This directory provides parameters for particular devices on the system. Most systems have at least two directories, cdrom and raid, but customized kernels can have others, such as parport, which provides the ability to share one parallel port between multiple device drivers.
The cdrom directory contains a file called info, which reveals a number of important CD-ROM parameters:
Issue the following responses to the queries from the command:
n (create a new partition)
p (will make it a "primary" partition)
1 (starting cylinder)
w (write partition table and quit)
/sbin/mke2fs -b 2048 /dev/hdd
mkdir /mnt/dvd
mount /dev/hdd /mnt/dvd
You can create, delete, and edit files & directories under /mnt/dvd in the same way that you would for any other file systems
Unmount the disk with the command:
umount /mnt/dvd
(Make ATAPI CD/DVD Devices look like SCSI devices under Linux)
/sbin/modprobe ide-scsi
ln -sf /dev/scd0 /dev/cdrom
ln -sf /dev/scd1 /dev/cdrom1
cdrecord -scanbus
cdrecord -scanbus dev=ATAPI
cdrecord -dao -v speed=24 dev=ATAPI:0,0
mke2fs -b 2048 /dev/scd1
mke2fs -b 2048 /dev/hdd
mount /dev/hdd /storage/dvd
mondoarchive -L -s 2220m -E /web_disc -Oi -d /storage/dvd
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -g -Oi -d /storage/dvd
mondoarchive -L -E /web_disc -Oi -d /storage/dvd -g -B "mount /storage/dvd" -A "umount /storage/dvd" -s 2220m
mondoarchive -L -g -E "/web_disc /web_logs" -Oi -d /web_disc/ccp14/temp
mondoarchive -S /tmp -T /tmp -L -E "/web_disc /web_logs" -S /web_disc/ccp14/temp -Oi -d /web_disc/ccp14/temp
mondoarchive -Oi -d /mnt/zip -g -B "mount /mnt/zip" -A "umount /mnt/zip" -s 100m
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -Ow -d 1,1,0
mondoarchive -S /tmp -T /tmp -Ow 1 -d /dev/scd1 -L -s 2220m -E "/web_disc /web_logs"
Verify an existing archive (16 is speed):
mondoarchive -Vc 16
mondoarchive -S /tmp -T /tmp -L -s 2220m -E "/web_disc /web_logs" -Oi -d /tmp/isos
cdrecord dev=1,1,0 -v blank=fast
cdrecord -dao -v dev=1,1,0 -data -eject 1.iso
Mount and view an ISO image:
mkdir /mnt/isoimage
mount -t iso9660 -o loop 1.iso /mnt/isoimage
information on MATSHITA DVD-RAM LF-D310
Panasonic LF-D311 IDE DVD-RAM/R
http://www.cdrinfo.com/hardware/panasonic-lfd311/page2.shtml
Burn Baby Burn - Setting up and burning DVD-Rs on your linux workstation
http://www.comet.ucar.edu/strc/wes/documents/dvd-r_setup.htm
If you are experiencing pop-ups generated by one of these malicious programs, you may want to remove the pop-up program from your computer. One program that attempts to detect and to uninstall pop-up programs is available at http://download.cnet.com/downloads/0-10106-108-63806.html. We have no relationship with the individuals who created this software and cannot vouch for it ourselves.
> HOW do I "set the sticky bit" of /tmp?
It is indicated by a t in the executable bit of the ls listing
drwxrwxrwt 6 root root 1024 May 28 00:04 /tmp
^ small `t' mean sticky and executable
and you set it chmod as usual.
chmod o+t /tmp
See the chmod man page for more information.
To enable plain-text passwords:
1. Start->Run.
2. Type regedit.
3. Add the DWORD value to the Registry entry EnablePlainTextPassword (reg Dword) 1 in the following Registry location:
Win98: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSETUP
WinNT: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters
NOTE: In the string "EnablePlainTextPassword"there are no spaces and case is important.
A system of simultaneous linear equations is written
Ax = b
where A is the coefficient matrix, b is the right hand side, and x is the solution. A is assumed to be a square matrix of order n, but some of the individual routines allow A to be rectangular. If there are several right hand sides, the system is
AX = B
where the columns of B are the individual right hand sides, and the columns of X are the corresponding solutions. The basic task is to compute X, given A and B.
djbdns is a DNS package by DJ Bernstein that consists of
From: werner@visaw.rus.uni-stuttgart.de (Andreas Werner)
Newsgroups: comp.sys.sgi.admin
Subject: Re: sshd
Date: 8 Apr 2000 19:42:51 GMT
Organization: Comp.Center (RUS), U of Stuttgart, FRG
there are lots of ways to do this, but the SGI typical way is:
1. Create a file /etc/init.d/sshd containing the following:
====================================
#! /bin/sh
#
# start up ssh server at boot
#
case "$1" in
'start')
if /sbin/chkconfig sshd ; then
if test -x /usr/local/sbin/sshd; then
/usr/local/sbin/sshd
fi
fi
;;
'stop')
/sbin/killall sshd sshd1
;;
*)
echo "usage: $0 {start|stop}"
;;
esac
#
====================================
2. Create two links:
# ln -s ../init.d/sshd /etc/rc0.d/K01sshd
# ln -s ../init.d/sshd /etc/rc2.d/S99sshd
3. Create a config variable:
# chkconfig -f sshd on
That's all, including the possibility to configure the daemon
on or off woth the 'chkconfig' command.
For the experts: Yes, I know that the 'killall' command will
kill user ssh daemons, too, but that's exactly the thing I want
when the machine shuts down ;-)
To: Exploit-Dev
Subject: Re: ssh-1.2.27 remote buffer overflow - exploitable
Date: Mon Nov 08 1999 21:24:17
Author: Daniel Jacobowitz
Message-ID: [19991109112417.A30046@drow.res.cmu.edu]
On Tue, Nov 09, 1999 at 01:48:53AM -0000, Frank wrote:
> This is submitted to the Freebsd bug tracking system, although there
> are doubtless other vendors who leave this package, despite the
> existence of the ssh-2.X. While Debian appears to be immune, I was
> able to crash my ssh daemon (much to my dismay), and there appears
> the potential to execute arbitrary code, as long as you encrypt it
> first...
>
> Here is the freebsd report.. it describes the method to crash a
> remote Ssh daemon (lets hope you ran sshd from your xinetd, etc).
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=14749
>
And here's a patch. Not tested, as I don't use the rsaref glue on any
machine here.
Dan
/--------------------------------\ /--------------------------------\
| Daniel Jacobowitz |__| SCS Class of 2002 |
| Debian GNU/Linux Developer __ Carnegie Mellon University |
| dan@debian.org | | dmj+@andrew.cmu.edu |
\--------------------------------/ \--------------------------------/
--- rsaglue.c.orig Tue Nov 9 11:12:32 1999
+++ rsaglue.c Tue Nov 9 11:17:58 1999
@@ -139,6 +139,10 @@
input_bits = mpz_sizeinbase(input, 2);
input_len = (input_bits + 7) / 8;
+ if(input_bits > MAX_RSA_MODULUS_BITS)
+ fatal("Attempted to encrypt a block too large (%d bits, %d max) (malicious?).",
+ input_bits, MAX_RSA_MODULUS_BITS);
+
gmp_to_rsaref(input_data, input_len, input);
rsaref_public_key(&public_key, key);
@@ -172,6 +176,10 @@
input_bits = mpz_sizeinbase(input, 2);
input_len = (input_bits + 7) / 8;
+ if(input_bits > MAX_RSA_MODULUS_BITS)
+ fatal("Received session key too long (%d bits, %d max) (malicious?).",
+ input_bits, MAX_RSA_MODULUS_BITS);
+
gmp_to_rsaref(input_data, input_len, input);
rsaref_private_key(&private_key, key);
So you can install the bzipped JDE, obtain bzip2 and install this extraction software.
Summary posted on the WGET Mailing List
SUMMARY:
Any strength encryption can be exported without a license to anybody
except governments in all countries but the terrorist 7 (Cuba, Iran,
Iraq, North Korea, Libya, Syria, Sudan).
"Government" is limited to entities performing governmental functions or
producing munitions.
"Retail" products can be exported to Governments without a license.
"Retail" products now include web-based products with equivalent
functionality to those you would traditionally consider to be retail
(generally available, and not easily morphed into something or so
complicated that you need a service agreement--but this standard
doesn't apply to web-based products, so long as the functionality is
equivalent)
Publically available source code can be downloaded without restriction
(you have to give the Bureau of Export Administration (BXA) the url),
but if you enter into an license to allow someone to commercially
develop a product based on the software AND you charge a royalty or
license fee, you have to report the name, address and description of
the intended product to BXA.
You can sell anything to ISPs and telcos without a license, and they
can provide services based on this to all entities except governments.
A license is required if the ISP or telco wants to provide a non-retail
service specific to government end-users.
There are certain review and reporting requirements, which should be
reviewed with the full text of the regulation at:
http://www.bxa.doc.gov/Encryption/pdfs/Crypto.pdf
Most companies implement a Reverse DNS check to see where the download
is coming from and compare that against a Restricted Countries and Parties
("terrorist" countries and known terrorists). This mechanism can certainly
be spoofed, but it is a best effort approach. Kinda silly in some cases,
but it is U.S. Export Law.
|
5.6. Can I use ssh to protect services like FTP or POP?If you want to avoid sending FTP passwords in cleartext over the net, you can use ssh to encrypt your command channel. This will still leave your data channel open to all attacks on TCP, and will not work through a firewall. You can either use ftpsshd by Per-Erik Martin at http://www.docs.uu.se/~pem/hacks/ for SSH1, or you can do this by hand. SSH1: Suppose you are on a host called myhost and want to initiate a ftp connection to ftphost. On myhost, you do myhost$ ssh -L 1234:ftphost.example.com:21 ssh-serverThis logs you on to ftphost and also forwards connections to 1234 on myhost to ftphost. Note: You need to use -g if you're forwarding to localhost (SSH1 only). Then, in another window, you do myhost$ ftp localhost 1234 220 ftphost FTP server (Foonix 08/15) ready. Name: (myhost:yourname): 331 Password required for yourname Password: 230 User yourname logged in.This works if the remote ftp daemon accepts PORT commands which specify a different host from the one the command channel appears to come from, and if the ftp client always uses PORT. This is true for vanilla UNIX ftp client and ftpd servers; it may not work for more advanced ftpds, such as wu-ftpd. For servers which do not accept this, you can see wether you ftp client supports passive mode, and wether the ftp server accepts PASV. Note, however, that unencrypted ftp data connections are still vulnerable to session hijacking and snooping. SSH2: Just use sftp instead. :-) For POP, Stephane Bortzmeyer (bortzmeyer@pasteur.fr) has written a script which protects the mail transfer and passwords ussing ssh. It requires no modification to existing POP servers or clients, and is available from ftp://ftp.internatif.org/pub/unix/gwpop/ . Or, you can use similar means for secure POP: myhost$ ssh -L 1234:popserver.example.com:110 ssh-server Other services could be secured by similar means.
5.7. Can I use ssh across a Socks firewall?
Socks 4 and 5 support should work in 1.2.16 or later. Socks support in version 2.0.11 and later should work.
|
Newsgroups: comp.security.unix Subject: Re: secure pop from sniffing From: [bglbv@my-deja.com] X-Newsreader: Gnus v5.7/Emacs 20.6 Date: 06 Jun 2000 20:29:54 +0100 "Bernd Dürrer" [duerrer@ika.ruhr-uni-bochum.de] writes: > "kukulkan" [isman@fsksm.utm.my] schrieb im Newsbeitrag > news:393C65B2.5A676C14@fsksm.utm.my... > > any software/methods to secure pop(esp. Eudora users) from being sniff?I > > have ssh here to protect remote login and file transfer, but still it > > has no meaning If I cannot have the pop to be secure .. > You want to use the port forwarding capabilities of SSH: Have a look at > http://www.employees.org/~satch/ssh/faq/ssh-faq-5.html#ss5.6 > > If this doesn't help you, please post what SSH implementation on what OS > your pop users are using. I don't think Eudora supports the SSH protocol at all. What it might support is: (a) APOP (Authenticated POP), which involves transmitting a (non-replayable) hash of the POP password and of a challenge sent by the POP server. The POP password is distinct from the password used for interactive logins. (b) POP over an SSL tunnel (to port 995 rather than 110). If I remember correctly, Eudora can do (a) but not (b), while Netscape Messenger can do (b) [but not (a)?]. It's probably wise to support both. And to make the POP passwords different from the login passwords in any case. Also make sure your POP server has no known security holes. (Some versions of Qpopper are to be avoided, for example.) |
From: eitz@weh.rwth-aachen.de (Holger Eitzenberger) Newsgroups: comp.security.unix Subject: Re: secure pop from sniffing Date: 7 Jun 2000 09:22:00 GMT Organization: RWTH Aachen Lines: 16 On Tue, 06 Jun 2000 10:45:06 +0800, isman@fsksm.utm.my (kukulkan) wrote: >any software/methods to secure pop(esp. Eudora users) from being sniff?I >have ssh here to protect remote login and file transfer, but still it >has no meaning If I cannot have the pop to be secure .. You may want to use APOP (authenticated POP3), which i use also. Both QPopper (on server side) and fetchmail (on client side) support it. APOP uses an encrypted one-time key to get mail. Holger -- + GnuPG Public Key -> finger eitz@jonathan.weh.rwth-aachen.de + |
|
Using APOP at NCSA - What is APOP?
|
http://www.cert.org/incident_notes/IN-99-01.html Automated Scanning and Exploitation http://www.cert.org/incident_notes/IN-98-06.html Probes with Spoofed IP Addresses http://www.cert.org/incident_notes/IN-98-05.html Advanced Scanning http://www.cert.org/incident_notes/IN-98.04.html New Tools Used for Widespread Scans http://www.cert.org/incident_notes/IN-98.02.html The most frequent reports involve well-known vulnerabilities in mountd, IMAP, and POP3. These services are installed and enabled by default in some operating systems. See the following advisories for more information: sunrpc (TCP port 111) and mountd (635) http://www.cert.org/advisories/CA-98.12.mountd.html IMAP (TCP port 143) http://www.cert.org/advisories/CA-98.09.imapd.html POP3 (TCP port 110) http://www.cert.org/advisories/CA-98.08.qpopper_vul.html
(23) telnet (53) dns (79) finger (80) web (110) pop (111) SunRPC & NFS (UDP and TCP) (143) imap (1080) socks (2049) nfs (UDP) (6000) X
From: Barry Margolin [barmar@bbnplanet.com] Newsgroups: comp.security.unix Subject: Re: Port Numbers List. Enjoy. In article [37de9d3b.528020403@news1.cal.metronet.ca], Jim Hutchison [Jim Hutchison] wrote: >There's a few posters wanting to know what services are associated >with certain port numbers. Here's a list I've been working with that >has been a great help. What's the Yes/No at the end of each line? >0 ICMP Click attack Yes ICMP doesn't have a port number, since it's not TCP or UDP. >19 UDP Chargen Yes >21 TCP Detects if someone is trying to FTP to you. No >23 TCP Detects if someone is trying to Telnet to you. No >53 TCP DNS Yes >129 TCP Password Generator Protocol Yes >137 TCP Netbios name (DoS attacks) Yes >138 TCP Netbios datagram (DoS attacks) Yes >139 TCP Netbios session (DoS attacks) Yes >555 TCP Stealth Spy - Beta 3 No >666 TCP Attack FTP No >1027 TCP ICQ Yes >1029 TCP ICQ Yes >1032 TCP ICQ Yes >1080 TCP Used to detect Wingate sniffers. Yes >1243 TCP Sub Seven (Also see TCP 6776 and TCP 6711) No >1981 TCP Shockrave No >2140 UDP Deep Throat No >2989 UDP Rat No >3150 UDP Deep Throat No >5000 2 TCP Detects & blocks Sokets de Trois v1. Yes >5001 TCP Detects & blocks Sokets de Trois v1. Yes >6711 TCP Sub Seven (Also see TCP 1243 and TCP 6776) No >6776 TCP Sub Seven (Also see TCP 1243 and TCP 6711) No >6969 TCP Gate Crasher No >7300 TCP Net Monitor No >7301 TCP Net Monitor No >10067 UDP Portal of Doom No >10167 UDP Portal of Doom No >12076 TCP GJamer No >12345 TCP Netbus No >12346 TCP Netbus No >20000 TCP Millennium No >20001 TCP Millennium No >21554 TCP GirlFriend No >23456 TCP EvilFTP No >30100 TCP NetSphere No >30102 TCP NetSphere No >31337 UDP Backorifice (BO) No >31337 TCP Netpatch No >31338 UDP Deep BO No >31785 TCP Hack'a'Tack No >31789 UDP Hack'a'Tack No >31791 UDP Hack'a'Tack No >40421 TCP Master's Paradise - Hacked No >40422 TCP Master's Paradise - Hacked No >40423 TCP Master's Paradise - Hacked No >40425 TCP Master's Paradise - Hacked No >50505 TCP Detects & blocks Sokets de Trois v2. No >54320 TCP Backorifice 2000 No >54321 UDP Backorifice 2000 No >65000 TCP Devil No
7777 Unreal, Klingon Honor Guard 22450 Sin 26000 Quake 26900 Hexen 2 26950 HexenWorld 27015 Half-life 27500 QuakeWorld 27910 Quake 2 28910 Heretic 2
"You can diagnose most memory leaks with Performance Monitor and several Microsoft Windows NT Server 4.0 Resource Kit utilities. (For a list of resource kit tools, see the sidebar "Resource Kit Tools for Diagnosing and Monitoring Memory Leaks.")"
The TNEF implementation defines several TNEF-specific attributes, each of which corresponds to a particular MAPI property. These attributes are used to encode their respective MAPI properties into the TNEF stream. In addition, a special attribute is defined that can be used to encapsulate any MAPI property that does not have a specific attribute corresponding to it. The reason these attributes are defined instead of simply using a uniform encoding method for all MAPI properties is to enable backward compatibility with non-MAPI-compliant software that is using TNEF such as Microsoft Mail 3.x and its transport providers.
The remainder of this appendix describes the structure and syntax of a TNEF stream, the mapping between MAPI properties and TNEF attributes, and important considerations for certain TNEF attributes."
12,248,097
The attacking Windows machines generate maximum-size 64k byte UDP packets, but only the first 1500 byte "fragment" of each packet carries the packet's port "666" destination. Therefore, for every identified "666" packet blocked, approximately 43 additional maximum-size "packet fragments" were also blocked. We therefore estimate that our filters running in Verio's router blocked at least 538,916,268 malicious packets that night.
May 17/18/19/20th - Attack 6. The exact dates and times are unknown because we were completely shielded by the configuration of Verio's router. But when we checked the router's "UDP/666" hit counter on the morning of Monday May 21st we found that the blocked "666" count had jumped from its previous value of 12,248,097 to a whopping 54,528,114 packets, leading us to conclude that the filters had weathered, by this time, at least :
2,399,237,016 malicious packets.
- nearly 2.4 BILLION malicious packets.
1. Thank God someone's finally exposing this charlatan
2. You both make good points, but we're still leaning in Steve's direction
3. Steve walks on water; you're a moron, and so's your old man
> Is there a way to completely fool (or block) OS detection from scanners (like nmap, queso, > etc.) using the Linux OS? What about Windoze? Under linux try iplog ( http://ojnk.sourceforge.net/ ) with -z as option. I've been using it for a while, and it works like a charm. Under windows, i have absolutely no idea.
If you describe your intermediate forms using Zephyr's Abstract Syntax Description Language (ASDL), we can generate data-structure definitions in C, C++, Java, Standard ML, and Haskell."
Adding Shortcuts to Windows 95
If you would like to add a shortcut to your program in the Start Menu,
you can use the undocumented API call that is used in the setupkit.
Declarations
You must declare the following in the declarations section of a project.
Declare Function fCreateShellLink Lib "STKIT432.DLL" _
(ByVal lpstrFolderName as String, ByVal lpstrLinkName _
as String, ByVal lpstrLinkPath as String, ByVal _
lpstrLinkArgs as String) As Long
Use
To add a shortcut to the Start Menu, you call the function with these parameters:
Where to place the link in relation to the Programs folder on the Start Menu.
Name or Text to appear in the link.
Path of the file to link to.
Arguments for the file.
For instance, to add a shortcut to the desktop, you would use the following code:
lngResult = fCreateShellLink("....Desktop", _
"Link to my program", "C:\Path\Program.exe","")
Tip by James Limm
Visual Basic
Adding shortcuts in Windows 95
It's easy to create your own shortcuts. The secret to creating shortcuts with Visual Basic
lies in this VB 4.0 setup kit declaration:
Declare Function fCreateShellLink _
Lib "STKIT432.DLL" _
(ByVal lpstrFolderName as String _
ByVal lpstrLinkName as String _
ByVal lpstrLinkPath as String _<
ByVal lpstrLinkArgs as String ) As Long
The first parameter asks where to place the link (shortcut) relative to
the Start menu's Programs folder. The second parameter is the name or
text to appear with the link. Next comes the file's path; the final
parameter handles any arguments. So, to place a shortcut on the desktop,
try this code:
iLong = fCreateShellLink("....Desktop", _
"My Link to Success", "C:PathSuccess.exe","")
"By utilizing the ITU-T T.128 compliant application sharing function, users can increase meaningful communication by collaborating on any shared X, Control Windows, and most Open GL applications as easily as if they were running the application natively. By sharing the actual application, users can easily see what others are doing without having to travel across town or to send a fax. Users need not have copies of the application on their machine in order to share it. The host opens the application, and other users view it on their screens simultaneously. The host may choose to give control to someone else in the conference. Changes made appear on everyone's monitors. Once the users are finished, they may save changes made in the session to the host's machine."
Dear Colleagues
I was alerted to this article by an article in "PC-Pro"
magazine, December edition page 251. The journalist drew attention
to this and a few other funny effects that occur, especially when
using Excel with Visual Basic programming. I imagine quite a lot
of people use Excel across CLRC - I do, so I will be somewhat more
sceptical of the results & check them somewhat more.
Here's the Reference & Abstract from Elsevier's website.
http://www.elsevier.nl/locate/csda
========================================================
Computational Statistics And Data Analysis Vol. 31 (1) pp. 27-37
Copyright (c) 1999 Elsevier Science B.V. All rights reserved.
"On the accuracy of statistical procedures
in Microsoft Excel 97"
B.D. McCullough, Berry Wilson
Federal Communications Commission,
445 12th St. SW Room 2C-134, ,
Washington, DC 20554, USA
Received 1 June 1998; Revised 1 December 1998
Abstract
The reliability of statistical procedures in Excel
are assessed in three areas: estimation (both
linear and nonlinear); random number generation;
and statistical distributions (e.g., for calculating
p -values). Excel's performance in all three areas
is found to be inadequate. Persons desiring to conduct
statistical analyses of data are advised not to use Excel.
===========================================================
(I did the highlighting)
Robert Paynter,
Energy Research Unit, RAL
Other Information
The "hit profile" of an adult-oriented site is amazingly different from any other kind of site. Because there are relentless, insatiable hordes of visitors, it is almost impossible to control the bandwidth requirements of such sites in a manner that will satisfy the visitors, the adult site customer, and our other customers. The peak hit frequency of some adult sites is extreme; even when access is blocked to restrict bandwidth, the impact on servers is more than noticeable."
"Aren't PCs just toy machines?"
"Any provider who tells you this has either never used an unrestricted Unix on the PC platform, or is trying to justify their misguided and unnecessarily expensive investment in inflexible "corporate mentality" equipment. When compared to commercial Unix vendor equipment that costs ten times as much, a properly configured PC-based server provides superior price/performance ratio, overall reliability, and spare parts availability. Don't be fooled by the legacy of DOS!"
From: Ole Michaelsen [omic+usenet@fys.ku.dk]
Newsgroups: comp.security.unix
Subject: Re: secure a user to his home directory and disable him from viewing anything outside his own directory
Date: 08 Jun 2000 20:08:34 +0200
Organization: University of Copenhagen
dwaynekuan@my-deja.com writes:
>
> how do i totally shut him down to his own home directory??
I found this on freshmeat. Maybe that's what you need?
Path: news.freshmeat.net!not-for-mail
Approved: scoop@freshmeat.net (Patrick Lenz)
Message-ID: [8hnrkf$9vo$2@mail.freshmeat.net]
NNTP-Posting-Host: freshmeat.net
NNTP-Posting-Date: 8 Jun 2000 10:13:35 GMT
Xref: news.freshmeat.net fm.announce.console:3910
application: Linux Intrusion Detection System 0.9.5a
author: Xie Hua Gang [xhg@gem.ncic.ac.cn]
license: GPL
category: Console/Firewall and Security
urgency: medium
homepage: http://freshmeat.net/redir/homepage/939982897/
download: http://freshmeat.net/redir/download/939982897/
description:
The Linux Intrusion Detection System is a patch which enhances the
kernel's security. When it is in effect, chosen files access, all
system/network administration operations, any capability use, raw
device, mem, and I/O access can be made impossible even for root. You
can define which program can access which file. It uses and extends the
system capabilities bounding set to control the whole system and adds
some network and filesystem security features to the kernel to enhance
the security. You can finely tune the security protections online, hide
sensitive processes, receive security alerts through the network, and
more.
Changes:
Transition to 2.2.16 kernel, bugfix for protecting mount point, bugfix
for port scanner detector in the kernel.
|> http://freshmeat.net/news/2000/06/08/960459276.html
Wouldn't something like making his shell be 'chroot sh -i $HOME' do the trick? [Please excuse me if I'm missing something obvious] -- Texas Imperial Software | Try WFTPD, the Windows FTP Server. Find us 1602 Harvest Moon Place | at web site http://www.wftpd.com or email Cedar Park TX 78613 | us at alun@texis.com. VISA / MC accepted. Fax +1 (512) 378 3246 | NT-based ISPs, be sure to read details of
> dwaynekuan@my-deja.com writes: > > > how do i totally shut him down to his own home directory?? man 2 chroot
From: clive@nsict.org (Clive Jones) Newsgroups: comp.security.unix Subject: Re: secure a user to his home directory and disable him from viewing anything outside his own directory Date: 9 Jun 2000 01:02:25 +0100 Organization: National Society for the Inversion of Cuddly Tigers In article [87em673j67.fsf@bglbv.my-deja.com], [bglbv@my-deja.com] wrote: >Yes, although the likelihood of unwittingly introducing a security >hole that makes it possible for the user to break out of the chroot >jail shouldn't be underestimated. That's not the only thing not to underestimate. Messing with chroot when you don't understand the implications fully can give people root expoits, not just a way out of the jail. An obvious example would be accidentally including su, login, or similar in their environment, when they can modify their personal version of /etc/passwd - but that's just the tip of the iceberg. --Clive.
Things get tricky for works that were in their first term when the law changed in 1978. Works copyrighted between January 1, 1950 and December 31, 1963 still had to be renewed in order to be protected for a second term. If renewed, the second term was extended to sixty-seven years, for a total of a ninety-five year term, see above.) If renewal was not applied for, the copyright protection ended on December 31 of the twenty eight year.
Works copyrighted between January 1, 1964 and December 31, 1977 were automatically renewed for a second term. Thus, no registration of the renewal was required."
APIC WORLDWIDE - Three Important Copyright Points
The United States affords protection to the authors of
certain original works as provided by the United States Code on Copyright.
In order to avoid the problems involved in copyright infringement it is
important to understand the fundamentals of copyright law. Three important
points are:
The notice of copyright
Just what does copyright protect
The duration of copyright
1. Notice Of Copyright
It is not necessary to attach a copyright notice to a work in order for
that work to be copyrighted. However, in order to be eligible for certain
damages in a lawsuit, the copyright notice must be attached.
A copyright notice should contain:
the symbol © (THE LETTER C IN A CIRCLE), or the word "Copyright" or the
abbreviation "Copr.", and; the year of first publication of the work, and;
the name of the owner of copyright in the work.
Example: ©1997 Jane Doe
2. What Types of Work Does Copyright Protect?
Copyright protects original works of expression. These works include:
literary
dramatic, including accompanying music
pantomimes and choreographic
pictorial, graphic and sculptural
motion pictures and other audiovisual
sound recordings, and
architectural
3. Duration of Copyright
Before 1978:
published: Copyright expires 75 years from the date of publication not
published: Copyright expires 12/31/02
1978 through present:
individually owned: life of author plus 50 years owned by employer of
author: 75 years from date of publication or 100 years from date of
creation, whichever occurs first.
Berne Convention
In 1989 the United States joined the Berne Convention for the Protection of
Literary and Artistic Works. The Berne Convention is an international
copyright treaty signed by 96 countries. The regulations are far more
stringent than United States copyright laws. The Berne Convention recently
extended the term of protection to the life of the author plus 75 years.
The United States law is expected to follow suit.
Fair Use
See 17 United States Code Section 107- Limitations on Exclusive Rights:
Fair Use- For certain purposes, such as criticism, comment, news reporting,
teaching (including multiple copies for classroom use), scholarship or
research, is not an infringement of copyright. In making this determination
of fair use these 4 factors must be considered: purpose and character of
use, whether of a commercial nature or for nonprofit
educational purposes;
the nature of the copyrighted work;
the amount and substantiality of the portion used
in relation to the copyrighted work as
a whole; and
the effect of the use upon the potential market
for or value of the copyrighted work.
Public Domain
Public domain is a legal term which refers to the end of term of copyright
and thereafter. You can be certain that you would never come across any
erotic photography on the web that would be considered public domain.
Remember, copyright begins with the creator of a work (a photo, an article,
etc.) and continues through that author's life plus 50 years. Only then is
that work in the "public domain". Anyone who simply puts up sites with
photos they grabbed elsewhere off the Internet is most certainly infringing
someone's copyrights. You can be certain that this includes all celebrity
images as well. A celebrity image with all applicable model releases would
allow the copyright owner economic freedom to sell or assign the rights to
that image.
The Public Domain is made up of all those works, that for whatever reason
are not protected by copyright Works in the Public Domain are free to use
without permission. These include:
originally non-copyrightable
expired copyright
authored by the Federal Government
specifically granted to the Public Domain
Australia outlaws e-mail forwarding
By: Thomas C Greene in Washington
Posted: 05/03/2001 at 08:10 GMT
Outrageously strict Internet copyright laws which have
just gone into effect throughout Australia make it illegal to forward an
e-mail memo without the author's permission, and could result in fines of
$60,000 or five years in the slam, according to a story by the Aussie
Sunday Telegraph.
"It's quite possible that the forwarding of an e-mail
could be a technical infringement of copyright," an unnamed legal advisor
to Oz Attorney General Daryl Williams told the paper.
"E-mailing is a 'communication' under the Digital
Agenda Act, and so is putting something up on a Web site," the source added.
This could rank as the world's most copyright-friendly and
common-sense-hostile piece of legislation yet devised. And that's not all:
Aussies recently revealed a widespread national neurosis by entertaining,
in the state of South Australia, an Internet censorship bill which would
criminalize the posting any material which cops deem offensive to children
- that's anything, anywhere.
The bill would require Net content to be child-friendly according to the
country's movie certification scheme; but, in a twist straight out of
Kafka, it's not possible for Webmasters to get their sites reviewed by the
relevant authority before they get busted.
Which is to say nothing of the lunacy of reducing
on-line discourse and dialogue to infant babble. Clearly, the Puritanical
delight in censoring impure thoughts and regulating the pleasure of others
has once again got out of control down under.
Over half a century ago the English writer Norman Douglas had occasion to
observe that "all mankind is at the mercy of a handful of neurotics".
So much for progress. ®
Aussie AG denies e-mail penalty, sort of
By: Thomas C Greene in Washington
Posted: 05/03/2001 at 16:50 GMT
We've been buried in reader responses, most originating in Australia,
pointing us to a statement in clear contradiction of a Sunday Telegraph
story indicating that Australia's new copyright regulations could result in
penalties for forwarding an e-mail memo, which we picked up here.
"Contrary to alarmist media reports, sharing e-mail is not banned by law,"
Australian Attorney General Daryl Williams says in a press release issued
Monday.
"Amendments to the Copyright Act that came into effect today do not ,outlaw
the practice of forwarding personal e-mails to other people. That would be
ridiculous," he observes.
A court would need to find that the contents of the e-mail were an
"original literary work", he adds. But while he decries media
sensationalism firmly enough, he doesn't quite deny the possibility that
forwarding e-mail can land one in hot water with the same finality.
"For example, if the e-mail was simply a joke that everyone had been
re-hashing for years, it is doubtful it would have the necessary
originality to be protected by copyright. Similarly, a casual exchange of
personal information or office gossip would probably not be original enough
to have copyright in it." (our emphasis)
That's not quite the same as saying that some doofus original limerick or
ode to precious bodily fluids as in the case of the now famous, possibly
bogus, Claire Swire e-mail could not be disputed in court.
One reader scolded us for repeating what we'd read in the papers. "The
Sunday Telegraph. A source for NEWS? Are you serious?!" they ask.
Well, we thought we were.... ®
> On 08 Jun 2000 12:17:06 +0200, Emmanuel Michon wrote: > > >Is it possible to get inside the local network without breaking the > >gateway security first? > > For one possibility (source routed packets) read > > http://www.robertgraham.com/pubs/firewall-seen.html#3.1 As far as I understand Linux is about sanely configured in this case, and has the following default settings: accept_source_route - BOOLEAN Accept packets with SRR option. (default TRUE) rp_filter - INTEGER 2 - do source validation by reversed path, as specified in RFC1812 Recommended option for single homed hosts and stub network routers. Could cause troubles for complicated (not loop free) networks running a slow unreliable protocol (sort of RIP), or using static routes. 1 - (DEFAULT) Weaker form of RP filtering: drop all the packets that look as sourced at a directly connected interface, but were input from another interface. 0 - No source validation. It seems that this setting is reasonable; but I could also disable definitely with accept_source_route=FALSE -- Emmanuel Michon
From: nick@webthing.com (Nick Kew)
Newsgroups: comp.security.unix
Subject: Re: One-to-many nat: can such a network be penetrated?
Date: Thu, 8 Jun 2000 13:31:13 +0000
Organization: The Holy Book of the Great Bludner
In article [7wbt1c1nq5.fsf@sdesigns.com],
Emmanuel Michon [emmanuel_michon@sdesigns.com] writes:
> let's consider a local network of computers with private addresses,
> let's say 172.15.0.0/255.255.0.0. Such addresses cannot be routed
> on the internet.
Methinks you got your address range wrong, but we'll let that pass.
> One of them acts as a gateway, with an ethernet 172.15.12.12 and
> also another network interface to the internet, with a public address.
> Is it possible to get inside the local network without breaking the
> gateway security first?
Somewhere on the 'net:
/sbin/route add -network [your.private.net] -gateway [your.public.address]
(or whatever the syntax for route on your OS may be)
Add a rule to block traffic arriving at the external interface for an
internal address.
--
Nick Kew
"Stallman was there to put them right. This is a man who treats copyright as damage and routes around it - as Nick Mailer from the Campaign for Unmetered Telecoms found out over lunch when Stallman roasted him for daring to use the non-open Zend PHP compiler, and told him that the only honourable thing to do was to sit down and write his own. For the man who started the GNU project, this probably seems reasonable, but the rest of us could only sit back in awe. "
The Net Authority Acceptable Internet Usage Guidelines (NA-AIUG) are based solely on the desirable morals of civilized society. Their basic effect is to simply organize and prioritize all that is blasphemous in the eyes of God. It is only natural for one of the tools of His creation to be adapted and molded into a form that He finds acceptable. Net Authority merely acts as a catalyst for that process."
For more information on our databases, please click here.
In these times of widespread chaos and blatant defiance of our Lord, we must work together. With our help and yours, the Internet can become a much safer, more enjoyable, and friendly environment to work in."
General Blasphemy
Registered General Blasphemy Offenders: 2801
The general blasphemy list contains information on people who have either read, distributed, or been involved in any way with blasphemic materials on the internet. General blasphemy is material that is considered evil when viewed through the eyes of God.
"``Why are we hiding from the police, daddy?'' ``They use Emacs, son, and we use vi.''
DragonLinux is small and compact in nature. The total file size is around 20 megabytes. If you need more utilities or applications that are not included in the distribution, simply grab them from the nearest internet site and install them!"
"Peer review often doesn't work (Score:3, Interesting)
by Anonymous Coward on Wednesday July 28, @09:17PM EDT (#107)
Back when I was in grad school, my research happened to make a notable contribution to a hot topic at the time. I was (usually with other authors)
submitting papers to IEEE journals at a rate of about 1 per 3-6 months. I also attended several conferences and got to know a lot of the major contributors in
my research area.
Typically, every submission got sent to 3 experts for review. My professor (and one of his collegues) even forwarded to me several papers they were asked to
review. I noticed a couple of things regarding peer review:
The second argument is that the CTEA falls foul of the US Constitution's guarantee of freedom of speech. A third road, not pressed before the Supreme Court, treats the CTEA as a violation of the judge-made "public trust" doctrine, which, in its narrowest form, holds that Congress cannot give away public lands and waters to private individuals.):
A: There is a problem with NT - it wouldn't boot from partitions above 2G. You have to place NT partition under 2G or make a small FAT-16 partition at the beginning of the disk where NT could put its boot files. Alternatively you may install a patch for FAT-16 boot sector that comes with Partition Manager version 2.38, which could boot NT from the partitions above 2G. For installation procedures, please, refer to readme.txt file that is included with version 2.38."
From: Henry Whincup
Cc: "freebsd-users@uk.freebsd.org"
Subject: Re: Installing in cylinder in > 1024
List-Archive: http://listserver.uk.freebsd.org/pipermail/freebsd-users/
Date: Wed, 28 Mar 2001 11:37:43 +0100 (BST)
This looks like it may help: From 'man boot0cfg':
--
-o options
A comma-separated string of any of the following options may be
specified (with ``no'' prepended as necessary):
packet Use the disk packet (BIOS Int 0x13 extensions) interface,
as as opposed to the legacy (CHS) interface, when doing
disk I/O. This allows booting above cylinder 1023, but
requires specific BIOS support. The default is `nopacket'.
--
However you can use grub if you prefer (I think there was an article on it
at http://www.daemonnews.org/).
As for 4.3 it is in the process of being released, so soon-ish!
cheers
Henry
File sharing applications such as KaZaA, Morpheus and Gnutella. Computers that have been broken into and then used to launch attacks. See http://www.cert.org/current for a list of currently active attacks that affect Microsoft Windows and Linux machines.
Streaming media servers.
Game servers.
These can all be legitimate uses of the network. However, total traffic is stressing our Internet capacity.
We are taking the following actions to manage performance:
Using measurement tools to detect computers that are using excessive amounts of Internet bandwidth for extended periods of time. For example, machines that are found to be using bandwidth of 2 Megabits per second or more over a 10-minute period are removed from the network and the responsible parties notified.
Continuing of "traffic shaping" of several popular file sharing applications across all network users at Columbia. This shaping began several months ago, and consists of limiting the bandwidth that is taken up by these applications. Since these applications use the TCP protocol, they automatically adjust to this limit by running a little more slowly.
Installing a faster Internet router. This new router will also facilitate more sophisticated traffic shaping than our current router is able to handle. It will also be able to handle extremely high numbers of packets (usually associated with Denial of Service attacks).
Continuing to monitor and analyze performance.
What you can do to help:
If you use a popular file-sharing application such as KaZaA, Morpheus, Gnutella, etc., please be considerate of others on the network and make the necessary configuration changes to:
1. Not share files from your computer. Don't be a KaZaA supernode.
2. Limit the bandwidth of your file sharing and/or the number of connections to your machine.
3. Similarly, media and game servers should be throttled in such a way that they do not consume inordinate amounts of bandwidth.
Please keep in mind that there are potential legal ramifications to sharing copyrighted materials such as music and videos.
You may want to add the "-u" option to ls to see last-accessed times rather than last-modified times (esp to help gauge how harmful it would be to unsetuid the file).
The US National Aeronautics and Space Administration (NASA)
has taken delivery of a desktop-sized supercomputer which draws no
more power than a hair dryer, based on Field Programmable Gate Array
(FPGA) technology instead of a CPU.
FPGA chips can reconfigure themselves thousands of times a second,
making it possible for numerous applications to run simultaneously. This
setup simply leapfrogs over Moore's Law, yielding a desktop box with
1000 times the power of one running on a CPU.
The power boost comes from the ability of an FPGA array to maximize
the use of transistors. A CPU is designed to handle many different sorts
of tasks, so only a fraction of its transistors is in use at any given time.
An FPGA array, by contrast, can dedicate as many of its transistors as
needed for a task on the fly.
config.cache should always be removed if you have changed the CC, CXX, CFLAGS or CXXFLAGS environment vars."
Also see the WAI HTML Techniques and CSS Techniques documents.
Some users report that when they use Change Case to change the filenames to upper case, Windows Explorer shows filename with an initial capital and the rest is lower case after this change. In fact, this is NOT a bug of Change Case. This is a problem of Windows. If the length of folder/file name is less than or equal to 8 and the folder/file name is in upper case, Windows Explorer will display it with an initial capital. But if you use DIR command in MS-DOS prompt or in Netscape Navigator or FTP clients, you will see the filename is really upper case. This is designed by Windows.
Change Case is a CARDWARE. If you are using the program, please send a postcard to
Hai Li
No. 1607 Unit 133
Beijing Institute of Technology
Beijing 100081
PR China
Newsgroup: comp.os.ms-windows.networking.win95 In article [3403e909.767220765@harrogateX51], we heard from "jegan@shipway.u-net.com (James Egan)", who said: >IMHO an important requirement is to be able to force lowercase in >filenames. Win95 tends to mix and match upper and lower case which can >cause unneccessary problems on unix machines. Before anyone else gets confused, let's note that Unix also uses mixed upper and lower case. Or at least, Unix users often do. The difference is that Unix requires you to access the file with the same case that it was originally created. Win95 doesn't care what case you use, and will happily read file "README.TXT" when it is asked for "readme.txt" - Unix will simply insist the file does not exist. The Unix method is known as Case Sensitive, and the Windows method is Case Preserving. It's only a matter of convention that most users will give their file names in lower case on Unix machines. And it's a matter of poor programming that even telling a Windows NT command-line FTP client "put filename.dat filename.dat" may result in a file on the remote machine called "FILENAME.DAT". Alun. ~~~~ --- Texas Imperial Software | Try WFTPD, the Windows FTP Server. 1602 Harvest Moon Place | Available at the web site Cedar Park TX 78613 | http://www.wftpd.com Fax +1 (512) 378 3246 | or email me at alun@texis.com Phone +1 (512) 257 2578 | Now accepting credit card orders! =================================================================== ***** WFTPD Pro, an NT Service FTP Server supporting multiple ***** ** simultaneous virtual hosts, is now available for $80 per copy **
CARDWARE to Bill Klein 6950 Fielding, Apt 606 Montreal, Quebec H4V 1P7 Canada
An excerpt from e:\winnt\system32\drivers\etc\hosts: 127.0.0.1 ad.doubleclick.net That line prevents the DoubleClick ads from loading, and so prevents me from clicking the ads, as well as preventing my computer from having to load the ads.
ALL: ALL: spawn ((/bin/echo -n "user = %u\nclient = %h\nserver = %H\nprocess = %d\nPID = %p\ndate = "; /bin/date) | /bin/mail -s "Unauthorized access" root &)
Certainly, Wietse's rpcbind is an excellent choice for tightening up the portmapper. However, I'd have to ask why any RPC services are required on a web server -- I'm assuming that it's open to the outside world to access. I'd recommend going through every active network port and eliminating those that are not _essential_ to running the web server, at a minimum. YMMV. Cheers, Ken Kenneth R. van Wyk Vice President, Chief Technology Officer Para-Protect Services, Inc. krvw@para-protect.com http://www.para-protect.com
From: "Derrick Young" [derrick.young@washingtondc.ncr.com] Newsgroups: comp.security.unix Subject: Re: Restrict ROOT logon Date: Wed, 29 Sep 1999 15:18:48 -0400 look in /etc/default - there should be a file /etc/default/login - there should be an entry #console=/dev/console If you remove the comment (#) from this line and save the file then you will limit the root login to the console. Note, you will be able to su to root from any session - but not from the login prompt.
Here's a modified copy of the original ruleset using the
quick keyword:
block in quick all
pass in all
In this case, IPF looks at the first rule:
block in quick all
The packet matches and the search is over. The packet is
expunged without a peep. There are no notices, no logs, no
memorial service. Cake will not be served.
3.2. Implicit Allow; The "keep state" Rule
The job of your firewall is to prevent unwanted traffic
getting to point B from point A. We have general rules
which say "as long as this packet is to port 23, it's okay."
We have general rules which say "as long as this packet has
its FIN flag set, it's okay." Our firewalls don't know the
beginning, middle, or end of any TCP/UDP/ICMP session. They
merely have vague rules that are applied to all packets.
We're left to hope that the packet with its FIN flag set
isn't really a FIN scan, mapping our services. We hope that
the packet to port 23 isn't an attempted hijack of our tel-
net session. What if there was a way to identify and autho-
rize individual TCP/UDP/ICMP sessions and distinguish them
from port scanners and DoS attacks? There is a way, it's
called keeping state.
We want convenience and security in one. Lots of peo-
ple do, that's why Ciscos have an "established" clause that
lets established tcp sessions go through. Ipfw has estab-
lished. Ipfwadm has setup/established. They all have this
feature, but the name is very misleading. When we first saw
it, we thought it meant our packet filter was keeping track
of what was going on, that it knew if a connection was
really established or not. The fact is, they're all taking
the packet's word for it from a part of the packet anybody
can lie about. They read the TCP packet's flags section and
there's the reason UDP/ICMP don't work with it, they have no
such thing. Anybody who can create a packet with bogus
flags can get by a firewall with this setup.
Where does IPF come in to play here, you ask? Well,
unlike the other firewalls, IPF really can keep track of
whether or not a connection is established. And it'll do it
with TCP, UDP and ICMP, not just TCP. Ipf calls it keeping
state. The keyword for the ruleset is keep state.
9.1. Localhost Filtering
A long time ago at a university far, far away, Weitse
Venema created the tcp-wrapper package, and ever since, it's
been used to add a layer of protection to network services
all over the world. This is good. But, tcp-wrappers have
flaws. For starters, they only protect TCP services, as the
name suggests. Also, unless you run your service from
inetd, or you have specifically compiled it with libwrap and
the appropriate hooks, your service isn't protected. This
leaves gigantic holes in your host security. We can plug
these up by using ipf on the local host. For example, my
laptop often gets plugged into or dialed into networks that
I don't specifically trust, and so, I use the following rule
set:
pass in quick on lo0 all
pass out quick on lo0 all
block in log all
block out all
pass in quick proto tcp from any to any port = 113 flags S keep state
pass in quick proto tcp from any to any port = 22 flags S keep state
pass in quick proto tcp from any port = 20 to any port 39999 >< 45000 flags S keep state
pass out quick proto icmp from any to any keep state
pass out quick proto tcp/udp from any to any keep state keep frags
It's been like that for quite a while, and I haven't suf-
fered any pain or anguish as a result of having ipf loaded
up all the time. If I wanted to tighten it up more, I could
switch to using the NAT ftp proxy and I could add in some
rules to prevent spoofing. But even as it stands now, this
box is far more restrictive about what it presents to the
local network and beyond than the typical host does. This
is a good thing if you happen to run a machine that allows a
lot of users on it, and you want to make sure one of them
doesn't happen to start up a service they wern't supposed
to. It won't stop a malicious hacker with root access from
adjusting your ipf rules and starting a service anyway, but
it will keep the "honest" folks honest, and your weird ser-
vices safe, cozy and warm even on a malicious LAN. A big
win, in my opinion. Using local host filtering in addition
to a somewhat less-restrictive "main firewall" machine can
solve many performance issues as well as political night-
mares like "Why doesn't ICQ work?" and "Why can't I put a
web server on my own workstation! It's MY WORKSTATION!!"
Another very big win. Who says you can't have security and
convienence at the same time?
"Man pages for the portmapper say you can stuff "-A" or "-a 255.255.255.0,my.net.work.0" to only allow RPC from these places (the first means "my networks"); I've tried this, but it didn't do anything -- that is, I could still tickle anything RPC-ish from anywhere."
> *** A fragmentation attack against IP Filter *** > > April 6th, 2001 > > Thomas Lopatic> > The research for this advisory was supported by > > TUV data protect GmbH, > a TUV Rheinland/Berlin-Brandenburg affiliate > > >Summary >------- > >The current release (3.4.16) of Darren Reed's IP Filter package >contains a flaw in the fragment handling code. This vulnerability >enables an attacker who has access to a single UDP or TCP port on a >host protected by an IP Filter firewall to obtain access to any other >UDP or TCP port on the same host. > >Although this flaw is based on problems handling fragments, it can >still be exploited even if the rule-base explicitly blocks all >fragmented packets. > >It seems that this problem has been buried in the source code for >quite a while. Thus it is likely that several older releases of IP >Filter are also vulnerable. However, the only version that I have >looked at in addition to 3.4.16 is the release included in the OpenBSD >2.8 distribution (3.3.18), which is also vulnerable. > > >Details >------- > >When IP Filter evaluates the rule-base for an IP fragment and decides >whether to pass it or block it, this decision is saved in a "decision >cache" together with the fragment's IP ID, protocol number, source >address and destination address fields. > >Before any received fragment is passed through the rule-base, the >decision cache is searched for a matching entry, i.e. an entry in >which the IP ID, protocol number, source address, and destination >address fields match the corresponding fields of the fragment. > >If a matching entry is found, the cached decision is applied to the >received fragment. Otherwise the fragment is passed through the >rule-base. > >In this way the same decision is applied to all fragments belonging to >the same original unfragmented packet. > >The cache entry is discarded after a timeout period. But an >optimization is implemented for the common case of receiving all >fragments in order, i.e. from the leading offset-0 fragment to the >last fragment with a cleared IP_MF bit. If all fragments are received >in order, the cache entry is discarded after IP Filter has seen the >last fragment. > >Let us assume that we can only access port 80/TCP on a host behind an >IP Filter firewall and all other ports are blocked. However, we know >that the host also runs an FTP server that we could compromise because >we have spotted a giraffe in its code. We would therefore like to gain >access to port 21/TCP. Hence, we patch Dug Song's fragrouter 1.6 and >start doing a bit of packet mangling. > >For each TCP packet A that we send to port 21 and that we would like >to sneak through the firewall, we create a TCP packet B by making a >copy of A - i.e. we copy A's IP header, TCP header, and TCP payload - >and changing the destination port in B's TCP header to 80. If sent, >packet B would be passed by the firewall (in contrast to packet A), >because traffic to port 80/TCP is allowed by the rule-base. > >We then split B into three fragments B1, B2, and B3, keeping B's >original IP header and only adjusting the offset and length fields. In >the canonical case, these fragments would be sent in order, IP Filter >would see B1, go through the rule-base, find the rule that allows >traffic to port 80/TCP, pass B1 because it is an offset-0 fragment and >the contained TCP header fields match this rule, cache the "pass" >decision, receive B2, apply the cached decision to B2, receive B3, >apply the cached decision to B3, and discard the cache entry after >having processed B3. > >Now there is a way to make IP Filter not only pass B1, B2, and B3 - >i.e. apply the decision cached for B1 to B2 and B3 - but also apply >the cached "pass" decision to A. Which is convenient for our purpose >of obtaining access to port 21/TCP. > >Note that the created fragments B1, B2, and B3 contain the same >fragment ID, protocol number, source address and destination address >as A. Remember that B's IP header is an exact copy of A's IP header >and that the fragments' IP headers differ from B's IP header only in >their length and offset fields. > >We fragment B in the following way. If B's TCP payload is less than 13 >bytes, we pad it with null bytes. > >Fragment Offset Length IP_MF Payload >------------------------------------------------------------------------ >B1 0 24 1 B's TCP header, i.e. A's TCP > header + destination port = 80 > bytes 0 to 3 of B's TCP payload > >B2 24 8 1 bytes 4 to 11 of B's TCP payload > >B3 32 depends 0 rest of B's TCP payload > on B (at least one byte) > >First we send B1. IP Filter will consider the rule-base, pass the >fragment, and cache this "pass" decision. > >We then send B3 and B2 out of order, i.e. we send B3 before B2. The >cache entry created for B1 matches each fragment and the cached "pass" >decision is looked up and used in both cases. However, the >optimization for in-order fragments mentioned above does not apply and >the cached "pass" decision is still kept for a while. In the meantime >the destination host reassembles B1, B2, and B3. > >We now send packet A. Since A has the same IP ID, source address, >destination address, and protocol number as the fragments, the cache >entry created for B1 also matches A and the cached "pass" decision is >applied to A as well. Thus, IP Filter passes A, although it is >directed to port 21/TCP and should have been blocked according to the >rule-base. > >Looking at the IP Filter source code, we see that A does not need to >be fragmented to make IP Filter search its decision cache for a match, >which saves us some work in exploiting this vulnerability. > >The attack as described up to here can be prevented by adding a >filtering rule along the lines of > > block in quick all with frag > >which blocks all fragmented IP traffic. However, before considering >the rule-base, IP Filter searches its state-table for a connection >entry matching the received packet. On a match, IP Filter passes the >packet without touching the rule-base. > >Therefore, we just send B before sending B1, B2, and B3. Receiving B, >IP Filter creates an entry in the state-table representing a >connection from our computer to the open port on the host that we are >attacking, i.e. port 80 to cling to our example. > >Since B1 contains a full TCP header and we address B1 to the same port >as B, B1 is also passed because a matching connection entry in the >state-table has already been created by the non-fragmented packet >B. The rule-base is ignored as is the "block with frag" rule. > >Passing B1, however, leads to this "pass" decision being cached, >because B1 is a fragment. This in turn allows us to pass B3, B2, and A >through the filter. > >As can be seen the attack still applies even if all fragments are >blocked by a filtering rule. > >If we did not care about the fragments awaiting reassembly in the >victim host, we could skip the steps of sending B2 and B3 and just >send B1. The effect of IP Filter passing traffic to blocked ports >would be identical. > >Thanks to John McDonald of NAI's COVERT Labs for pointing out the full >implications of the vulnerability to me. > > >Fix information >--------------- > >I sent an early version of this advisory to Darren and he created an >updated release of the IP Filter package, which is available from the >IP Filter homepage at http://coombs.anu.edu.au/~avalon. > >Users of ThomasBSD 1.0 might want to upgrade their installation to >ThomasBSD 1.1 by applying the following patch.
The following rule-sets are provided as a simple example to minimize
exposure on an IRIX host with one network interface.
#
# Accept packets with a loopback source address only if they
# come over the loopback interface.
accept -i localhost src=127.0.0.1
reject src=127.0.0.1
#
# Accept all packets originating from this trusted network.
accept (src&0xFFFFFF00)=123.45.67.0
#
# Reject spoofed packets from private address space which
# should not be used on the Internet according to RFC 1918.
reject (src&0xFF000000)=10.0.0.0
reject (src&0xFFFF0000)=192.168.0.0
reject (src&0xFFF00000)=172.16.0.0
#
#
# Allow RIP broadcasts if running gated/routed.
accept udp.dport=520
#
# Allow DNS replies from the name servers
# This is required for host name resolution to work.
accept udp.sport=53 and ip.src=192.26.210.1
accept udp.sport=53 and ip.src=205.151.69.200
#
# Explicitly reject all UDP packets not accepted above
reject udp
#
#
#
#
# Allow only connections to httpd, sshd and telnetd.
# Other services defined in /etc/services or by using
# their respective port numbers can be added here.
accept tcp.dport=telnet
accept tcp.dport=22
accept tcp.dport=http
#
# Allow all TCP packets related to outgoing connections.
# The most efficient way of accomplishing this is to
# accept all TCP packets which don't have the SYN flag set.
accept tcp and not(tcp.flags=SYN)
#
# Explicitly reject all tcp packets not accepted above
reject tcp
#
#
# Deny ICMP time-stamps requests in order to prevent
# remote hosts from querying the local time.
# Do not use if your host is a time server.
reject icmp.type=TSTAMP
#
# Accept all other types of ICMP packets.
accept icmp
#
# Explicitly Deny everything else (default behavior).
reject (src&0)=0
From: l.cranswick@dl.ac.uk (Lachlan Cranswick) Newsgroups: comp.sys.sgi.admin Subject: Re: How Secure is IRIX O2 6.5.3 Mountd??? Date: Sat, 22 May 1999 20:11:21 LOCAL Organization: Daresbury Laboratory, UK "Molte excellanto!" (as they say in the Latin) Using the pmap_dump approach works well and the portmapper is now refusing to consider requests from non-authorised machines (probing if files exist, etc). (though authorized machines can still probe around for files using the mount command) pmap_dump within ftp://ftp.porcupine.org/pub/security/portmap_4.tar.gz To see rejected requests in the SYSLOG file, I put the -v (verbose) option in the /etc/config/portmap.options -------- > pmap_dump > stuff > /sbin/killall portmap > /usr/etc/portmap `cat /etc/config/portmap.options` > pmap_set < stuff Lachlan. ======== [following post Re: does portmap read the config file on startup] (Please forgive laziness on my part: Script to load portmap in /etc/init.d/network - and loads the /etc/config/portmap.options explicitely Lachlan. In article <7i6jnu$97o$1@niri.ncsa.uiuc.edu> slevy@ncsa.uiuc.edu (Stuart Levy) writes: >In article, >Lachlan Cranswick wrote: > [...] >>Another one from the ministry of silly questions - the man page for portmap >>mentions it reads the /etc/config/portmap.option during system >>initialisation. By what command can you get it to reread it again >>without all the servers it is using having to be restarted as well? >Well -- you *could* pick up & compile Wietse Venema's "portmap" replacement. >Needn't install his portmap variant, but the package includes programs >pmap_dump and pmap_set for saving and re-loading the list of registered >services. So you'd say > pmap_dump > stuff > /sbin/killall portmap > /usr/etc/portmap `cat /etc/config/portmap.options` > pmap_set < stuff >and get all the service registrations back without having to reboot. >(Disclaimer: I haven't actually tried this with SGI's portmap, only with >Venema's on Irix 6.3 and earlier, a while back. But it should work on >any portmap, I think.) > Stuart Levy, slevy@ncsa.uiuc.edu
rpcinfo -p machinename.domain rpcinfo: can't contact portmapper: rpcinfo: RPC: Authentication error; why = Failed (unspecified error)
On Wed, 18 Aug 1999 11:14:16 +0200, tetu wrote: >Got an O2 with IRIX 6.3. >ec0 was 10 Mb/s half-duplex. > >I find in PROM Monitor how to have 100 Mb/s (setenv ec0mode 100), but >not full-duplex. > >How to have full-duplex? In prom monitor, "setenv -p ec0mode F100", then reboot.
ifconfig ec0 debug Unplug/replug network cable, and check console and SYSLOG. ifconfig ec0 -debug Alexis Cousein al@brussels.sgi.com Systems Engineer SGI Belgium
From: roberson@ibd.nrc.ca (Walter Roberson) Newsgroups: comp.sys.sgi.admin Subject: Re: domain name Date: 4 Oct 2000 23:03:41 GMT Organization: National Research Council Canada In article [E0OC5.49$iY1.1437@sodalite.nbnet.nb.ca], Bailey Campbell [bcampbell@imagictv.com] wrote: :I have 6.5.7 installed on a SGI Origin 200 machine. How do I set the domain :name? I recommend doing all of the following: 1) Use a fully-qualified host name in /etc/sys_id to start with. Some people disagree with me on this point, but I have seen too much software that -just- looks at the output of 'hostname' (which gets the information from /etc/sys_id) and then fails to work properly. 2) On the /etc/hosts line that matches the IP address for the host, make sure that the fully-qualified version of the hostname is the *first* hostname on the line. If you have other aliases for the host, put them later on the same line. This is more important than the sys_id ! Note that whatever you have in your /etc/sys_id, your /etc/hosts line should have at least one name that is *exactly* the same. For example, if your /etc/sys_id contains sodalite and your /etc/hosts line says 123.45.54.21 sodalite.nbnet.nb.ca then the system will NOT know that the two names are the same: you would need 123.45.54.21 sodalite.nbnet.nb.ca sodalite to clue it in. 3) Add a 'domain' statement in /etc/resolv.conf that gives the domain name.
Your system doesn't have a reasonable amount of memory for starters. I'd
at least double it. To see what system resources you are using, I suggest
creating a file ~/.grosview with the following in it:
cpu strip
rmem strip
wait strip
pswap strip
gfx strip
Then execute `gr_osview'. Also use the command `swap -l' to see how much
swap you are using.
--
Brent L. Bates (UNIX Sys. Admin.) Phone:(757) 864-2854
M.S. 912 Phone:(757) 865-1400, x204
NASA Langley Research Center FAX:(757) 865-8177
Hampton, Virginia 23681-0001
Email: B.L.BATES@larc.nasa.gov http://www.vigyan.com/~blbates/
you can decyper which bus and id your device is on as follows: sys-sgi 106% hinv
S/KEY and OPIE. S/Key -- This one-time password system from Bellcore provides authentication over insecure networks. It’s designed to defeat eavesdroppers "listening" for login name and password transmittals. The user's secret password never crosses the network during login or when executing other commands requiring authentication such as the UNIX passwd or su commands. No secret information is stored anywhere, including the host being protected, and the underlying algorithm is public knowledge. The remote end of this system can run on any locally available computer, including PC’s and Mac’s. RFC 1938 is based on Bellcore's S/KEY implementation. Note that OPIE is a replacement for S/Key with additional security enhancements. For more information: ftp://thumper.bellcore.com/pub/nmh/docs/skey.txt To download: ftp://thumper.bellcore.com/pub/nmh/ OPIE (One Time Passwords in Everything), an S/Key derivative (the name was changed to avoid trademark infringement) developed by the US Naval Research Laboratory (NRL) and other institutions over the past few years. Per the README file included with the distribution: "OPIE is derived in part from the BSD Unix software developed at UC Berkeley, in part from the S/Key (TM) software developed at Bell Communications Research (Bellcore), and also includes enhancements developed at NRL." OPIE implements the IETF One-Time Passwords (OTP) standard as per RFC 1938.