _
(ByVal lpstrFolderName as String _
ByVal lpstrLinkName as String _
ByVal lpstrLinkPath as String _<
ByVal lpstrLinkArgs as String ) As Long
The first parameter asks where to place the link (shortcut) relative to
the Start menu's Programs folder. The second parameter is the name or
text to appear with the link. Next comes the file's path; the final
parameter handles any arguments. So, to place a shortcut on the desktop,
try this code:
iLong = fCreateShellLink("....Desktop", _
"My Link to Success", "C:PathSuccess.exe","")
"By utilizing the ITU-T T.128 compliant application sharing function, users can increase meaningful communication by collaborating on any shared X, Control Windows, and most Open GL applications as easily as if they were running the application natively. By sharing the actual application, users can easily see what others are doing without having to travel across town or to send a fax. Users need not have copies of the application on their machine in order to share it. The host opens the application, and other users view it on their screens simultaneously. The host may choose to give control to someone else in the conference. Changes made appear on everyone's monitors. Once the users are finished, they may save changes made in the session to the host's machine."
Dear Colleagues
I was alerted to this article by an article in "PC-Pro"
magazine, December edition page 251. The journalist drew attention
to this and a few other funny effects that occur, especially when
using Excel with Visual Basic programming. I imagine quite a lot
of people use Excel across CLRC - I do, so I will be somewhat more
sceptical of the results & check them somewhat more.
Here's the Reference & Abstract from Elsevier's website.
http://www.elsevier.nl/locate/csda
========================================================
Computational Statistics And Data Analysis Vol. 31 (1) pp. 27-37
Copyright (c) 1999 Elsevier Science B.V. All rights reserved.
"On the accuracy of statistical procedures
in Microsoft Excel 97"
B.D. McCullough, Berry Wilson
Federal Communications Commission,
445 12th St. SW Room 2C-134, ,
Washington, DC 20554, USA
Received 1 June 1998; Revised 1 December 1998
Abstract
The reliability of statistical procedures in Excel
are assessed in three areas: estimation (both
linear and nonlinear); random number generation;
and statistical distributions (e.g., for calculating
p -values). Excel's performance in all three areas
is found to be inadequate. Persons desiring to conduct
statistical analyses of data are advised not to use Excel.
===========================================================
(I did the highlighting)
Robert Paynter,
Energy Research Unit, RAL
Other Information
The "hit profile" of an adult-oriented site is amazingly different from any other kind of site. Because there are relentless, insatiable hordes of visitors, it is almost impossible to control the bandwidth requirements of such sites in a manner that will satisfy the visitors, the adult site customer, and our other customers. The peak hit frequency of some adult sites is extreme; even when access is blocked to restrict bandwidth, the impact on servers is more than noticeable."
"Aren't PCs just toy machines?"
"Any provider who tells you this has either never used an unrestricted Unix on the PC platform, or is trying to justify their misguided and unnecessarily expensive investment in inflexible "corporate mentality" equipment. When compared to commercial Unix vendor equipment that costs ten times as much, a properly configured PC-based server provides superior price/performance ratio, overall reliability, and spare parts availability. Don't be fooled by the legacy of DOS!"
From: Ole Michaelsen [omic+usenet@fys.ku.dk]
Newsgroups: comp.security.unix
Subject: Re: secure a user to his home directory and disable him from viewing anything outside his own directory
Date: 08 Jun 2000 20:08:34 +0200
Organization: University of Copenhagen
dwaynekuan@my-deja.com writes:
>
> how do i totally shut him down to his own home directory??
I found this on freshmeat. Maybe that's what you need?
Path: news.freshmeat.net!not-for-mail
Approved: scoop@freshmeat.net (Patrick Lenz)
Message-ID: [8hnrkf$9vo$2@mail.freshmeat.net]
NNTP-Posting-Host: freshmeat.net
NNTP-Posting-Date: 8 Jun 2000 10:13:35 GMT
Xref: news.freshmeat.net fm.announce.console:3910
application: Linux Intrusion Detection System 0.9.5a
author: Xie Hua Gang [xhg@gem.ncic.ac.cn]
license: GPL
category: Console/Firewall and Security
urgency: medium
homepage: http://freshmeat.net/redir/homepage/939982897/
download: http://freshmeat.net/redir/download/939982897/
description:
The Linux Intrusion Detection System is a patch which enhances the
kernel's security. When it is in effect, chosen files access, all
system/network administration operations, any capability use, raw
device, mem, and I/O access can be made impossible even for root. You
can define which program can access which file. It uses and extends the
system capabilities bounding set to control the whole system and adds
some network and filesystem security features to the kernel to enhance
the security. You can finely tune the security protections online, hide
sensitive processes, receive security alerts through the network, and
more.
Changes:
Transition to 2.2.16 kernel, bugfix for protecting mount point, bugfix
for port scanner detector in the kernel.
|> http://freshmeat.net/news/2000/06/08/960459276.html
Wouldn't something like making his shell be 'chroot sh -i $HOME' do the trick? [Please excuse me if I'm missing something obvious] -- Texas Imperial Software | Try WFTPD, the Windows FTP Server. Find us 1602 Harvest Moon Place | at web site http://www.wftpd.com or email Cedar Park TX 78613 | us at alun@texis.com. VISA / MC accepted. Fax +1 (512) 378 3246 | NT-based ISPs, be sure to read details of
> dwaynekuan@my-deja.com writes: > > > how do i totally shut him down to his own home directory?? man 2 chroot
From: clive@nsict.org (Clive Jones) Newsgroups: comp.security.unix Subject: Re: secure a user to his home directory and disable him from viewing anything outside his own directory Date: 9 Jun 2000 01:02:25 +0100 Organization: National Society for the Inversion of Cuddly Tigers In article [87em673j67.fsf@bglbv.my-deja.com], [bglbv@my-deja.com] wrote: >Yes, although the likelihood of unwittingly introducing a security >hole that makes it possible for the user to break out of the chroot >jail shouldn't be underestimated. That's not the only thing not to underestimate. Messing with chroot when you don't understand the implications fully can give people root expoits, not just a way out of the jail. An obvious example would be accidentally including su, login, or similar in their environment, when they can modify their personal version of /etc/passwd - but that's just the tip of the iceberg. --Clive.
Things get tricky for works that were in their first term when the law changed in 1978. Works copyrighted between January 1, 1950 and December 31, 1963 still had to be renewed in order to be protected for a second term. If renewed, the second term was extended to sixty-seven years, for a total of a ninety-five year term, see above.) If renewal was not applied for, the copyright protection ended on December 31 of the twenty eight year.
Works copyrighted between January 1, 1964 and December 31, 1977 were automatically renewed for a second term. Thus, no registration of the renewal was required."
APIC WORLDWIDE - Three Important Copyright Points
The United States affords protection to the authors of
certain original works as provided by the United States Code on Copyright.
In order to avoid the problems involved in copyright infringement it is
important to understand the fundamentals of copyright law. Three important
points are:
The notice of copyright
Just what does copyright protect
The duration of copyright
1. Notice Of Copyright
It is not necessary to attach a copyright notice to a work in order for
that work to be copyrighted. However, in order to be eligible for certain
damages in a lawsuit, the copyright notice must be attached.
A copyright notice should contain:
the symbol © (THE LETTER C IN A CIRCLE), or the word "Copyright" or the
abbreviation "Copr.", and; the year of first publication of the work, and;
the name of the owner of copyright in the work.
Example: ©1997 Jane Doe
2. What Types of Work Does Copyright Protect?
Copyright protects original works of expression. These works include:
literary
dramatic, including accompanying music
pantomimes and choreographic
pictorial, graphic and sculptural
motion pictures and other audiovisual
sound recordings, and
architectural
3. Duration of Copyright
Before 1978:
published: Copyright expires 75 years from the date of publication not
published: Copyright expires 12/31/02
1978 through present:
individually owned: life of author plus 50 years owned by employer of
author: 75 years from date of publication or 100 years from date of
creation, whichever occurs first.
Berne Convention
In 1989 the United States joined the Berne Convention for the Protection of
Literary and Artistic Works. The Berne Convention is an international
copyright treaty signed by 96 countries. The regulations are far more
stringent than United States copyright laws. The Berne Convention recently
extended the term of protection to the life of the author plus 75 years.
The United States law is expected to follow suit.
Fair Use
See 17 United States Code Section 107- Limitations on Exclusive Rights:
Fair Use- For certain purposes, such as criticism, comment, news reporting,
teaching (including multiple copies for classroom use), scholarship or
research, is not an infringement of copyright. In making this determination
of fair use these 4 factors must be considered: purpose and character of
use, whether of a commercial nature or for nonprofit
educational purposes;
the nature of the copyrighted work;
the amount and substantiality of the portion used
in relation to the copyrighted work as
a whole; and
the effect of the use upon the potential market
for or value of the copyrighted work.
Public Domain
Public domain is a legal term which refers to the end of term of copyright
and thereafter. You can be certain that you would never come across any
erotic photography on the web that would be considered public domain.
Remember, copyright begins with the creator of a work (a photo, an article,
etc.) and continues through that author's life plus 50 years. Only then is
that work in the "public domain". Anyone who simply puts up sites with
photos they grabbed elsewhere off the Internet is most certainly infringing
someone's copyrights. You can be certain that this includes all celebrity
images as well. A celebrity image with all applicable model releases would
allow the copyright owner economic freedom to sell or assign the rights to
that image.
The Public Domain is made up of all those works, that for whatever reason
are not protected by copyright Works in the Public Domain are free to use
without permission. These include:
originally non-copyrightable
expired copyright
authored by the Federal Government
specifically granted to the Public Domain
Australia outlaws e-mail forwarding
By: Thomas C Greene in Washington
Posted: 05/03/2001 at 08:10 GMT
Outrageously strict Internet copyright laws which have
just gone into effect throughout Australia make it illegal to forward an
e-mail memo without the author's permission, and could result in fines of
$60,000 or five years in the slam, according to a story by the Aussie
Sunday Telegraph.
"It's quite possible that the forwarding of an e-mail
could be a technical infringement of copyright," an unnamed legal advisor
to Oz Attorney General Daryl Williams told the paper.
"E-mailing is a 'communication' under the Digital
Agenda Act, and so is putting something up on a Web site," the source added.
This could rank as the world's most copyright-friendly and
common-sense-hostile piece of legislation yet devised. And that's not all:
Aussies recently revealed a widespread national neurosis by entertaining,
in the state of South Australia, an Internet censorship bill which would
criminalize the posting any material which cops deem offensive to children
- that's anything, anywhere.
The bill would require Net content to be child-friendly according to the
country's movie certification scheme; but, in a twist straight out of
Kafka, it's not possible for Webmasters to get their sites reviewed by the
relevant authority before they get busted.
Which is to say nothing of the lunacy of reducing
on-line discourse and dialogue to infant babble. Clearly, the Puritanical
delight in censoring impure thoughts and regulating the pleasure of others
has once again got out of control down under.
Over half a century ago the English writer Norman Douglas had occasion to
observe that "all mankind is at the mercy of a handful of neurotics".
So much for progress. ®
Aussie AG denies e-mail penalty, sort of
By: Thomas C Greene in Washington
Posted: 05/03/2001 at 16:50 GMT
We've been buried in reader responses, most originating in Australia,
pointing us to a statement in clear contradiction of a Sunday Telegraph
story indicating that Australia's new copyright regulations could result in
penalties for forwarding an e-mail memo, which we picked up here.
"Contrary to alarmist media reports, sharing e-mail is not banned by law,"
Australian Attorney General Daryl Williams says in a press release issued
Monday.
"Amendments to the Copyright Act that came into effect today do not ,outlaw
the practice of forwarding personal e-mails to other people. That would be
ridiculous," he observes.
A court would need to find that the contents of the e-mail were an
"original literary work", he adds. But while he decries media
sensationalism firmly enough, he doesn't quite deny the possibility that
forwarding e-mail can land one in hot water with the same finality.
"For example, if the e-mail was simply a joke that everyone had been
re-hashing for years, it is doubtful it would have the necessary
originality to be protected by copyright. Similarly, a casual exchange of
personal information or office gossip would probably not be original enough
to have copyright in it." (our emphasis)
That's not quite the same as saying that some doofus original limerick or
ode to precious bodily fluids as in the case of the now famous, possibly
bogus, Claire Swire e-mail could not be disputed in court.
One reader scolded us for repeating what we'd read in the papers. "The
Sunday Telegraph. A source for NEWS? Are you serious?!" they ask.
Well, we thought we were.... ®
> On 08 Jun 2000 12:17:06 +0200, Emmanuel Michon wrote: > > >Is it possible to get inside the local network without breaking the > >gateway security first? > > For one possibility (source routed packets) read > > http://www.robertgraham.com/pubs/firewall-seen.html#3.1 As far as I understand Linux is about sanely configured in this case, and has the following default settings: accept_source_route - BOOLEAN Accept packets with SRR option. (default TRUE) rp_filter - INTEGER 2 - do source validation by reversed path, as specified in RFC1812 Recommended option for single homed hosts and stub network routers. Could cause troubles for complicated (not loop free) networks running a slow unreliable protocol (sort of RIP), or using static routes. 1 - (DEFAULT) Weaker form of RP filtering: drop all the packets that look as sourced at a directly connected interface, but were input from another interface. 0 - No source validation. It seems that this setting is reasonable; but I could also disable definitely with accept_source_route=FALSE -- Emmanuel Michon
From: nick@webthing.com (Nick Kew)
Newsgroups: comp.security.unix
Subject: Re: One-to-many nat: can such a network be penetrated?
Date: Thu, 8 Jun 2000 13:31:13 +0000
Organization: The Holy Book of the Great Bludner
In article [7wbt1c1nq5.fsf@sdesigns.com],
Emmanuel Michon [emmanuel_michon@sdesigns.com] writes:
> let's consider a local network of computers with private addresses,
> let's say 172.15.0.0/255.255.0.0. Such addresses cannot be routed
> on the internet.
Methinks you got your address range wrong, but we'll let that pass.
> One of them acts as a gateway, with an ethernet 172.15.12.12 and
> also another network interface to the internet, with a public address.
> Is it possible to get inside the local network without breaking the
> gateway security first?
Somewhere on the 'net:
/sbin/route add -network [your.private.net] -gateway [your.public.address]
(or whatever the syntax for route on your OS may be)
Add a rule to block traffic arriving at the external interface for an
internal address.
--
Nick Kew
"Stallman was there to put them right. This is a man who treats copyright as damage and routes around it - as Nick Mailer from the Campaign for Unmetered Telecoms found out over lunch when Stallman roasted him for daring to use the non-open Zend PHP compiler, and told him that the only honourable thing to do was to sit down and write his own. For the man who started the GNU project, this probably seems reasonable, but the rest of us could only sit back in awe. "
The Net Authority Acceptable Internet Usage Guidelines (NA-AIUG) are based solely on the desirable morals of civilized society. Their basic effect is to simply organize and prioritize all that is blasphemous in the eyes of God. It is only natural for one of the tools of His creation to be adapted and molded into a form that He finds acceptable. Net Authority merely acts as a catalyst for that process."
For more information on our databases, please click here.
In these times of widespread chaos and blatant defiance of our Lord, we must work together. With our help and yours, the Internet can become a much safer, more enjoyable, and friendly environment to work in."
General Blasphemy
Registered General Blasphemy Offenders: 2801
The general blasphemy list contains information on people who have either read, distributed, or been involved in any way with blasphemic materials on the internet. General blasphemy is material that is considered evil when viewed through the eyes of God.
"``Why are we hiding from the police, daddy?'' ``They use Emacs, son, and we use vi.''
DragonLinux is small and compact in nature. The total file size is around 20 megabytes. If you need more utilities or applications that are not included in the distribution, simply grab them from the nearest internet site and install them!"
"Peer review often doesn't work (Score:3, Interesting)
by Anonymous Coward on Wednesday July 28, @09:17PM EDT (#107)
Back when I was in grad school, my research happened to make a notable contribution to a hot topic at the time. I was (usually with other authors)
submitting papers to IEEE journals at a rate of about 1 per 3-6 months. I also attended several conferences and got to know a lot of the major contributors in
my research area.
Typically, every submission got sent to 3 experts for review. My professor (and one of his collegues) even forwarded to me several papers they were asked to
review. I noticed a couple of things regarding peer review:
The second argument is that the CTEA falls foul of the US Constitution's guarantee of freedom of speech. A third road, not pressed before the Supreme Court, treats the CTEA as a violation of the judge-made "public trust" doctrine, which, in its narrowest form, holds that Congress cannot give away public lands and waters to private individuals.):
A: There is a problem with NT - it wouldn't boot from partitions above 2G. You have to place NT partition under 2G or make a small FAT-16 partition at the beginning of the disk where NT could put its boot files. Alternatively you may install a patch for FAT-16 boot sector that comes with Partition Manager version 2.38, which could boot NT from the partitions above 2G. For installation procedures, please, refer to readme.txt file that is included with version 2.38."
From: Henry Whincup
Cc: "freebsd-users@uk.freebsd.org"
Subject: Re: Installing in cylinder in > 1024
List-Archive: http://listserver.uk.freebsd.org/pipermail/freebsd-users/
Date: Wed, 28 Mar 2001 11:37:43 +0100 (BST)
This looks like it may help: From 'man boot0cfg':
--
-o options
A comma-separated string of any of the following options may be
specified (with ``no'' prepended as necessary):
packet Use the disk packet (BIOS Int 0x13 extensions) interface,
as as opposed to the legacy (CHS) interface, when doing
disk I/O. This allows booting above cylinder 1023, but
requires specific BIOS support. The default is `nopacket'.
--
However you can use grub if you prefer (I think there was an article on it
at http://www.daemonnews.org/).
As for 4.3 it is in the process of being released, so soon-ish!
cheers
Henry
File sharing applications such as KaZaA, Morpheus and Gnutella. Computers that have been broken into and then used to launch attacks. See http://www.cert.org/current for a list of currently active attacks that affect Microsoft Windows and Linux machines.
Streaming media servers.
Game servers.
These can all be legitimate uses of the network. However, total traffic is stressing our Internet capacity.
We are taking the following actions to manage performance:
Using measurement tools to detect computers that are using excessive amounts of Internet bandwidth for extended periods of time. For example, machines that are found to be using bandwidth of 2 Megabits per second or more over a 10-minute period are removed from the network and the responsible parties notified.
Continuing of "traffic shaping" of several popular file sharing applications across all network users at Columbia. This shaping began several months ago, and consists of limiting the bandwidth that is taken up by these applications. Since these applications use the TCP protocol, they automatically adjust to this limit by running a little more slowly.
Installing a faster Internet router. This new router will also facilitate more sophisticated traffic shaping than our current router is able to handle. It will also be able to handle extremely high numbers of packets (usually associated with Denial of Service attacks).
Continuing to monitor and analyze performance.
What you can do to help:
If you use a popular file-sharing application such as KaZaA, Morpheus, Gnutella, etc., please be considerate of others on the network and make the necessary configuration changes to:
1. Not share files from your computer. Don't be a KaZaA supernode.
2. Limit the bandwidth of your file sharing and/or the number of connections to your machine.
3. Similarly, media and game servers should be throttled in such a way that they do not consume inordinate amounts of bandwidth.
Please keep in mind that there are potential legal ramifications to sharing copyrighted materials such as music and videos.
You may want to add the "-u" option to ls to see last-accessed times rather than last-modified times (esp to help gauge how harmful it would be to unsetuid the file).
The US National Aeronautics and Space Administration (NASA)
has taken delivery of a desktop-sized supercomputer which draws no
more power than a hair dryer, based on Field Programmable Gate Array
(FPGA) technology instead of a CPU.
FPGA chips can reconfigure themselves thousands of times a second,
making it possible for numerous applications to run simultaneously. This
setup simply leapfrogs over Moore's Law, yielding a desktop box with
1000 times the power of one running on a CPU.
The power boost comes from the ability of an FPGA array to maximize
the use of transistors. A CPU is designed to handle many different sorts
of tasks, so only a fraction of its transistors is in use at any given time.
An FPGA array, by contrast, can dedicate as many of its transistors as
needed for a task on the fly.
config.cache should always be removed if you have changed the CC, CXX, CFLAGS or CXXFLAGS environment vars."
Also see the WAI HTML Techniques and CSS Techniques documents.
Some users report that when they use Change Case to change the filenames to upper case, Windows Explorer shows filename with an initial capital and the rest is lower case after this change. In fact, this is NOT a bug of Change Case. This is a problem of Windows. If the length of folder/file name is less than or equal to 8 and the folder/file name is in upper case, Windows Explorer will display it with an initial capital. But if you use DIR command in MS-DOS prompt or in Netscape Navigator or FTP clients, you will see the filename is really upper case. This is designed by Windows.
Change Case is a CARDWARE. If you are using the program, please send a postcard to
Hai Li
No. 1607 Unit 133
Beijing Institute of Technology
Beijing 100081
PR China
Newsgroup: comp.os.ms-windows.networking.win95 In article [3403e909.767220765@harrogateX51], we heard from "jegan@shipway.u-net.com (James Egan)", who said: >IMHO an important requirement is to be able to force lowercase in >filenames. Win95 tends to mix and match upper and lower case which can >cause unneccessary problems on unix machines. Before anyone else gets confused, let's note that Unix also uses mixed upper and lower case. Or at least, Unix users often do. The difference is that Unix requires you to access the file with the same case that it was originally created. Win95 doesn't care what case you use, and will happily read file "README.TXT" when it is asked for "readme.txt" - Unix will simply insist the file does not exist. The Unix method is known as Case Sensitive, and the Windows method is Case Preserving. It's only a matter of convention that most users will give their file names in lower case on Unix machines. And it's a matter of poor programming that even telling a Windows NT command-line FTP client "put filename.dat filename.dat" may result in a file on the remote machine called "FILENAME.DAT". Alun. ~~~~ --- Texas Imperial Software | Try WFTPD, the Windows FTP Server. 1602 Harvest Moon Place | Available at the web site Cedar Park TX 78613 | http://www.wftpd.com Fax +1 (512) 378 3246 | or email me at alun@texis.com Phone +1 (512) 257 2578 | Now accepting credit card orders! =================================================================== ***** WFTPD Pro, an NT Service FTP Server supporting multiple ***** ** simultaneous virtual hosts, is now available for $80 per copy **
CARDWARE to Bill Klein 6950 Fielding, Apt 606 Montreal, Quebec H4V 1P7 Canada
An excerpt from e:\winnt\system32\drivers\etc\hosts: 127.0.0.1 ad.doubleclick.net That line prevents the DoubleClick ads from loading, and so prevents me from clicking the ads, as well as preventing my computer from having to load the ads.
ALL: ALL: spawn ((/bin/echo -n "user = %u\nclient = %h\nserver = %H\nprocess = %d\nPID = %p\ndate = "; /bin/date) | /bin/mail -s "Unauthorized access" root &)
Certainly, Wietse's rpcbind is an excellent choice for tightening up the portmapper. However, I'd have to ask why any RPC services are required on a web server -- I'm assuming that it's open to the outside world to access. I'd recommend going through every active network port and eliminating those that are not _essential_ to running the web server, at a minimum. YMMV. Cheers, Ken Kenneth R. van Wyk Vice President, Chief Technology Officer Para-Protect Services, Inc. krvw@para-protect.com http://www.para-protect.com
From: "Derrick Young" [derrick.young@washingtondc.ncr.com] Newsgroups: comp.security.unix Subject: Re: Restrict ROOT logon Date: Wed, 29 Sep 1999 15:18:48 -0400 look in /etc/default - there should be a file /etc/default/login - there should be an entry #console=/dev/console If you remove the comment (#) from this line and save the file then you will limit the root login to the console. Note, you will be able to su to root from any session - but not from the login prompt.
Here's a modified copy of the original ruleset using the
quick keyword:
block in quick all
pass in all
In this case, IPF looks at the first rule:
block in quick all
The packet matches and the search is over. The packet is
expunged without a peep. There are no notices, no logs, no
memorial service. Cake will not be served.
3.2. Implicit Allow; The "keep state" Rule
The job of your firewall is to prevent unwanted traffic
getting to point B from point A. We have general rules
which say "as long as this packet is to port 23, it's okay."
We have general rules which say "as long as this packet has
its FIN flag set, it's okay." Our firewalls don't know the
beginning, middle, or end of any TCP/UDP/ICMP session. They
merely have vague rules that are applied to all packets.
We're left to hope that the packet with its FIN flag set
isn't really a FIN scan, mapping our services. We hope that
the packet to port 23 isn't an attempted hijack of our tel-
net session. What if there was a way to identify and autho-
rize individual TCP/UDP/ICMP sessions and distinguish them
from port scanners and DoS attacks? There is a way, it's
called keeping state.
We want convenience and security in one. Lots of peo-
ple do, that's why Ciscos have an "established" clause that
lets established tcp sessions go through. Ipfw has estab-
lished. Ipfwadm has setup/established. They all have this
feature, but the name is very misleading. When we first saw
it, we thought it meant our packet filter was keeping track
of what was going on, that it knew if a connection was
really established or not. The fact is, they're all taking
the packet's word for it from a part of the packet anybody
can lie about. They read the TCP packet's flags section and
there's the reason UDP/ICMP don't work with it, they have no
such thing. Anybody who can create a packet with bogus
flags can get by a firewall with this setup.
Where does IPF come in to play here, you ask? Well,
unlike the other firewalls, IPF really can keep track of
whether or not a connection is established. And it'll do it
with TCP, UDP and ICMP, not just TCP. Ipf calls it keeping
state. The keyword for the ruleset is keep state.
9.1. Localhost Filtering
A long time ago at a university far, far away, Weitse
Venema created the tcp-wrapper package, and ever since, it's
been used to add a layer of protection to network services
all over the world. This is good. But, tcp-wrappers have
flaws. For starters, they only protect TCP services, as the
name suggests. Also, unless you run your service from
inetd, or you have specifically compiled it with libwrap and
the appropriate hooks, your service isn't protected. This
leaves gigantic holes in your host security. We can plug
these up by using ipf on the local host. For example, my
laptop often gets plugged into or dialed into networks that
I don't specifically trust, and so, I use the following rule
set:
pass in quick on lo0 all
pass out quick on lo0 all
block in log all
block out all
pass in quick proto tcp from any to any port = 113 flags S keep state
pass in quick proto tcp from any to any port = 22 flags S keep state
pass in quick proto tcp from any port = 20 to any port 39999 >< 45000 flags S keep state
pass out quick proto icmp from any to any keep state
pass out quick proto tcp/udp from any to any keep state keep frags
It's been like that for quite a while, and I haven't suf-
fered any pain or anguish as a result of having ipf loaded
up all the time. If I wanted to tighten it up more, I could
switch to using the NAT ftp proxy and I could add in some
rules to prevent spoofing. But even as it stands now, this
box is far more restrictive about what it presents to the
local network and beyond than the typical host does. This
is a good thing if you happen to run a machine that allows a
lot of users on it, and you want to make sure one of them
doesn't happen to start up a service they wern't supposed
to. It won't stop a malicious hacker with root access from
adjusting your ipf rules and starting a service anyway, but
it will keep the "honest" folks honest, and your weird ser-
vices safe, cozy and warm even on a malicious LAN. A big
win, in my opinion. Using local host filtering in addition
to a somewhat less-restrictive "main firewall" machine can
solve many performance issues as well as political night-
mares like "Why doesn't ICQ work?" and "Why can't I put a
web server on my own workstation! It's MY WORKSTATION!!"
Another very big win. Who says you can't have security and
convienence at the same time?
"Man pages for the portmapper say you can stuff "-A" or "-a 255.255.255.0,my.net.work.0" to only allow RPC from these places (the first means "my networks"); I've tried this, but it didn't do anything -- that is, I could still tickle anything RPC-ish from anywhere."
> *** A fragmentation attack against IP Filter *** > > April 6th, 2001 > > Thomas Lopatic> > The research for this advisory was supported by > > TUV data protect GmbH, > a TUV Rheinland/Berlin-Brandenburg affiliate > > >Summary >------- > >The current release (3.4.16) of Darren Reed's IP Filter package >contains a flaw in the fragment handling code. This vulnerability >enables an attacker who has access to a single UDP or TCP port on a >host protected by an IP Filter firewall to obtain access to any other >UDP or TCP port on the same host. > >Although this flaw is based on problems handling fragments, it can >still be exploited even if the rule-base explicitly blocks all >fragmented packets. > >It seems that this problem has been buried in the source code for >quite a while. Thus it is likely that several older releases of IP >Filter are also vulnerable. However, the only version that I have >looked at in addition to 3.4.16 is the release included in the OpenBSD >2.8 distribution (3.3.18), which is also vulnerable. > > >Details >------- > >When IP Filter evaluates the rule-base for an IP fragment and decides >whether to pass it or block it, this decision is saved in a "decision >cache" together with the fragment's IP ID, protocol number, source >address and destination address fields. > >Before any received fragment is passed through the rule-base, the >decision cache is searched for a matching entry, i.e. an entry in >which the IP ID, protocol number, source address, and destination >address fields match the corresponding fields of the fragment. > >If a matching entry is found, the cached decision is applied to the >received fragment. Otherwise the fragment is passed through the >rule-base. > >In this way the same decision is applied to all fragments belonging to >the same original unfragmented packet. > >The cache entry is discarded after a timeout period. But an >optimization is implemented for the common case of receiving all >fragments in order, i.e. from the leading offset-0 fragment to the >last fragment with a cleared IP_MF bit. If all fragments are received >in order, the cache entry is discarded after IP Filter has seen the >last fragment. > >Let us assume that we can only access port 80/TCP on a host behind an >IP Filter firewall and all other ports are blocked. However, we know >that the host also runs an FTP server that we could compromise because >we have spotted a giraffe in its code. We would therefore like to gain >access to port 21/TCP. Hence, we patch Dug Song's fragrouter 1.6 and >start doing a bit of packet mangling. > >For each TCP packet A that we send to port 21 and that we would like >to sneak through the firewall, we create a TCP packet B by making a >copy of A - i.e. we copy A's IP header, TCP header, and TCP payload - >and changing the destination port in B's TCP header to 80. If sent, >packet B would be passed by the firewall (in contrast to packet A), >because traffic to port 80/TCP is allowed by the rule-base. > >We then split B into three fragments B1, B2, and B3, keeping B's >original IP header and only adjusting the offset and length fields. In >the canonical case, these fragments would be sent in order, IP Filter >would see B1, go through the rule-base, find the rule that allows >traffic to port 80/TCP, pass B1 because it is an offset-0 fragment and >the contained TCP header fields match this rule, cache the "pass" >decision, receive B2, apply the cached decision to B2, receive B3, >apply the cached decision to B3, and discard the cache entry after >having processed B3. > >Now there is a way to make IP Filter not only pass B1, B2, and B3 - >i.e. apply the decision cached for B1 to B2 and B3 - but also apply >the cached "pass" decision to A. Which is convenient for our purpose >of obtaining access to port 21/TCP. > >Note that the created fragments B1, B2, and B3 contain the same >fragment ID, protocol number, source address and destination address >as A. Remember that B's IP header is an exact copy of A's IP header >and that the fragments' IP headers differ from B's IP header only in >their length and offset fields. > >We fragment B in the following way. If B's TCP payload is less than 13 >bytes, we pad it with null bytes. > >Fragment Offset Length IP_MF Payload >------------------------------------------------------------------------ >B1 0 24 1 B's TCP header, i.e. A's TCP > header + destination port = 80 > bytes 0 to 3 of B's TCP payload > >B2 24 8 1 bytes 4 to 11 of B's TCP payload > >B3 32 depends 0 rest of B's TCP payload > on B (at least one byte) > >First we send B1. IP Filter will consider the rule-base, pass the >fragment, and cache this "pass" decision. > >We then send B3 and B2 out of order, i.e. we send B3 before B2. The >cache entry created for B1 matches each fragment and the cached "pass" >decision is looked up and used in both cases. However, the >optimization for in-order fragments mentioned above does not apply and >the cached "pass" decision is still kept for a while. In the meantime >the destination host reassembles B1, B2, and B3. > >We now send packet A. Since A has the same IP ID, source address, >destination address, and protocol number as the fragments, the cache >entry created for B1 also matches A and the cached "pass" decision is >applied to A as well. Thus, IP Filter passes A, although it is >directed to port 21/TCP and should have been blocked according to the >rule-base. > >Looking at the IP Filter source code, we see that A does not need to >be fragmented to make IP Filter search its decision cache for a match, >which saves us some work in exploiting this vulnerability. > >The attack as described up to here can be prevented by adding a >filtering rule along the lines of > > block in quick all with frag > >which blocks all fragmented IP traffic. However, before considering >the rule-base, IP Filter searches its state-table for a connection >entry matching the received packet. On a match, IP Filter passes the >packet without touching the rule-base. > >Therefore, we just send B before sending B1, B2, and B3. Receiving B, >IP Filter creates an entry in the state-table representing a >connection from our computer to the open port on the host that we are >attacking, i.e. port 80 to cling to our example. > >Since B1 contains a full TCP header and we address B1 to the same port >as B, B1 is also passed because a matching connection entry in the >state-table has already been created by the non-fragmented packet >B. The rule-base is ignored as is the "block with frag" rule. > >Passing B1, however, leads to this "pass" decision being cached, >because B1 is a fragment. This in turn allows us to pass B3, B2, and A >through the filter. > >As can be seen the attack still applies even if all fragments are >blocked by a filtering rule. > >If we did not care about the fragments awaiting reassembly in the >victim host, we could skip the steps of sending B2 and B3 and just >send B1. The effect of IP Filter passing traffic to blocked ports >would be identical. > >Thanks to John McDonald of NAI's COVERT Labs for pointing out the full >implications of the vulnerability to me. > > >Fix information >--------------- > >I sent an early version of this advisory to Darren and he created an >updated release of the IP Filter package, which is available from the >IP Filter homepage at http://coombs.anu.edu.au/~avalon. > >Users of ThomasBSD 1.0 might want to upgrade their installation to >ThomasBSD 1.1 by applying the following patch.
The following rule-sets are provided as a simple example to minimize
exposure on an IRIX host with one network interface.
#
# Accept packets with a loopback source address only if they
# come over the loopback interface.
accept -i localhost src=127.0.0.1
reject src=127.0.0.1
#
# Accept all packets originating from this trusted network.
accept (src&0xFFFFFF00)=123.45.67.0
#
# Reject spoofed packets from private address space which
# should not be used on the Internet according to RFC 1918.
reject (src&0xFF000000)=10.0.0.0
reject (src&0xFFFF0000)=192.168.0.0
reject (src&0xFFF00000)=172.16.0.0
#
#
# Allow RIP broadcasts if running gated/routed.
accept udp.dport=520
#
# Allow DNS replies from the name servers
# This is required for host name resolution to work.
accept udp.sport=53 and ip.src=192.26.210.1
accept udp.sport=53 and ip.src=205.151.69.200
#
# Explicitly reject all UDP packets not accepted above
reject udp
#
#
#
#
# Allow only connections to httpd, sshd and telnetd.
# Other services defined in /etc/services or by using
# their respective port numbers can be added here.
accept tcp.dport=telnet
accept tcp.dport=22
accept tcp.dport=http
#
# Allow all TCP packets related to outgoing connections.
# The most efficient way of accomplishing this is to
# accept all TCP packets which don't have the SYN flag set.
accept tcp and not(tcp.flags=SYN)
#
# Explicitly reject all tcp packets not accepted above
reject tcp
#
#
# Deny ICMP time-stamps requests in order to prevent
# remote hosts from querying the local time.
# Do not use if your host is a time server.
reject icmp.type=TSTAMP
#
# Accept all other types of ICMP packets.
accept icmp
#
# Explicitly Deny everything else (default behavior).
reject (src&0)=0
From: l.cranswick@dl.ac.uk (Lachlan Cranswick) Newsgroups: comp.sys.sgi.admin Subject: Re: How Secure is IRIX O2 6.5.3 Mountd??? Date: Sat, 22 May 1999 20:11:21 LOCAL Organization: Daresbury Laboratory, UK "Molte excellanto!" (as they say in the Latin) Using the pmap_dump approach works well and the portmapper is now refusing to consider requests from non-authorised machines (probing if files exist, etc). (though authorized machines can still probe around for files using the mount command) pmap_dump within ftp://ftp.porcupine.org/pub/security/portmap_4.tar.gz To see rejected requests in the SYSLOG file, I put the -v (verbose) option in the /etc/config/portmap.options -------- > pmap_dump > stuff > /sbin/killall portmap > /usr/etc/portmap `cat /etc/config/portmap.options` > pmap_set < stuff Lachlan. ======== [following post Re: does portmap read the config file on startup] (Please forgive laziness on my part: Script to load portmap in /etc/init.d/network - and loads the /etc/config/portmap.options explicitely Lachlan. In article <7i6jnu$97o$1@niri.ncsa.uiuc.edu> slevy@ncsa.uiuc.edu (Stuart Levy) writes: >In article, >Lachlan Cranswick wrote: > [...] >>Another one from the ministry of silly questions - the man page for portmap >>mentions it reads the /etc/config/portmap.option during system >>initialisation. By what command can you get it to reread it again >>without all the servers it is using having to be restarted as well? >Well -- you *could* pick up & compile Wietse Venema's "portmap" replacement. >Needn't install his portmap variant, but the package includes programs >pmap_dump and pmap_set for saving and re-loading the list of registered >services. So you'd say > pmap_dump > stuff > /sbin/killall portmap > /usr/etc/portmap `cat /etc/config/portmap.options` > pmap_set < stuff >and get all the service registrations back without having to reboot. >(Disclaimer: I haven't actually tried this with SGI's portmap, only with >Venema's on Irix 6.3 and earlier, a while back. But it should work on >any portmap, I think.) > Stuart Levy, slevy@ncsa.uiuc.edu
rpcinfo -p machinename.domain rpcinfo: can't contact portmapper: rpcinfo: RPC: Authentication error; why = Failed (unspecified error)
On Wed, 18 Aug 1999 11:14:16 +0200, tetu wrote: >Got an O2 with IRIX 6.3. >ec0 was 10 Mb/s half-duplex. > >I find in PROM Monitor how to have 100 Mb/s (setenv ec0mode 100), but >not full-duplex. > >How to have full-duplex? In prom monitor, "setenv -p ec0mode F100", then reboot.
ifconfig ec0 debug Unplug/replug network cable, and check console and SYSLOG. ifconfig ec0 -debug Alexis Cousein al@brussels.sgi.com Systems Engineer SGI Belgium
From: roberson@ibd.nrc.ca (Walter Roberson) Newsgroups: comp.sys.sgi.admin Subject: Re: domain name Date: 4 Oct 2000 23:03:41 GMT Organization: National Research Council Canada In article [E0OC5.49$iY1.1437@sodalite.nbnet.nb.ca], Bailey Campbell [bcampbell@imagictv.com] wrote: :I have 6.5.7 installed on a SGI Origin 200 machine. How do I set the domain :name? I recommend doing all of the following: 1) Use a fully-qualified host name in /etc/sys_id to start with. Some people disagree with me on this point, but I have seen too much software that -just- looks at the output of 'hostname' (which gets the information from /etc/sys_id) and then fails to work properly. 2) On the /etc/hosts line that matches the IP address for the host, make sure that the fully-qualified version of the hostname is the *first* hostname on the line. If you have other aliases for the host, put them later on the same line. This is more important than the sys_id ! Note that whatever you have in your /etc/sys_id, your /etc/hosts line should have at least one name that is *exactly* the same. For example, if your /etc/sys_id contains sodalite and your /etc/hosts line says 123.45.54.21 sodalite.nbnet.nb.ca then the system will NOT know that the two names are the same: you would need 123.45.54.21 sodalite.nbnet.nb.ca sodalite to clue it in. 3) Add a 'domain' statement in /etc/resolv.conf that gives the domain name.
Your system doesn't have a reasonable amount of memory for starters. I'd
at least double it. To see what system resources you are using, I suggest
creating a file ~/.grosview with the following in it:
cpu strip
rmem strip
wait strip
pswap strip
gfx strip
Then execute `gr_osview'. Also use the command `swap -l' to see how much
swap you are using.
--
Brent L. Bates (UNIX Sys. Admin.) Phone:(757) 864-2854
M.S. 912 Phone:(757) 865-1400, x204
NASA Langley Research Center FAX:(757) 865-8177
Hampton, Virginia 23681-0001
Email: B.L.BATES@larc.nasa.gov http://www.vigyan.com/~blbates/
you can decyper which bus and id your device is on as follows: sys-sgi 106% hinv
S/KEY and OPIE. S/Key -- This one-time password system from Bellcore provides authentication over insecure networks. It’s designed to defeat eavesdroppers "listening" for login name and password transmittals. The user's secret password never crosses the network during login or when executing other commands requiring authentication such as the UNIX passwd or su commands. No secret information is stored anywhere, including the host being protected, and the underlying algorithm is public knowledge. The remote end of this system can run on any locally available computer, including PC’s and Mac’s. RFC 1938 is based on Bellcore's S/KEY implementation. Note that OPIE is a replacement for S/Key with additional security enhancements. For more information: ftp://thumper.bellcore.com/pub/nmh/docs/skey.txt To download: ftp://thumper.bellcore.com/pub/nmh/ OPIE (One Time Passwords in Everything), an S/Key derivative (the name was changed to avoid trademark infringement) developed by the US Naval Research Laboratory (NRL) and other institutions over the past few years. Per the README file included with the distribution: "OPIE is derived in part from the BSD Unix software developed at UC Berkeley, in part from the S/Key (TM) software developed at Bell Communications Research (Bellcore), and also includes enhancements developed at NRL." OPIE implements the IETF One-Time Passwords (OTP) standard as per RFC 1938.
Windows NT crashed. I am the Blue Screen of Death No one hears your screams.
[common] This term is closely related to the older Black Screen of Death but much more common (many non-hackers have picked it up). Due to the extreme fragility and bugginess of Microsoft Windows, misbehaving applications can readily crash the OS (and the OS sometimes crashes itself spontaneously). The Blue Screen of Death, sometimes decorated with hex error codes, is what you get when this happens. (Commonly abbreviated BSOD.)
Level 1 ISO-9660 defines names to be the familiar 8+3 convention that
MS-DOS users have suffered through for many years: eight characters for the
name, a period ("full stop" for those of you in the U.K.), followed by
three characters for the file type, all in upper case. The only allowed
characters are A-Z, 0-9, '.', and '_'. There's also a file version number,
separated from the name by a semicolon, but it's usually ignored.
24. Can you give a short explaination of ISO-9660?
ISO-9660 is an international standard that defines a filesystem for
CD-ROMs. Almost all systems support ISO-9660.
Level one ISO-9660 is similar to an MS-DOS filesystem. Filenames are
limited to eight single-case characters, a dot, and a three character
extension. Filenames cannot contain special characters, (no hyphens,
tildes, equals, or pluses). Only single case letters, numbers, and
underscores. Directory names cannot have the three digit extension,
just eight single-case characters.
All alphabetics are in UPPER case; some software maps this to lower case.
Either the file name or the extension may be empty, but not both ("F."
and ".E" are both legal file names).
There is a "File Version Number" which can range from 1-32767, and is
separated from the extension by a semi-colon. The file version number
is ignored on many systems.
Here are some examples of legal and illegal filenames:
Legal Illegal Why
TEST_1C.TXT TEST-1C.TXT hyphen
TEST1C.TXT TEST 1C.TXT space
TEST.1C TEST.1C.TXT more than 1 period
README Readme not single case
Subdirectories are allowed to nest up to eight levels deep.
Level two ISO-9660 allows longer filenames, up to 32 characters.
But many of the other restrictions still apply. Level two discs
are not usable on some systems, particularly MS-DOS.
A: Well, assuming you have enough Video memory for your current resolution to support more than 8bpp (256 colors), you can start x with the command 'startx -- -bpp 16' (if you use xinit instead of startx, you do dito for xinit) . Of course, replace 16 with whatever screen depth you want. It might be wise to make an alias for this command, if you're normally gonna start in more than depth 8. Alternatively, if you're the only user on the system, change in your /etc/X11/xinit/xserverrc (path may vary depending on what distribution you're running), or create it if it doesn't exist, and add the line 'exec X -bpp 16'. This makes 16 the 'default' color depth when starting X.
Q: I'm tired of logging in in text mode, since I always start x the first thing I do anyway. What should I do?
A: Well, you can set it up so that X starts before you login. this is done by changing the default runlevel in your /etc/inittab file. Exactly what to set the runlevel to varies between distributions. On my machine I changed from runlevel 3 to 5 (Red Hat 3.0.3), but I've seen other ones where they change from 4 to 3 (some Slackware distributions). This will start a program called xdm, which handles the logon, amongst other things.
Q: Ok, now I have the xdm login and everything, but now I'm back with the color problem. How do I get xdm to start in another color depth?
A: Locate your xdm directory (on my machine it's /etc/X11/xdm/), and change in the file called Xservers. In one line you'll find the command that executes X. It should look something like ':0 local /usr/X11R6/bin/X'. Give that command the flag '-bpp 16'.
Date: Tue, 23 May 2000 10:48:55 +0100 (BST) From: "Scott" To: "L. Cranswick"Subject: Re: What does it mean when a Fortran program does this? On Mon, 22 May 2000, L. Cranswick wrote: > > Hi Scott, > > have been increasing the arrays of a fortran > program to get it to handle a larger problem on > a Digital Alpha machine - but it gives an error like: > > 22879:maps: /sbin/loader: Fatal Error: cannot map Main > pxsv6% ./maps > 18152:./maps: /sbin/loader: Fatal Error: cannot map Main > > > What does this means - arrays going over each-other or > something like this? > I've not come across this exact problem before, and I would need to see the code and the actual compilation instructions, but judging by what you are doing to the code, it sounds like the arrays you are defining are to big to be allocated on the stack. You can do two things to get round this: 1) The stack usage is normally limited by the shell. Type ulimit -a to see the restrictions. If you are running csh/tcsh then there is not much you can do about is because for some reason it does not let you increase the limit. You could try running bash, it lets you change the limits. Change the stack limit using ulimit -s #, where # is the number of 512-byte blocks to set the limit to, or ulimit -s unlimited to grab as much as you're allowed. If this does not work then go to 2. 2) Dynamically allocate the memory at run time. This actually is always the best thing to do when data arrays start to become very big and has the advantage that you don't need to know the size of the array before you run the program. There is no standard way to dynamically allocate objects in f77. You will have to use the libc malloc() function. You can do dynamic allocation in Fortran 90. I'm not very hot in Fortran 90 (I'm a C man myself) but something like this should work: PROGRAM alloc_example C Allocate a 1-d real array with N elements INTEGER N, ALLOC_ERR REAL, ALLOCATABLE :: DATA(:) C You would calculate N at run time or see it to the valus you want. N = 10 C ALLOC_ERR is set to a positive integer (i.e. not zero) if an error C occur with the allocation, such as out-of-memory. ALLOCATE (DATA(N), STAT = ALLOC_ERR) IF (ALLOC_ERR.NE.0) THEN WRITE(*,*) 'ERROR: Could not alloc memory' STOP END IF C Zero array, or do what ever you want to do with it. DO I = 1,N DATA(I) = 0.0 END DO C Once you finished, deallocate the memory. DEALLOCATE(DATA) END Digital Alpha has a Fortran 90 compiler (f90) but it might be a nightmare trying to compile old f77 code with it. There is another possiblity that the linker, for some reason, cannot find the main block. This is entirely due to the compilation. But seeing that it has compiled and worked before (I assume) then this is unlikely to be the problem. I hope this helps. I can help you with incorporating malloc into the code but linking with c routines is quite non-portable so once you have changed the code to work with Alpha compilers you may ahve to customise for any other machine that you want to compile on. Scott.
This particular heresy bids fair to be replaced by ``All the world's a Sun'' or ``All the world's a 386'' (this latter being a particularly revolting invention of Satan), but the words apply to all such without limitation. Beware, in particular, of the subtle and terrible ``All the world's a 32-bit machine'', which is almost true today but shall cease to be so before thy resume grows too much longer.
If you are using a Unix workstation or a Mac, then you will need to strip off either the <CR> or the <LF> to convert them to standard Unix" or Mac ASCII files.
WarnLaunchExtensions=exe|com|bat|cmd|pif|htm|do|xl|reg|lnk|
to their "[Settings]" section. (The default is to warn for all of these extensions except the "lnk" one.) Note the trailing "|" on the end -- this is necessary in order for Eudora to warn for "lnk" files, but the extra "|" can be confusing to users who intuitively understand "|" to mean "or" -- in which case it looks like the trailing "|" should not be necessary, but it's required by the Eudora parser. "
"Or you can get the GNU tar program (1.12) and just use it like:
tar --rsh-command=/usr/sbin/ssh --tape-length=(length of tape in bytes) \
-cvpMf host:/dev/st0 /"
"Tar throughput over a network can be greatly increased using: ftp://src.doc.ic.ac.uk/packages/buffer/ I use a buffer at end of the network socket: tar ... | buffer | ssh host buffer -oAlso, use a fastest encryption method, which in 1.2.26 is blowfish, for backups."
To: freebsd-users@uk.freebsd.org
From: Lachlan Cranswick (lachlan@ldeo.columbia.edu)
Subject: Re: C tutorials
Date: Wed, 11 Apr 2001 17:44:01 -0700
>On Wed, Apr 11, 2001 at 09:07:43PM +0100, Ben Paley wrote:
>> On Tue, 10 Apr 2001, you wrote:
>> <snip>
>> > Once you're comfortable with the basics of C, I recommend ploughing
>> > through the comp.lang.c FAQ sometime. It's a mine of information that
>> > other people have found out about the hard way.
>> <snip>
>>
>> Thanks a lot, I'll check that stuff out. I managed to find a reasonable gtk+
>> tutorial (which assumes a little more c knowledge than I have) at
>> http://www.gtk.org/tutorial (the obvious place!), now if only I can get
>> gcc to find the gtk libraries...
>
>One hint, which I would have much appreciated when I was starting out is
>that the libraries go at the end of the command line. F'rinstance:
>
>% gcc -o gtkprog gtkprog.o -L/usr/X11R6/lib -lgtk
>
>The -L flag says where to look for libraries, the -l says which
>libraries to link in. The -L can go anywhere on the command line, but
>the -l *must* come after everything else. And if you have multiple
>libraries to link in, they frequently have to be given in the right
>order as well. Beware.
Not being a programmer person I am not sure of the why and wherefores but
the -I option may have to be explicitely mentioned (this can be something
to find out due to random mucking about) On SGI IRIX both the relevant
directory areas for -I and -L are found by default:
e.g.,
on SGI IRIX:
f77 -o platon platon.f xdrvr.c -lX11
On Redhat Linux with g77 installed:
f77 -o platon platon.f xdrvr.c -L /usr/X11R6/lib -lX11
On FreeBSD with EGCS gcc installed:
g77 -o platon platon.f xdrvr.c -I/usr/X11R6/include -L /usr/X11R6/lib -lX11
On FreeBSD with default f2c based f77
f77 -NL400 -Nn802 -Nx800 -o platon platon.f xdrvr.c -I/usr/X11R6/include -L /usr/X11R6/lib -lX11
Lachlan.
-----------------------
Lachlan M. D. Cranswick
Geochemistry - Lamont-Doherty Earth Observatory, Columbia University
PO Box 1000, 61 Route 9W Palisades, New York 10964-1000 USA
Tel: (845) 365-8662 Fax: (845) 365-8155
E-mail: lachlan@ldeo.columbia.edu WWW: http://www.ldeo.columbia.edu
CCP14 Xtal Software Website: http://www.ccp14.ac.uk
> e.g., > > on SGI IRIX: > f77 -o platon platon.f xdrvr.c -lX11 > > On Redhat Linux with g77 installed: > f77 -o platon platon.f xdrvr.c -L /usr/X11R6/lib -lX11 > > On FreeBSD with EGCS gcc installed: > > g77 -o platon platon.f xdrvr.c -I/usr/X11R6/include -L /usr/X11R6/lib -lX11 > > On FreeBSD with default f2c based f77 > f77 -NL400 -Nn802 -Nx800 -o platon platon.f xdrvr.c -I/usr/X11R6/include > -L /usr/X11R6/lib -lX11 The -I flag will have to be explicitly mentioned if the header file you are trying to include is not in /usr/include. There are normally two steps to compiling a program, .c -> .o and .o -> exe. I only showed the first one before. Together they would look like: % cc -o gtkprog.o -I/usr/X11R6/include gtkprog.c % cc -o gtkprog -L/usr/X11R6/lib gtkprog.o -lgtk12 -lX11 (I think I forgot -lX11 last time). -- M-x smite-the-infidel
A very good but quite mathematical book on modern optimisation methods (including Levenburg-Marquardt, constrained optimisation): Fletcher, R., Practical Methods of Optimization, Second Edition (2000), Wiley-Interscience, John Wiley & Sons. ISBN 0 471 49463 1. A good, comprehensive book on Win32 (the Windows C API for programming Windows 95/98/NT4/2000/etc applications): Rector, Brent E. & Newcomer, Joseph M., Win32 Programming (1997), Addison-Wesley Developers Press. ISBN 0 201 63492 9. *The* best MFC book there is: Prosise, Jeff, Programming Windows with MFC, Second Edition (1999), Microsoft Press. ISBN 1 57231 695 0. Another good MFC book in the form of an FAQ: Kain, Eugene, The MFC Answer Book (1998), Addison-Wesley, ISBN 0 201 18537 7.
mke2fs -b 2048 /dev/hdd
mount /dev/hdd /storage/dvd
mondoarchive -L -s 2220m -E /web_disc -Oi -d /storage/dvd
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -g -Oi -d /storage/dvd
mondoarchive -L -E /web_disc -Oi -d /storage/dvd -g -B "mount /storage/dvd" -A "umount /storage/dvd" -s 2220m
mondoarchive -L -g -E "/web_disc /web_logs" -Oi -d /web_disc/ccp14/temp
mondoarchive -L -E "/web_disc /web_logs" -S /web_disc/ccp14/temp -Oi -d /web_disc/ccp14/temp
mondoarchive -Oi -d /mnt/zip -g -B "mount /mnt/zip" -A "umount /mnt/zip" -s 100m
Among the products that support this rapid deployment method are Symantec's Norton Ghost, Altiris' RapiDeploy and Micro House International's ImageCast.
Deploying Windows NT Workstation 4.0 with this method can take minutes per PC - much faster than typical operating system upgrades, which take several hours to install. Using the system preparation tool can translate into substantial cost savings for customers.
The Microsoft system preparation tool for Windows NT Workstation 4.0 is available free of charge to Microsoft customers that have a current Microsoft Select or Enterprise Agreement."
"but I think that today there are better softwares than these.
What you need is a AUTORUN.INI file on the root of your CD Rom and
in this file you write
[AutoRun]
OPEN=Autorun\Autorun.exe -> This is the directory whose software is to be
loaded
ICON=Autorun\Autorun.exe
shell\update=&Update Comctl
shell\update\command=Autorun\401Comupd.exe
Lachlan Cranswick wrote: > A silly question if someone has the time. How do you kill > the Sendmail deamon but still allow E-mail to be sent from > the machine. E.g., using the /usr/sbin/Mail program. /etc/init.d/mail stop (indeed, killall sendmail will do in most circumstances). And of course "chkconfig sendmail off", so that it does not get started as a daemon on next reboot. > Does sendmail have to be invoked in some manner when > Email goes out? Unless the mailer has MTA functionality built-in (mail and Mail haven't), yes. However they do not bind to the sendmail daemon anyway, but start their own sendmail process. sendmail is a multi-purpose program: MUA, incoming and outgoing MTA. It only needs to be run as a daemon if you use it as a incoming MTA, or (to some extent) if you want to queue outgoing mail. Programs invoking sendmail as a MUA (like CGI scripts) or outgoing MTA (like common mailers) will do so independent of the daemon, so you can shut it down without any consequences as long as you do not want to receive SMTP mail on that machine. Sevo -- Sevo Stille
Without the sendmail daemon running, you can send to a non-local address, send to a local address and receive from a local address. The only thing you get from running the sendmail daemon is the ability to receive from a non-local sender.
From: rbogue@entropy.phy.ilstu.edu (Ross Bogue) Newsgroups: comp.sys.sgi.admin Subject: Re: disabling sendmail Date: Tue, 04 Apr 2000 08:31:01 -0500 Organization: Illinois State University > I would appreciate if somehow give me some instructions on how to >disable sendmail. > A first approximation might be cat > /etc/config/sendmail off ^D You could follow up with mv /usr/lib/sendmail /usr/lib/sendmail.OFF mv /usr/bsd/mailq /usr/bsd/mailq.OFF mv /usr/bsd/newaliases /usr/bsd/newaliases.OFF chmod -x /usr/lib/sendmail.OFF /usr/bsd/mailq.OFF /usr/bsd/newaliases.OFF and then ln -s /usr/local/postfix/bin/sendmail /usr/lib/sendmail ln -s /usr/local/postfix/bin/sendmail /usr/bsd/mailq ln -s /usr/local/postfix/bin/sendmail /usr/bsd/newaliases :-)
From: Atro Tossavainen [Atro.Tossavainen@iki.fi.invalid] Newsgroups: comp.sys.sgi.admin Subject: Re: disabling sendmail Date: 04 Apr 2000 16:20:34 +0300 Organization: U of Hell-Sin-City, Office of the BOFH chmmai@leonis.nus.edu.sg (Ma Ngai Ling Ida) writes: > I would appreciate if somehow give me some instructions on how to > disable sendmail. IRIX v?.?? This is for 6.5 chkconfig sendmail off killall sendmail A more elegant solution that does not break mail delivery out of the computer, yet stops you from being a Spamhaus is to take a look at the init scripts that start sendmail and make sure that the option "-bd" isn't used when sendmail is started. Randolph will probably correct me on this, but as far as I could see, entering something into /etc/config/sendmail.options causes the defaults to be ignored - so you could put "-q30m" in this file and be happy. And restart sendmail of course...
From: Jefferson Ogata [ogata@pobox-u-spam-u-die.com] Newsgroups: comp.sys.sgi.admin Subject: Re: disabling sendmail Date: Tue, 04 Apr 2000 12:58:43 -0400 Organization: The Antibozo Alexis Cousein wrote: > Atro Tossavainen wrote: > > chmmai@leonis.nus.edu.sg (Ma Ngai Ling Ida) writes: > > > > > I would appreciate if somehow give me some instructions on how to > > > disable sendmail. > > > > IRIX v?.?? This is for 6.5 > > > > chkconfig sendmail off > > killall sendmail > > > > A more elegant solution that does not break mail delivery out of the > > computer, > > It doesn't. Most mailer clients now can do SMTP to something else than > localhost, and mailers like "mail" spawn their own copy of sendmail to > send mail. Nonetheless, mail from cron jobs will still be queued via sendmail. If initial delivery fails, you need to rerun the queue. The simplest way to do this is to change the startup options as Atro suggests. If you take out -bd, sendmail won't bind and listen on the SMTP port, and -q15m will have it run the queue every 15 minutes. Other systems you install may expect to be able to deliver mail via sendmail as well. You need to run the queue periodically, one way or another. > Can't *receive* mails to local mailboxes without sendmail on, though. > > -- > [standard disclaimer: these are my personal views, not SGI's] > Alexis Cousein al@brussels.sgi.com > Systems Engineer SGI Belgium -- Jefferson Ogata : Internetworker, Antibozo smtp: [ogata@pobox-u-spam-u-die.com] http://www.antibozo.net/ogata/ ICQ: 19569681
>I think you and your customers will be interested in learning >more about the most powerful FTP client available for Windows 9x/NT, >the award winning FTP Voyager. This FTP client has an intuitive >drag-and-drop interface. FTP Voyager lets you update a Web site with >a single click, transfer files directly between FTP servers, and >resume interrupted downloads. > >FTP Voyager is a perfect tool for Web developers or anyone that moves >files on the Internet. FTP Voyager is available for evaluation and >can be downloaded for free from RhinoSoft.com. Current language >versions include English, Spanish, French, German, Italian, Finnish >and Japanese. > >The interface of FTP Voyager has the simplicity to allow beginners to >use it with ease while including advanced features for the experienced >FTP user. We are confident that you and your customers will find this >rare combination of simplicity for novice users and advanced features >for the experts a combination that no other FTP client on the market >can compare to.
From: "Andrew" grof@home.com Newsgroups: comp.infosystems.www.servers.unix,comp.infosystems.www.servers.misc Subject: Re: Log file rotation - what a nightmare with Apache :-( Date: Thu, 06 May 1999 12:35:23 GMT Try this, it works: mv /path/to/old/log/file /path/to/new/log/file touch /path/to/new/log/file kill -HUP [pid of apache] the last line can be done using the file that contains the pid of apache... eg. kill -HUP `cat /path/to/httpd.pid` or if you wanted, you could grep through your ps aux (althogh the previous is better) kill -HUP `ps aux | grep httpd | tail -1` Oh the power! :) You can get past without HUP'ing Apache... It is needed. It shouldn't hurt you. If you have problems restarting than it is likely your .conf files are screwed and you would have had problems down the line anyways. Fix 'em now while you can. Good luck with it! Andrew
#! /usr/local/bin/bash HTTPD_LOGS_DIR=/opt/httpd/logs # path to httpd log dir HTTPD_PID=/opt/httpd/logs/httpd.pid # path to httpd pid YYMMDD=`/usr/bin/date +%Y%m%d` cd $HTTPD_LOGS_DIR mv -f access_log access_log.$YYMMDD mv -f error_log error_log.$YYMMDD kill -USR1 `cat $HTTPD_PID` sleep 15 gzip -9f access_log.$YYMMDD error_log.$YYMMDD
Hi Lachlan, I now have a foolproof (?) way to prevent caching. Adding a random parameter to the URL will always fetch it again eg http..../icsd/tmp/myFile.wrl?$RANDOM is the same as: http..../icsd/tmp/myFile.wrl - except the former is not cached if $RANDOM is a random string eg a number generated by perl: srand(); $RANDOM=substr(rand(99),0,2); #2 digit random no. Alan Hewat, ILL Grenoble, FRANCEtel (33) 4.76.20.72.13 ftp://ftp.ill.fr/pub/dif fax (33) 4.76.20.76.48 http://www.ill.fr/dif/
From: "Joshua Slive" <slive+news@finance.commerce.ubc.ca> Newsgroups: comp.infosystems.www.servers.unix Subject: Re: Apache Redirect/ReWrite for redirecting old->new domains? Date: 7 Jul 1999 17:21:47 GMT Organization: The University of British Columbia Frampton Steve R <3srf@qlink.queensu.ca> wrote: > Hello: > I'm having some difficulty getting Apache to redirect page requests with > an informative message. My place of employment is moving from their old > domain name to a new one. We now have both of these domain names active, > both of which point to the same server. Although we will be phasing out > the old address very soon, people continue accessing the pages at the old > address, hence the reason for the redirect. > Putting something like <META HTTP-EQUIV="refresh" > "CONTENT=05;URL=http://newdomain.com/newpage"> in all our pages is not > an optimal solution because (a) there are hundreds of pages that would > need to be updated, (b) this solution doesn't display an informative > message before the redirect, and (c) Apache provides a better solution. I think that your syntax is a little off. Check the Apache docs for the relevant directives. What I would do is something like RewriteEngine On RewriteRule ^/~test/(.*) /redirector.shtml/$1 Then configure /redirector.shtml as an SSI parsed document looking something like <HTML> <HEAD><TITLE>This page has moved</TITLE> <META HTTP-EQUIV="refresh" CONTENT="05;URL=http://newdomain.com/~test/<!--#echo var="PATH_INFO" -->"> <BODY> <H1>This page has moved</H1> <P>The new location is <A HREF="http://newdomain.com/~test/<!--#echo var="PATH_INFO" -->">here</A>. You will be redirected automatically in 5 seconds. Please update your bookmarks. </BODY> </HTML> This is completely untested, and probably has errors, but it should get you started. You could also use a cgi script instead of the SSI
mark@knm.org wrote: > I have several virtual hosts which I would like to share the same > directory, but instead of pointing to index.html I would like to have > different index pages for each. > What you want is this <VirtualHost www.ford.com> ... DocumentRoot /usr/local/webpages DirectoryIndex ford_index.html </VirtualHost> <VirtualHost www.chevy.com> ... DocumentRoot /usr/local/webpages DirectoryIndex chevy_index.html </VirtualHost> Note this chenges the index.html default to the supplied one in all the subdirectories in your document tree as well, but only for the virtual host in question. The Pilgrim
The easiest way to do a redirect is to use cgi.pm (http://stein.cshl.org/WWW/software/CGI/cgi_docs.html) To send back a redirect with a status 302 (moved temporarily) cgi.pm 's redirect function is all that is needed: print redirect($location); # location is the new url The redirect function can use the same parameters as cgi.pm's header function, but sometimes I like everything to be explicit, like when I send a status 301 (moved permanently). For these, I also like to send an expiration time for my reverse proxy cache... print header(-Status=>$redirect_status, -Location=>$location, -Type=>'', -Expires=>$expiration_time); in this case, $redirect_status would be something like '301 Moved Permanently', $location 'http://www.latimes.com/somewherelse' (or just '/somewherelse') ,and $expiration_time '+2h'. If you don't want to use cgi.pm, you can do everything with print statements: $|=1; print "Content: text/html\n"; print "Status: 301 Moved Permanently\n"; print "Location: http://sports.latimes.com/lat/ADANDE/\n"; print "\n";
> I'm trying to use mod_rewrite to rewrite www.domain.con to > www.otherdomain.com. Both of this domain are VirtualHost. The goal is to > put the new name in the Location field of the browser. > > Can anyoune help me? <VirtualHost> ServerName www.domain.com Redirect permanent / http://www.otherdomain.com </VirtualHost> And try to avoid mod_rewrite if possible :). It is fun but has smell of black magic. Mindaugas Riauba http://www.hostex.net
What you are trying to do is called "user authentication". The best place
to learn about user authentication is from the source (NCSA). They have a very easy to
understand tutorial at the following URL:
http://hoohoo.ncsa.uiuc.edu/docs/tutorials/user.html
Sample .htaccess:
AuthUserFile /the-path/.htpasswd
AuthGroupFile /dev/null
AuthName "Bill's Restaurant"
AuthType Basic
<Limit GET>
require user William
</Limit>
To set up the password for "William" issue the following command:
% /usr/local/bin/htpasswd -c /home/directory/[login]/.htpasswd William
Use the htpasswd command without the -c flag to add additional users; e.g.:
% /usr/local/bin/htpasswd /home/directory/[login]/.htpasswd peanuts
% /usr/local/bin/htpasswd /home/directory/[login]/.htpasswd almonds
% /usr/local/bin/htpasswd /home/directory/[login]/.htpasswd walnuts
From: phr@netcom.com (Paul Rubin)
Newsgroups: comp.infosystems.www.servers.unix,comp.infosystems.www.servers.misc
Subject: Re: PROXY-ABUSE PROXY ABUSE (Apache/Linux) - HELP and INFO wanted
Subject: Re: PROXY ABUSE (Apache/Linux) - HELP and INFO wanted
Date: 10 Jun 2000 20:06:05 GMT
Organization: NETCOM / MindSpring Enterprises, Inc.
Lines: 53
X-Newsreader: trn 4.0-test72-NUGLOPS (19 April 1999)
In article <39429960.5C67DCBD@uc.net>, Marc Moeller <mm@uc.net> wrote:
>hi,
>
>> > I started rejecting IP-addresses, but my real question is:
>> > WHERE/WHY DO THESE REQUEST COME FROM ?
>> > any clues/help appreciated.
>>
>> Turn off your proxy for outside addresses. Someone is using your machine
>> to relay click-thru's and is probably being paid for each hit.
>
>I refuse all proxy-access to any IP, but WHY does this happen ?
>From where do 'they' get my IP-addresses ? Or does this happen to all
>(many) other webservers, too ?
>Beside the traffic (which doesn't have any affect on my machine(s),
>there
>is also CPU-waste in sending 403-replies.
>:-(
>
>do YOU know about such abuse - the requests are more than every minute!
I've never heard of that exact scam being done before, but it's similar
to the usual spammer trick of finding open SMTP relays and hijacking them.
What's happened is somebody has sold banner ads on his web site. He
has a web page containing, say, porno pictures, along with a banner
ad at the top. The banner company gives the site operator a piece of
HTML to put at the top of his page, which typically looks like this:
<img src=http://ad.bannercompany.com/banner.gif?id=12345>
The banner ad is supposed to get served by bannercompany.com's server
and they use the ID number to know which site the banner appeared in.
They pay the site operator a certain amount for every hit.
If the HTML instead looks like
<img src=http://yourproxy.youraddress.at/http://ad.bannercompany... >
guess what? You're now paying for the bandwidth to serve the banner
to the final viewer, instead of the ad company paying for it. If the
ad company is there in .at with you, and most of the users are in North
America and it's more expensive to send IP traffic across the ocean than
within Austria, the banner operator is ripping you off for a lot of money.
You might log the incoming referer headers to see what site is
including those ads. If you want to creatively get back at them a
little, instead of sending 403 responses, you could set up your server
to send good 200 responses, but send your own version of the banner ad
for the customer to see instead of the ad company's, heh heh heh.
It's probably not worth your time though.
http://cache.jp.apan.net/proxy-checker has a proxy security checker
|
Subject: Re: Firewall positioning CERT paper on firewall security issues and best practices. http://www.cert.org/security-improvement/modules/m08.html Contrary to some answers you may have received: a) never leave a web server where it is not protected (in front of a firewall) b) do not allow inbound connections through a firewall to your internal network (unless you are a security expert and know the risks or you have it checked by a security expert) c) so that leaves you with 1 primary option: get a single firewall and use 3 interfaces: 1 to your internal network, 1 to a DMZ (a semi-secure area that is designed for serving inbound requests) and 1 to the Internet. ..more complex answers are available but require in-depth knowledge of the situation and the expertise to evaluate the options...
My personal preference (may not be available or may be different
of various unix-flavors, YMMV) is:
route add -blackhole 62.2.252.230 127.0.0.1
And *any* packets from the offendee are simply dropped by the kernel.
Or, if it is in your purview, similarly at your firewall or router.
>THE ANSWER ABOUT THIS PROBLEM (to test before the others in listing) , IS: >insert in the first line of the cgi or of the script file the header >#!/bin/ksh or #!/bin/sh because on some server if you don't specify the >variable of shell the script don't start from the web server. Ok, thanks a >lot for all the answers but I have try all and only this answer have >resolved my problem.
From: "Joshua Slive" [slive+news@finance.commerce.ubc.ca]
Newsgroups: comp.infosystems.www.servers.unix
Subject: Re: Apache/mod_rewrite: index.html --> /
Date: 15 Nov 1999 19:15:56 GMT
Martin Ramsch [m.ramsch@computer.org] wrote:
[...]
> I'd like to redirect every access to ".../index.html" to ".../", so to
> avoid unneccessary long and complicated URLs in bookmarks and search
> engines.
[...]
> So far my solution using mod_rewrite is:
> RewriteCond %{THE_REQUEST} "/index\.html HTTP"
> RewriteRule ^(.*/)index\.html$ http://%{SERVER_NAME}$1 [R=301]
What is the point of the RewriteCond. I may be missing something,
buy I don't understand why you need it there at all. The second
line should be sufficient all on its own.
--
Joshua Slive
slive+news@finance.commerce.ubc.ca
http://finance.commerce.ubc.ca/~slive/
Earlier this month, a public server of the Apache Software Foundation (ASF) was illegally accessed by unknown crackers. The intrusion into this server, which handles the public mail lists, web services, and the source code repositories of all ASF projects was quickly discovered, and the server immediately taken offline. Security specialists and administrators determined the extent of the intrusion, repaired the damage, and brought the server back into public service. The public server that was affected by the incident serves as a source code repository as well as the main distribution server for binary release of ASF software. There is no evidence that any source or binary code was affected by the intrusion, and the integrity of all binary versions of ASF software has been explicitly verified. This includes the industry-leading Apache web server. Specifically: on May 17th, an Apache developer with a sourceforge.net account logged into a shell account at SourceForge, and then logged from there into his account at apache.org. The ssh client at SourceForge had been compromised to log outgoing names and passwords, so the cracker was thus able get a shell on apache.org. After unsuccessfully attempting to get elevated privileges using an old installation of Bugzilla on apache.org, the cracker used a weakness in the ssh daemon (OpenSSH 2.2) to gain root privileges. Once root, s/he replaced our ssh client and server with versions designed to log names and passwords. When they did this replacement, the nightly automated security audits caught the change, as well as a few other trojaned executables the cracker had left behind. Once we discovered the compromise, we shut down ssh entirely, and through the serial console performed an exhaustive audit of the system. Once a fresh copy of the operating system was installed, backdoors removed, and passwords zeroed out, ssh and commit access was re-enabled. After this, an exhaustive audit of all Apache source code and binary distributions was performed. The ASF is working closely with other organizations as the investigation continues, specifically examining the link to other intrusion(s), such as that at SourceForge (http://sourceforge.net/) [ and php.net (http://www.php.net/). ] Through an extra verification step available to the ASF, the integrity of all source code repositories is being individually verified by developers. This is possible because ASF source code is distributed under an open-source license, and the source code is publicly and freely available. Therefore, the ASF repositories are being compared against the thousands of copies that have been distributed around the globe. While it was quickly determined that the source code repositories on the ASF server were untouched by the intruders, this extra verification step provides additional assurance that no damage was done. As of Tuesday, May 29, most of the repository has been checked, and as expected, no problems have been found. A list of verified modules will be maintained, and is available here: http://www.apache.org/info/hack-20010519.html Because of the possible link of the ASF server intrusion to other computer security incidents, the investigation is ongoing. When complete, the ASF will offer a complete and public report. The Apache Software Foundation strongly condemns this illegal intrusion, and is evaluating all options, including prosecution of the individual(s) responsible to the fullest extent of the law. Anyone with pertinent information relating to this or other related events should contact root@apache.org. Anyone from the media with further interest should contact press@apache.org. Thanks. Brian Behlendorf President, Apache Software Foundation
"I'm a 25-year-old aspiring cryptanalyst. I was very recently hired by a large telecommunications outfit as a security specialist. I've noticed that they do not officially share my views on just about anything so I'm keeping the name secret.
Anyway.. because of this, I had to move to Helsinki, where I am now happily living in a big abandoned house with a bunch of friends that I wouldn't like my co-workers to see, a couple of rats, and some exotic but capable radio equipment."
Manifesto: Netizens of the World Unite! When in the Course of human events, it becomes necessary for one people to shake the commercial bands which have connected them with another, they should declare their Independence. At least for 24 hours. As Netizens, we hold certain truths to be self-evident: that the Internet was created and endowed by its Creator with certain unalienable Rights, chief among these: free Access to uncensored Content, the ability to Shop wherever and whenever one chooses and the general pursuit of e-Happiness. And that whenever any Despotic force threatens these truths, it is the right and duty of Netizens to throw off such Tyranny and Misunderstanding. And for the support of this Declaration, we mutually pledge to each other our Lives, our Fortunes and our Honor. True. True.
Misc WAP (Wireless Application Protocol) Stuff and LinksSummary: WAP is CRAP (but can be made to work)
|
Date: Sun, 31 Dec 2000 01:43:59 +1100 (EST)
To: Lachlan Cranswick [l.cranswick@dl.ac.uk]
Subject: favicon.ico in our web error logs - mystery solved.
Hey Lach,
Finally got sufficiently curious about that "favicon.ico" that keeps
bloating both of our error logs. It's an automatic thingee that
IE5 assumes must exist on every site when people "bookmark" it.
(Typical Microsoft). It's then placed against the bookmark for your
pages on the users PC (if you get my drift). Anyway, have added one for
you and me (BTW - you may like to change yours).
In other late-breaking and earth-shattering news, have plaugurised your
excellent "page not found" page (bad-link.html). Hope you don't mind?
Cheers,
Tony
F.Y.I.: Favicon (pronounced fav-eye-con) is short for 'Favorites Icon'
<HEAD>
<LINK REL="SHORTCUT ICON" HREF="http://www.mydomain.com/myicon.ico">
<TITLE>My Title</TITLE>
</HEAD>
If you didn't make your Icon using our applet, it may not be a true ICO file and you need to make a favicon.ico file using our program. If you did make a favicon.ico file at favicon.com and are still having trouble seeing your new icon, it is probably because you had an existing bookmark for that page already. IT IS HARD TO CHANGE EXISTING BOOKMARKS. Rest assured, however, your new bookmark is visible to the rest of the world and any new bookmarks will be seen with that logo. If you want to see the new logo, we have 2 possible remedies (Thanks Pete Harwood):
1. RENAME FAVICON (RECOMMENDED) - Call the new icon anything other than favicon.ico (or your currently chosen name in the link tag), and use the in the header of the page. Simply deleting the original shortcut and creating a new one forces IE to download the new icon as it doesn't have the newicon.ico file in cache. It is also good habit to check the link used in the above tag (ie http://www.mydomain.com/newicon.ico);
2. DELETE CACHE - Go to Tools Menu and select Internet Options. Then make sure you select the General Tab. There you will click Settings under Temporary Internet Files. You can then delete the offending file there. When you reboot the machine now, the shortcuts will revert to IE's standard icon. Simply clearing the cache doesn't delete icons, just as it doesn't delete cookies. Adding the site to favorites again now will force IE to download the new icon. Earlier we had recommended, deleting the existing bookmark(s), clear all your cache, reset your computer, return to page and bookmark, however, users said they got mixed results. Let us know if you have any more information
On rare occassions, we have seen discount/free ISPs add their advertising in such a way that disallows the use of Favicons. Read below if this is the case. In addition, sometimes you have to SELECT THE BOOKMARK TO SEE IT - rather than typing in the URL - in order to see the icon in the address bar.
Solution submitted by Steven Champeon
RedirectMatch permanent .*/favicon\.ico$ URL
where URL is the URL of either:
1) an icon named something other than favicon.ico, on your own site
2) http://www.microsoft.com/favicon.ico/requests/are/flooding/my/error/log
It catches all requests containing the string 'favicon.ico' (which you must do, as IE will request /favion.ico, or /subdirectory/favicon.ico, etc. as appropriate given the URL that was bookmarked) and redirects them to another icon or to Microsoft's site. The idea is that if you don't have an icon, you should lodge a protest of sorts, and waste Microsoft's logfiles instead.
"From: l.cranswick@dl.ac.uk (Lachlan Cranswick)
Newsgroups: comp.infosystems.www.servers.unix
Subject: Re: Server / Log analyzer..
Date: Wed, 1 Dec 1999 15:11:49 LOCAL
Organization: Daresbury Laboratory, UK
On the point of keeping bean counters amused with graphs
and nifty graphics. One area that is wide open for
Server / Log analyzer software is the concept of a
3D (VRML based?) Pie Sphere.
2D Pie charts can provide useful information - where as a 3D Pie Sphere -
where % could either be the surface or volume it contains (with volume or
subsets of the data hidden under the surface as per a
cut section or onion rings); would be amusing useless.
It would most likely not be able to bring over any useful
information but it would be really nifty.
I really should declare a software patent on this, but would
prefer to give this to the world for the greater glory of future
management information presentation systems.
Cheers,
Lachlan.
In article [l.cranswick.434.0311518A@dl.ac.uk> l.cranswick@dl.ac.uk (Lachlan
Cranswick) writes:>In article [3844F485.87ED5C15@cam.ac.uk> Stephen Turner
[sret1@cam.ac.uk> >writes:>Anthony Cogan wrote:
>>>
>>> Just wondering what the best web server / log analyzer out there is?
>>> Looking for an opensource solution.
>>Well, as the author, I obviously think my program, analog, is. There's good
>>evidence it's the most popular anyway.
>> http://www.statslab.cam.ac.uk/~sret1/analog/
>I don't disagree with analog being a good program but:
>As one of the main "real" reason for doing webstats is to keep the
>bean counters happy, I strongly recommend using http-analyze.
>http://www.netstore.de/Supply/http-analyze/
>Lots of Pie charts and graphs to keep those above
>amused for ages. Even VRML if the bean counter of your
>choice has this viewing capability. Is very fast and chews
>throughs stats in no time at all!
>Refer to copy of my web-stats:
>http://webstats.ccp14.ac.uk/filtered/
>http://webstats.ccp14.ac.uk/filtered/www1999/frames.html
>(go one directory above for un-filtered web-stats)
>There is a freely available version for non-profit use though I
>have registered - as some programs are just so good - the
>programmer should be rewarded for the errorts. Http-analyze
>is one of these programs!
>Lachlan.
Lachlan M. D. Cranswick
Collaborative Computational Project No 14 (CCP14)
for Single Crystal and Powder Diffraction
Daresbury Laboratory, Warrington, WA4 4AD U.K
Tel: +44-1925-603703 Fax: +44-1925-603124
E-mail: l.cranswick@dl.ac.uk Ext: 3703 Room C14
New Domains being registered at a rate of around one a secondDomain name speculation seems to have increased considerably this year, as the advent of multiple registrars for .com|.net|.org has led to cheaper prices and greater promotion. In a 10 day period during March around three quarters of a million new domains were registered. What is startling is how quickly the new registrars have been able to build awareness and take market share from NSI. On a sample of new domain registrations in the same period, register.com, were taking almost 17%.Resonate load balances 2% of web sitesResonate, which recently received an investment from Sun and filed to go public, has a load balancing product which slightly perturbs the tcp/ip characteristics of the systems behind it. It is possible to use this to determine Resonate installations, and the current survey has found 222 of these, which broadly matches Resonate's claim of more than 250 customers worldwide. These systems load balance slightly over 2% of the hosts found in the current survey. Resonate may have additional product versions which do not have the same effect on tcp/ip characteristics, and so their actual installed base may be bigger than we report here, but the numbers seem impressive in any case.Wap content pouring on to the webWith wap enabled phones such as the Nokai 7110 now fairly widely available, there has been a surge of wap content onto the web, with the leading cellular providers developing mini-portals of wap content, and sites such as yahoo.co.uk and iii.co.uk already delivering information via WAP. However, one other early content provider has already commented that the tiny screens and limited bandwidth make for a frustrating user experience.Credit card theft rife, chronic ecommerce site securityMSNBC reported on 17th March, and again on 24th March, cases in which large numbers of credit card numbers and associated information had been stolen from sites, while theregister.co.uk recently headlined an article "Hacking credit cards is preposterously easy". Certainly, it is clear that large numbers of valid credit cards are now in the wild, and being used to fraduently buy goods and services around the web. Another Microsoft associate, Expedia reported that it had discovered that up to 18% of its revenue for the last quarter had been fraudulent. 18% of revenue is a massive hit in a low margin business such as selling airline tickets. Visa had earlier announced that around half its disputes concern internet based credit card transactions, despite these only making up 2% of its total revenue.These incidents make plain that, however much encryption is used to protect information in transit (as SSL does), data is still not protected if the systems at the end points are insecure. The amount of disruption caused for credit card fullfilment has led to a small resurgence of internet in the use of the SET protocol instead of SSL to alleviate the problems of weak merchant security. SET uses trusted centralised servers, typically run by financial institutions, and digitally signed information to avoid the need for the merchant to receive and store the credit card number itself. The customer has software which signs the payment authorisation using their private signature key. SET therefore might seem attractive: merchant systems would not accumulate large amounts of credit card data, so introduce less vulnerability into the system. However customers have to store private signature keys on their own systems, the theft of which would allow someone else to assume their identity as far as the SET protocol is concerned. It is an interesting judgement which is worse and more difficult to fix; 100,000 insecure merchant databases, or 100 million personal computers containing secret signature keys, superficially protected by the typical user's weak choice of password, and open to being extracted by any combination of trojan code, network insecurity or physical access, to which typical PCs might be vulnerable.
|
MULTIHOMING
Multihoming means using one machine to serve multiple hostnames. For
instance, if you're an internet provider and you want to let all of your
customers have customized web addresses, you might have www.joe.acme.com,
www.jane.acme.com, and your own www.acme.com, all
running on the same physical hardware. This feature is also known as
"virtual hosts". There are three steps to setting this up.
One, make DNS entries for all of the hostnames. The current way to do
this, allowed by HTTP/1.1, is to use CNAME aliases, like so:
www.acme.com IN A 192.100.66.1
www.joe.acme.com IN CNAME www.acme.com
www.jane.acme.com IN CNAME www.acme.com
However, this is incompatible with older HTTP/1.0 browsers. If you want
to stay compatible, there's a different way - use A records instead, each
with a different IP address, like so:
www.acme.com IN A 192.100.66.10
www.joe.acme.com IN A 192.100.66.200
www.jane.acme.com IN A 192.100.66.201
This is bad because it uses extra IP addresses, a somewhat scarce resource.
But if you want people with older browsers to be able to visit your
sites, you still have to do it this way.
Step two. If you're using the modern CNAME method of multihoming, then you
can skip this step. Otherwise, using the older multiple-IP-address
method you must set up IP aliases or multiple interfaces for the extra
addresses. You can use ifconfig(8)'s alias command to tell the machine to
answer to all of the different IP addresses. Example:
ifconfig le0 www.acme.com
ifconfig le0 www.joe.acme.com alias
ifconfig le0 www.jane.acme.com alias
If your OS's version of ifconfig doesn't have an alias command, you're
probably out of luck (but see the notes).
Third and last, you must set up thttpd to handle the multiple hosts.
The easiest way is with the -v flag, or the ALWAYS_VHOST config.h option.
This works with either CNAME multihosting or multiple-IP multihosting.
What it does is send each incoming request to a subdirectory based on
the hostname it's intended for. All you have to do in order to set
things up is to create those subdirectories in the directory where thttpd
will run. With the example above, you'd do like so:
mkdir www.acme.com www.joe.acme.com www.jane.acme.com
If you're using old-style multiple-IP multihosting, you should also
create symbolic links from the numeric addresses to the names, like so:
ln -s www.acme.com 192.100.66.1
ln -s www.joe.acme.com 192.100.66.200
ln -s www.jane.acme.com 192.100.66.201
This lets the older HTTP/1.0 browsers find the right subdirectory.
There's an optional alternate step three if you're using multiple-IP
multihosting: run a separate thttpd process for each hostname, using the -h flag
to specify which one is which. This gives you more flexibility, since
you can run each of these processes in separate directories, with different
throttle files, etc. Example:
thttpd -r -d /usr/www -h www.acme.com
thttpd -r -d /usr/www/joe -u joe -h www.joe.acme.com
thttpd -r -d /usr/www/jane -u jane -h www.jane.acme.com
But remember, this multiple-process method does not work with CNAME
multihosting - for that, you must use a single thttpd process with
the -v flag.
Most of today's internet uses IPv4, which is now nearly twenty years old. IPv4 has been remarkably resilient in spite of its age, but it is beginning to have problems. Most importantly, there is a growing shortage of IPv4 addresses, which are needed by all new machines added to the Internet"
Apache with SSL or with the mod_ssl package, and with the "put" module
seems to work fine for me.
Add mod_ssl mod_ssl-2.2.6-1.3.6.tar.gz from
http://www.engelschall.com/sw/mod_ssl
Use
configure --with-apache=[apache-srcdir]
Carefully generate SSL certificates, including an unsigned certificate
for starting Apache correctly.
The man pages should be linked from /usr/local/apache/man to
/usr/local/man.
Add apache-contrib-1.0.4 from
http://www.apache.org/dist/contrib/modules/1.3/
Use
make all install APXS=/usr/local/apache/bin/apxs
Then edit your httpd.conf appropriately to enable the PUT module only
in SSL or HTTPS mode.
From: lars@hyperreal.org (Lars Eilebrecht) Newsgroups: comp.infosystems.www.servers.unix,linux.redhat.rpm,linux.redhat.misc,comp.os.linux.networking Subject: Re: Apache-SSL, mod_ssl, and RedHat Secure Web Server Date: Tue, 27 Apr 1999 23:05:20 +0200 My recommendation: mod_ssl, because it has more features and is easier to install.
In any civilised court, the decision lies with the accuser to prove that a person did what they say they did. Hence "reasonable doubt" in murder trials for example. This is a cornerstone in most law courts and as such is automatically presumed to be the case in arbitration decisions. It is, however, not explicitly stated and the last two years has seen a relaxation in what should be a hard and fast rule.
[As several readers have rightly pointed out, this is for criminal courts only and civil courts work on a "balance of probabilities". Despite this, the point holds that UDRP does not provide an effective method for deciding guilt or innocence.]
Again, a seemingly unimportant point but one of extraordinary import. Without a set approach to how the rules can be proven one way or the other, decisions made by judges are likely to vary hugely and so damage the creation of case law. It is also makes it far harder for a registrant to respond effectively to a challenge (see next point).
"Tell me something I don't know. Do not ever, under any circumstances, allow anyone to install JetAdmin onto your PC. Workgroup networking this way is unreliable and loses jobs when multiple PCs try to print at the same time. Normal HP windows drivers also work under the premise that all you will ever want to do in life is print to an HP printer. Working applications or reliable networking are not necessary and can therefore be sacrificed in the interests of the HP Driver. It will load its own version of mpr.exe (multi-protocol routing driver) and destabilise your PC. When faced with this problem we do the following. 1: Setup an NT4 or W2000 PC (workstation or server) 2: Install DLC Protocol. 3: Install Printer/plotter driver onto HP Network Port 4: Share the printer. We refuse to set them up any other way"
The International PGP Home Page
#!/sbin/sh
#
# /etc/init.d/ssh
PATH=/usr/bin:/bin
SSHD=/usr/local/sbin/sshd
case $1 in
'start')
echo "Starting sshd...\c"
if [ -x $SSHD ]; then
$SSHD
echo "done."
else
echo "sshd not found."
fi
;;
'stop')
pid=`/usr/bin/ps -eo pid,comm | /usr/bin/awk '{ if ($2 == $SSHD) print $1 }'`
if test "$pid"
then
kill $pid
fi
;;
*)
echo "usage: /etc/init.d/ssh {start|stop}"
;;
esac
/etc/rc2.d/S98ssh'.
--------------------------------------------------
#! /bin/sh
#
# start the ssh deamon
# Start the ssh deamon
if [ -f /etc/sshd ] ; then
echo "starting ssh daemon"
/etc/sshd -b 1024
fi
This is probably old news, but I found no mention of it on ssh's website or in the 1.2.26 code tree. Under IRIX 6.4 and 6.5 a non-root user can't ssh in. ssh -v on the client side and sshd -d on the server reveal the problem to be a failed call to setprid() (at least, that's what the debug message said). I tracked this down to code within the #ifdef HAV_SGI_PROJ_H section of sshd.c (quoted below). In my case, the real error is because setprid is never called, because naccts = 0. A later if-test tests err for zero-ness, but because the variable was never initialized, this test succeeds, generating the debug message and bailing out. This all has to do with the fact that IRIX 6.x uses a system of projects to keep track of user activity on systems with billable accounts. The system is managed with /etc/project and /etc/projid, roughly equivalent to /etc/passwd and /etc/group. My IRIX machines use NIS accounts, so I haven't put any entries in these files. Because they're empty, naccts = 0. The real problem here is a basic one: the author assumed that the err variable would autmatically be initialized to zero upon declaration. Even with gcc, this isn't true under IRIX 6.x. When I changed line 3676 of sshd.c from "int err;" to "int err = 0;", the login worked." ..... "I edited the sshd.c and changed the err variable definition to include an initialization to zero (ie. 'int err = 0;'). Compiled it, tested it, worked fine. Moral of the story: don't trust uninitialized variables. I'm kinda surprised the ssh guys let this through."
"In addition, VPS 2.0 is free and it is open source! It is covered under the Gnu Public License (GPL). Our goal is to create an easy-to-use open source program that allows systems administrators to set up and manage VPNs with both a GUI and command-line interface."
These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted net is encrypted by the IPSEC gateway machine and decrypted by the gateway at the other end. The result is Virtual Private Network or VPN. This is a network which is effectively private even though it includes machines at several different sites connected by the insecure Internet."
It is also much more efficient than IPsec, which requires more overhead. And don't worry about UDP packets being thrown away - if it is encapsulated tcp traffic, the specific applications will still deal with a tcp circuit and do any error handling."
They inspire me To write beautiful haikus For The Register. Their mission is to Enhance my browsing session. Diet ads plague me. I get paid today. What shall I purchase online? Dad gets cheap flowers.
Section 3: Configuring Snort
----------------------------
3.1 Q: How do I setup snort on a 'stealth' interface?
3.2 Q: How do I run snort on an interface with no IP address?
3.3 Q: My network spans multiple subnets. How do I define HOME_NET?
3.4 Q: How can I run snort on multiple interfaces simultaneously?
3.5 Q: IP address is assigned dynamically to my interface, can I use snort
with it?
3.6 Q: I have one network card and two aliases, how can I force snort to
"listen" on both addresses ?
3.7 Q: How do I ignore traffic coming from a particular host or hosts?
3.8 Q: How do I get Snort to log the packet payload as well as the header?
3.9 Q: Why are there no subdirectories under /var/log/snort for IP addresses?
3.10 Q: How do you get snort to ignore some traffic?
#!/bin/sh
## Cheap-ass promiscuous mode watcher/action-taker
## Written by axon
##
## Requires "NEtwork Promiscuous Ethernet Detector" (neped.c)
## ftp://apostols.org/AposTools/snapshots/neped/neped.c
##
## This program must be run as root, or neped must be set-uid root.
##
#########################################################################
##
## Config Options!
##
######
# Command or shell script that's run when promisc.
promisccmd="promisc.sh" # mode card is found. This might shut down a
# service, or e-mail an administrator. Up to you.
# (you must write a promisc.sh script or change
# this variable)
# Command or shell script that's run when
nopromisccmd="nopromisc.sh" # promisc. mode ceases. This might page
# an administrator or restart a service.
# (you must write a nopromisc.sh script or
# change this variable)
while true
do
while true
do
# Counts number of lines
neped=`neped eth0 | wc -l` # that are returned
# by neped.
if [ $neped -gt 8 ];then # This runs the command of your
$promisccmd # choice when promisc. mode
break # is detected
neped eth0|grep "*>" >> promisc.log # appends output of neped to promisc.log
fi
done
while true
do
# Counts number of lines
neped=`neped eth0 | wc -l` # that are returned
# by neped.
if [ $neped = 8 ];then # This runs the command of your
$nopromisccmd # choice when promisc. mode
break # ceases
fi
done
done
Like the Macintosh, the Amiga was based on the Motorola 68000 processor. The initial model, the Amiga 1000, had 256 Kb of RAM. It was soon phased out by the lower cost Amiga 500 at the low end (shown in the picture), and the Amiga 2000 at the high end. Both offered 512 Kb of RAM standard, expandable to 1 Mb on the Amiga 500 and a whopping 8 Mb on the Amiga 2000.
Unlike previous personal computers, the Amiga used three custom chips (Agnes, Denise & Paula) to do advanced graphics and sound. The graphics in particular was amazing by the standards of those days. At a time when PC users thought 16 color low resolution EGA was hot stuff, the Amiga could display 4096 colors, could reach the extremely high resolution of 640x400, and had custom chips such as a blitter for accelerated graphics. It even had built-in video outputs for TV's and VCR's (a decade later this was still a pricey extra cost option for most systems). The Amiga's audio system was also impressive. Building on the audio capabilities of the Commodore 64, the Amiga had four voice sampled stereo sound and was the first computer with built-in speech synthesis. Although it only cost $1200, the Amiga did graphics, sound, and video well enough that many broadcast professionals adopted it for special effects. With a small investment, even a home user could do reasonable quality desktop video production (I remember doing quite a few videos myself for high school and university presentations).
The Amiga's operating system, designed by Carl Sassenrath, was just as amazing. From the outset it had preemptive multitasking, a graphical user interface, shared libraries, messaging, scripting, and multiple simultaneous command line consoles. Ten years later, PC and Macintosh users were still waiting for some of those features. Thanks to the custom chips and an efficient operating system, the Amiga even felt fast. The user interface was really quite snappy, much faster than a Macintosh. Five years later, Microsoft Windows running on a much faster 80386 based PC still felt slower.
The Amiga was also the first platform to make major use of emulation of other operating systems. Emulators for the IBM PC and the Apple Macintosh became quite widely used, often in an attempt to make the Amiga more useful for business purposes (it didn't have a lot of business software). The technology of emulation went on to become very important in the next decade."
Date: Mon, 22 Nov 1999 12:52:37 +0200 (EET) From: typo [typo@pc031.otanner.as.tampere.fi] To: proftpd@proftpd.net Subject: Re: [ProFTPD] sniffable passwords on linux and freebsd3.3-stable On Mon, 22 Nov 1999, Lachlan Cranswick wrote: > >o Tunnel your ftp traffic through ssh whenever possible (!!!) > > Is there a web-page on how you would do this with the GUI based > FTP client programs connecting to a ProFTPD server? (assuming you're using windows to connect to a *nix server) 1. Launch SSH. 2. Go to the preferences and click on the tab 'forwarding' (or 'tunneling' in the new SSH2). 3. Select 'local' forwarding (all connections to the specified port on the local computer will be forwarded over the SSH connection to the specified port on the remote computer), port 21 on both local and remote computer (or, if the remote ftp server is using some other port, change that remote port accordingly) and fill in the remote computer's name/IP. 4. Connect to the remote computer with SSH. 5. Launch your FTP client and connect to your localhost (127.0.0.1), with the remote server's login name and password and you're all set. Everything is now tunneled through the SSH secure connection. If you're using *nix - *nix connections, read through SSH man pages and look for the -L option (local forwarding). Securing FTP traffic over an SSH connection when connecting to a Windows FTP server is a bit more cumbersome and I won't cover it here. Just use Linux/Unix ;) .pi. -- Petteri Lyytinen -+- typo@cc.tut.fi -+- http://vapaa.intternetti.com/~typo Once you stop trying, you can start succeeding.
Date: Mon, 22 Nov 1999 12:16:33 +0100 (MET) From: "V. T. Mueller" [vtmue@uni-freiburg.de] To: proftpd@proftpd.net Subject: Re: [ProFTPD] sniffable passwords on linux and freebsd3.3-stable The only caveat is that this only works for ftp clients that support ftp-sessions over *one port only*. If I don't mix it up that's called passive ftp, where active ftp opens one port for control and one for data. Of course ssh doesn't know anything about that second port and any ftp-session attempt will fail until the client is told to work in passive mode (which is not the default). Regards, Volker
SafeTP operates by installing a transparent proxy in the Windows networking stack which detects outgoing FTP connections from any windows FTP client, and silently secures them using modern cryptographic techniques (the server must also support SafeTP in order for a secure connection to be succesfully established). SafeTP is 100% compatible with existing (insecure) FTP servers, and will operate in an insecure mode if the server does not yet support the SafeTP protocol. One key feature of the SafeTP client proxy is that it was designed to be completely transparent to the client FTP application. This way, users can reap the benefits of FTP security, while continuing to use their existing FTP software."
From: peter pilsl [pilsl@goldfisch.atat.at] Newsgroups: comp.security.ssh Subject: Re: ftp over ssh-tunnel ? Organization: peter pilsl Date: Wed, 03 May 2000 22:26:54 GMT In article [m1l4s8fwcuu.fsf@syrinx.oankali.net], slade@shore.net says... > >>>>> "peter" == peter pilsl [pilsl@goldfisch.atat.at] writes: > > peter> you mean: ftp is impossible over ssh ? > > It is not usually possible to get the data channels to go through SSH, no. > Forwarding the control channel is of course still a win, since it hides > the password. > in fact, it would be enough ... the exact system is: local--NATfirewall - - - - - - server(--local2) where local has ip=192.168.10.2 and server has 192.168.0.1 as internal ip the server is not behind a firewall. so I connect from local to server via ssh and forward 21 and use passv- ftp: connecting to 127.0.0.1:21 Connected to 127.0.0.1 port 21 220 server.ihf FTP server (Version wu-2.4.2-academ[BETA-18](1) Fri Dec 11 19:58:25 /etc/localtime 1998) ready. USER peter 331 Password required for peter. PASS (hidden) 230 User peter logged in. PWD 257 "/home/user/peter" is current directory. SYST 215 UNIX Type: L8 Host type (S): UNIX (standard) PASV 227 Entering Passive Mode (192,168,0,1,13,240) connecting to 192.168.0.1:3568 - - connecting to 192.168.0.1:3568 ! Connection failed 192.168.0.1 - host unreachable ! connect: error 0 PORT 127,0,0,1,5,133 500 Illegal PORT Command ! Failed "port": ! Retrieve of folder listing failed (0) it seems that the server gives back its address 192.168.0.1 to the client and the client tries to connect it there. This will fail, cause the server gives back its internal address instead of its external address. Is this the feature of wu-ftp, you mentioned in your posting ? I use wu-2.4.2-academ[BETA-18] and didnt find this feature at the first attempt (man ftpaccess). You know from which version this feature is implemented ? thanks a lot, peter -- pilsl@
Date: Mon, 22 Nov 1999 16:56:22 +0000 (GMT)
From: The Flying Hamster [hamster@vom.tm]
cc: proftpd@proftpd.net
Subject: Re: [ProFTPD] sniffable passwords on linux and freebsd3.3-stable
What it boils down to is
Active
control channel, port 21
data channel, server specifies random port.
Passive
control channel, port 21
data channel, port 20
Newsgroups: comp.security.ssh
Subject: Re: ftp over ssh-tunnel ?
From: slade@shore.net (Richard E. Silverman)
Lines: 53
Date: 03 May 2000 22:54:36 -0400
> PASV
> 227 Entering Passive Mode (192,168,0,1,13,240)
> connecting to 192.168.0.1:3568
> - -
> connecting to 192.168.0.1:3568
> ! Connection failed 192.168.0.1 - host unreachable
> ! connect: error 0
> ...
> it seems that the server gives back its address 192.168.0.1 to the client
> and the client tries to connect it there. This will fail, cause the server
> gives back its internal address instead of its external address.
That's correct.
> Is this the feature of wu-ftp, you mentioned in your posting ?
Well, it's the FTP/NAT problem I mentioned, and wu-ftpd has a feature
which can get around it.
> PORT 127,0,0,1,5,133
> 500 Illegal PORT Command
> ! Failed "port":
> ! Retrieve of folder listing failed (0)
Just FYI: this second error happens because the passive-mode transfer
failed, so the client tries the usual way -- which fails because you did
"ftp localhost" and not "ftp client_host", so it gives out its loopback
address as the listening socket for the transfer. "ftp client_host" will
fix that problem in principle, but that won't help in your case because
the client IP address is not reachable from the server (it's another
reason why you need passive mode, besides the fact that your firewall
would block the reverse connections from the server).
> I use wu-2.4.2-academ[BETA-18] and didnt find this feature at the first
> attempt (man ftpaccess). You know from which version this feature is
> implemented ?
It's documented in the ftpaccess man page for wu-2.5.0(1), though I
haven't tried it out:
passive address [externalip] [cidr]
Allows control of the address reported in response to
a PASV command. When any control connection matching
the [cidr] requests a passive data connection (PASV),
the [externalip] address is reported. NOTE: this
does not change the address the daemone actually listens
on, only the address reported to the client.
This feature allows the daemon to operate correctly
behind IP-renumbering firewalls.
- Richard Silverman
slade@shore.net
"censor: A is being censored if, somewhere in the line of communication between A and B, a third party C, against the will of either A, B, or both, changes the message in such a way as to impact the content of the message in significant way, by removal of content, distortion of content, addition of content, or simply denying access to A. "
Note: Mass hacks involve defacing several domains, even though they are hosted
by the same machine. This tends to obscure the actual counts of hacked
systems. Take these numbers in stride..
08/1999
Win-NT 106 35.93%|
Solaris 77 26.10%|
Linux 68 23.05%|
BSDI 19 6.44%|
IRIX 11 3.73%|
FreeBSD 9 3.05%|
SCO 2 0.68%|
OSF1 1 0.34%|
HPUX 1 0.34%|
AIX 1 0.34%|
Reported Hacks: 319
Average number of website defacements per day since 99.08.01: 10.3.
09/1999
Win-NT 82 32.54%|
Linux 72 28.57%|
Solaris 62 24.60%|
BSDI 13 5.16%|
FreeBSD 12 4.76%|
IRIX 7 2.78%|
HPUX 2 0.79%|
MacOSX 1 0.40%|
DGUNIX 1 0.40%|
Reported Hacks: 260
Average number of website defacements per day since 99.09.01: 8.7.
10/06/1999
Win-NT 74 67.27%|
Solaris 13 11.82%|
FreeBSD 11 10.00%|
Linux 7 6.36%|
BSDI 4 3.64%|
IRIX 1 0.91%|
[99.10.26] NT [PsychoKid] Anti-Hacker (www.anti-hacker.org) [99.10.26] NT [phreak.nl] National Defense University (www.ndu.edu) [99.10.26] NT [phreak.nl] Jet Propulsion Laboratory, Acquisition Division (acquisition.jpl.nasa.gov) [99.10.26] NT [phreak.nl] Program Executive Office, Aviation Redstone Arsenal (peoavn.redstone.army.mil) [99.10.25] NT [Narcissus] Ad Finder (www.adfinder.co.uk) [99.10.25] NT [flipz] #2 Substance Abuse & Mental Health Services Administration (www.samhsa.gov) [99.10.25] Li [ ] M f2s (www.webdesign.f2s.com) [99.10.25] NT [p4riah] ACM U.L. Monitoring Station (www.acm-ul.com) [99.10.25] NT [p4riah] Louisiana Resource Center for Educators (www.lrce.org) [99.10.25] So [KES] South Shields Gazette (www.shields-gazette.co.uk) [99.10.25] BI [analognet] Mulberry Tech (www.mulberrytech.com) [99.10.25] NT [s0ften] M Unreal Webs (www.unrealwebs.com) [99.10.25] Bf [Blade] r00ted (www.r00ted.com) [99.10.25] Li [DeXeR] M Nancy Day (www.nancyday.com) [99.10.25] Li [ubt] #2 KBR (www.kbr.net) [99.10.25] NT [flipz] Department of Veterans Affairs (www.va.gov) [99.10.24] Ir [w0lf] CWI Web (www.cwiweb.com) [99.10.24] Ir [c0de red] Travel By Benny (www.travelbybenny.com) [99.10.24] NT [flipz] Microsoft's Conference Management Server (msrconf.microsoft.com/CMT/) [99.10.24] NT [FST] Media Solution (www.mediasolution.fi) [99.10.24] Li [zSh] KBR (www.kbr.net) [99.10.24] NT [flipz] Navy Management System Support Office (www.massolant.navy.mil) [99.10.24] NT [flipz] US Army Dental Care System (www.dencom.army.mil) [99.10.24] So [vendetta] Bit Web (www.bitweb.com) [99.10.23] Li [LevelSeven] Brew Help (taz.brewhelp.com) [99.10.23] NT [flipz] White Sands Missle Range (www.wsmr.army.mil) [99.10.23] Li [LevelSeven] Surfer (surfer.firstcity.net) [99.10.23] NT [DHC] #2 Penghu Islands National Scenic Area, Republic Of China (www.tbrocph.gov.tw) [99.10.23] Li [HIT2000] M Boutelegier (www.boutelegier.be) [99.10.23] Li [phreak.nl] M WYPC (www.wpyc.com.au) [99.10.23] NT [Contr0l-C] Disqueamizade (www.disqueamizade.com.br)
chfn Trojaned! User->r00t chsh Trojaned! User->r00t inetd Trojaned! Remote access login Trojaned! Remote access ls Trojaned! Hide files du Trojaned! Hide files ifconfig Trojaned! Hide sniffing netstat Trojaned! Hide connections passwd Trojaned! User->r00t ps Trojaned! Hide processes top Trojaned! Hide processes rshd Trojaned! Remote access syslogd Trojaned! Hide logs linsniffer Packet sniffer! fix File fixer! z2 Zap2 utmp/wtmp/lastlog eraser! wted wtmp/utmp editor! lled lastlog editor! bindshell port/shell type daemon! tcpd Trojaned! Hide connections, avoid denies
From: roberson@ibd.nrc.ca (Walter Roberson)
Newsgroups: comp.sys.sgi.apps
Subject: Re: getting DOS/Mac ASCII into UNIX ASCII format?
Date: 24 Apr 2000 20:01:13 GMT
Organization: National Research Council Canada
In article [4LYM4.9$fo1.260@rockyd.rockefeller.edu],
Penio Penev [penev@firenze.rockefeller.edu] wrote:
:On Sun, 23 Apr 2000 22:23:34 LOCAL Lachlan Cranswick [l.cranswick@dl.ac.uk] wrote:
:| I have not been having much fun tracking this down
:| in the help system. What are the programs (either with
:| SGI IRIX or installable off the internet) that can convert
:| DOS and Mac ASCII files into UNIX ASCII format?
:| (wild cards and recursion into subdirectories a plus)
:Anthother suggestion: ftp.
FTP doesn't really help so much for Mac text files. The convention
for Mac text files is that there is no carriage return or line
feed stored in them at the end of the "line": there is only a mark
at the end of a paragraph. Paragraphs can be indefinitely long, so
if you FTP the file over to a unix system, you could easily blow
the per-line character limit on most editors and be forced to
use something like emacs to patch up the file.
Mac text files also tend to have "smart-quotes" that need to be patched
up. \222 for left-single-quote, \223 for right-single-quote and
\224 for apostrophe. Unless, that is, the file happend to be created
with a Microsoft product on the Mac, in which case you also need to
worry about \226 and \227, the meaning of which I have mercifully managed
to forget.
Mac files are also more likely to contain international characters.
Those are not inherently a problem but the original poster did
specify ACSII and the ASCII standards only allow for a very small
number of international characters (and those do not -extend- the
US-ASCII set, they overlay the #, [, ], \, {, }, | and ~ characters.)
One also has to ask whether one has to worry about fonts: if the
composer switched to (say) Dingbat, then a proper translation to
Windows XP, unlike Windows 2000, leaves 802.1p/802.1q tagging enabled by default. This is an issue because CatOS software prior to 6.2.1 for the Catalyst 5000/5500 will forward 802.1x frames on all ports including spanning tree blocking ports, resulting in a layer 2 multicast storm.
The upshot of this is that a user can bring down an entire switch network by just connecting a Windows XP (Whistler) workstation to their network, if a 5000 series Lan switch is in place."
Perhaps he knows too much....
Standard grep options:
i case insensitive
n number lines
c give count of lines matching
C ditto, but >1 match per line possible
w word boundaries only
s silent mode
x exact matches only
v invert search sense (lines that DON'T match)
h hide filenames
e expression (for exprs beginning with -)
f file with expressions
l list filenames matching
F search for fixed strings (disable regular expressions)
Specials:
1 1 match per file
H highlight matches
u underline matches
r recursive on directories or dot if none
t process directories in `ls -t` order
p paragraph mode (default: line mode)
P ditto, but specify separator, e.g. -P '%%\\n'
a all files, not just plain text files
q quiet about failed file and dir opens
T trace files as opened
In article [37C56D66.9F9A1325@sun.com],
Arun Gupta [arun.gupta@sun.com] writes:
: How can i grep for a regular expression in all the source files in
: multiple levels of subdirectories ?
Grab tcgrep (from the Perl Power Tools) at
I usually do something like
% tcgrep -Hri expr dir
Greg
--
So, barmaid, bring a pitcher, another round o'brew
Honey, why don't we get drunk and screw?
-- Jimmy Buffett
From: Viral [sbviral@giasbma.vsnl.net.in] To: nmap-hackers@insecure.org Subject: Re: Nmap Users Favourite Tools Hi, I've compiled a summary of a few package names by flicking them from the Debian Package descriptions. Here's a summary of 25 or so tools that I could extract automatically. I hope its useful. Viral. Tool Name : Nessus URL : http://www.nessus.org Debian Package Name : nessus Description: Remote network security auditor, the client The Nessus Security Scanner is a security auditing tool. It makes possible to test security modules in an attempt to find vulnerable spots that should be fixed. . It is made up of two parts: a server, and a client. The server/daemon, nessusd, is in charge of the attacks, whereas the client, nessus, interferes with the user through nice X11/GTK+ interface. . This package contains the GTK+ 1.2 client, which exists in other forms and on other platforms, too. ------------------------------------------------------------------------- Tool Name : Netcat URL : http://www.l0pht.com/~weld/netcat/ (unofficial site) Debian Package Name : netcat Description: TCP/IP swiss army knife A simple Unix utility which reads and writes data across network connections using TCP or UDP protocol. It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. At the same time it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities. ------------------------------------------------------------------------- Tool Name : Tcpdump URL : http://www.tcpdump.org Debian Package Name : tcpdump Description: A powerful tool for network monitoring and data acquisition This program allows you to dump the traffic on a network. It can be used to print out the headers of packets on a network interface that matches a given expression. You can use this tool to track down network problems, to detect "ping attacks" or to monitor the network activities. ------------------------------------------------------------------------- Tool Name : Snort URL : http://www.snort.org Debian Package Name : snort Description: flexible packet sniffer/logger that detects attacks Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform content searching/matching in addition to being used to detect a variety of other attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, and much more. Snort has a real-time alerting capability, with alerts being sent to syslog, a separate "alert" file, or even to a Windows computer via Samba. ------------------------------------------------------------------------- Tool Name : Ethereal URL : http://ethereal.zing.org/ Debian Package Name : ethereal Description: Network traffic analyzer Ethereal is a network traffic analyzer, or "sniffer", for Unix and Unix-like operating systems. It uses GTK+, a graphical user interface library, and libpcap, a packet capture and filtering library. ------------------------------------------------------------------------- Tool Name : Abacus Portsentry URL : http://www.psionic.com/abacus/portsentry/ Debian Package Name : portsentry Description: Portscan detection daemon PortSentry has the ability to detect portscans(including stealth scans) on the network interfaces of your machine. Upon alarm it can block the attacker via hosts.deny, dropped route or firewall rule. It is part of the Abacus program suite. . Note: If you have no idea what a port/stealth scan is, I'd recommend to have a look at http://www.psionic.com/abacus/portsentry/ before installing this package. Otherwise you might easily block hosts you'd better not(e.g. your NFS-server, name-server, ...). ------------------------------------------------------------------------- Tool Name : Tripwire URL : http://www.tripwire.com/ (COMMERCIAL) Debian Package Name : tripwire Description: A file and directory integrity checker. Tripwire is a tool that aids system administrators and users in monitoring a designated set of files for any changes. Used with system files on a regular (e.g., daily) basis, Tripwire can notify system administrators of corrupted or tampered files, so damage control measures can be taken in a timely manner. ------------------------------------------------------------------------- Tool Name : Sniffit URL : http://reptile.rug.ac.be/~coder/sniffit/sniffit.html Debian Package Name : sniffit Description: packet sniffer and monitoring tool sniffit is a packet sniffer for TCP/UDP/ICMP packets. sniffit is able to give you very detailed technical info on these packets (SEC, ACK, TTL, Window, ...) but also packet contents in different formats (hex or plain text, etc. ). ------------------------------------------------------------------------- Tool Name : SATAN URL : http://www.fish.com/satan/ Debian Package Name : satan Description: Security Auditing Tool for Analysing Networks This is a powerful tool for analyzing networks for vulnerabilities created for sysadmins that cannot keep a constant look at bugtraq, rootshell and the like. ------------------------------------------------------------------------- Tool Name : iptables URL : http://netfilter.kernelnotes.org/ Debian Package Name : iptables Description: IP packet filter administration for 2.4.X kernels Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. The iptables tool also supports configuration of dynamic and static network address translation. ------------------------------------------------------------------------- Tool Name : John The Ripper URL : http://www.openwall.com/john/ Debian Package Name : john Description: An active password cracking tool john, normally called john the ripper, is a tool to find weak passwords of your users. ------------------------------------------------------------------------- Tool Name : Hunt URL : http://www.cri.cz/kra/index.html#HUNT Debian Package Name : hunt Description: Advanced packet sniffer and connection intrusion. Hunt is a program for intruding into a connection, watching it and resetting it. . Note that hunt is operating on Ethernet and is best used for connections which can be watched through it. However, it is possible to do something even for hosts on another segments or hosts that are on switched ports. ------------------------------------------------------------------------- Tool Name : SSH URL : http://www.ssh.com/commerce/index.html (some versions COMMERCIAL) Debian Package Name : ssh Description: Secure rlogin/rsh/rcp replacement (OpenSSH) OpenSSH is derived from OpenBSD's version of ssh, which was in turn derived from ssh code from before the time when ssh's license was changed to be non-free. Ssh (Secure Shell) is a program for logging into a remote machine and for executing commands on a remote machine. It provides secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel. It is intended as a replacement for rlogin, rsh and rcp, and can be used to provide rdist, and rsync with a secure communication channel. This software may be freely imported into the United States; however, the United States Government may consider re-exporting it a criminal offense. Thus, if you are outside the US, please retrieve this software from outside the US. In some countries, particularly Russia, Iraq, Pakistan, and France, it may be illegal to use any encryption at all without a special permit. ------------------------------------------------------------------------- Tool Name : tcp wrappers URL : ftp://ftp.porcupine.org/pub/security/index.html Debian Package Name : libwrap0 Description: Wietse Venema's TCP wrappers library Wietse Venema's network logger, also known as TCPD or LOG_TCP. . These programs log the client host name of incoming telnet, ftp, rsh, rlogin, finger etc. requests. Security options are: access control per host, domain and/or service; detection of host name spoofing or host address spoofing; booby traps to implement an early-warning system. ------------------------------------------------------------------------- Tool Name : Ntop URL : http://www.ntop.org Debian Package Name : ntop Description: display network usage in top-like format ntop is a Network Top program. It displays a summary of network usage by machines on your network in a format reminicent of the unix top utility. . It can also be run in web mode, which allows the display to be browsed with a web browser. ------------------------------------------------------------------------- Tool Name : traceroute URL : http://www.linux.com (or most other UNIX) Debian Package Name : traceroute Description: Traces the route taken by packets over a TCP/IP network. The traceroute utility displays the route used by IP packets on their way to a specified network (or Internet) host. Traceroute displays the IP number and host name (if possible) of the machines along the route taken by the packets. Traceroute is used as a network debugging tool. If you're having network connectivity problems, traceroute will show you where the trouble is coming from along the route. . Install traceroute if you need a tool for diagnosing network connectivity problems. ------------------------------------------------------------------------- Tool Name : telnet URL : http://www.linux.com (or most other UNIX) Debian Package Name : telnet Description: The telnet client. The telnet command is used for interactive communication with another host using the TELNET protocol. ------------------------------------------------------------------------- Tool Name : scanlogd URL : http://www.openwall.com/scanlogd/ Debian Package Name : scanlogd Description: A portscan detecting tool Scanlogd is a daemon written by Solar Designer to detect portscan attacks on your maschine. ------------------------------------------------------------------------- Tool Name : logcheck URL : http://www.psionic.com/abacus/logcheck/ Debian Package Name : logcheck Description: Mails anomalies in the system logfiles to the administrator Logcheck is part of the Abacus Project of security tools. It is a program created to help in the processing of UNIX system logfiles generated by the various Abacus Project tools, system daemons, Wietse Venema's TCP Wrapper and Log Daemon packages, and the Firewall Toolkit© by Trusted Information Systems Inc.(TIS). . Logcheck helps spot problems and security violations in your logfiles automatically and will send the results to you in e-mail. This program is free to use at any site. Please read the disclaimer before you use any of this software. ------------------------------------------------------------------------- Tool Name : Perl URL : http://www.perl.org Debian Package Name : perl Description: Fake package used for a smooth upgrade This package depends on perl-5.004. Perl-5.005 will conflict with perl so that all dependencies on perl will have to have vanished before perl-5.005 will be installed. The scripts and non-binary modules have to depend on perl5 and the binary modules on perl-5.005 (or whatever is the latest version of perl available in Debian). . It does also contain the io provides/replaces/conflicts. This has been removed from the perl-5.00X since io has disappeared a long time ago. ------------------------------------------------------------------------- Tool Name : Ngrep URL : http://www.packetfactory.net/Projects/ngrep/ Debian Package Name : ngrep Description: grep for network traffic ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular expressions to match against data payloads of packets. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop. ------------------------------------------------------------------------- Tool Name : Cheops URL : http://www.marko.net/cheops/ Debian Package Name : cheops Description: A GTK based network "swiss-army-knife" Cheops gives a simple interface to most network utilities, maps local or remote networks and can show OS types of the machines on the network. ------------------------------------------------------------------------- Tool Name : Libnet URL : http://www.packetfactory.net/libnet/ Debian Package Name : libnet0-dev Description: Routines for the construction and handling of network packets. libnet provides a portable framework for low-level network packet writing and handling. . Libnet features portable packet creation interfaces at the IP layer and link layer, as well as a host of supplementary functionality. Still in it's infancy however, the library is evolving quite a bit. Additional functionality and stability are added with each release. . Using libnet, quick and simple packet assembly applications can be whipped up with little effort. With a bit more time, more complex programs can be written (Traceroute and ping were easily rewritten using libnet and libpcap). ------------------------------------------------------------------------- Tool Name : LSOF URL : ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/ Debian Package Name : lsof-2.2 Description: List open files. Lsof is a Unix-specific diagnostic tool. Its name stands for LiSt Open Files, and it does just that. It lists information about any files that are open by processes current running on the system. The binary is specific to kernel version 2.2 ------------------------------------------------------------------------- Tool Name : IPTraf URL : http://cebu.mozcom.com/riker/iptraf/ Debian Package Name : iptraf Description: Interactive Colorful IP LAN Monitor IPTraf is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others. . Note that since 2.0.0 IPTraf requires a kernel >= 2.2 ------------------------------------------------------------------------- Tool Name : Queso URL : http://www.apostols.org/projectz/queso/ Debian Package Name : queso Description: Guess the operating system of a remote machine by looking in the TCP replies. ------------------------------------------------------------------------- |