December 2003 - Legacy - lists.gtalug.org

C programming question
by wildberger-iRg7kjdsKiH3fQ9qLvQP4Q＠public.gmane.org 21 Dec '03

21 Dec '03

I got interesting replies to my question on how to access physical memory. In summary: Yes, it can be done. No, it cannot be done. It is difficult. It is not easy. What comes to my mind is: "Das gefingerpoken in den Gewerken is not for Dummkopfen and is verboten." :-) Well, this certainly applies to me, and therefore I will have to reconsider my approach to trying to understand the intricacies of the Linux kernel. Thanks to all you good folks in helping to give advice. John -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

VPN question (ssh)
by james.knott-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 21 Dec '03

21 Dec '03

Justin Zygmont wrote: >>On December 20, 2003 07:00 pm, Fraser Campbell wrote: >> >> >>> If you care about your traffic being private at all some encryption just >>>makes sense ... encryption can be at the app layer (ssh, https, secure >>>imap, etc.), at the network layer (vpn) or at both the app and network >>>layer. >> >>Also encryption doesn't stop people from being dumb. For example allowing >>password based authentication with sshd leaves a rather weak link in the >>chain (depending on users to use good passwords), IWO if you use strong >>encryption with weak authentication you might as well not bother. > > > but the password is encrypted in transfer right? maybe i'm wrong about > this, but doesn't ssh use asymetric encryption initially, then symetric > after the session key is established? The problem with weak passwords, is that they're vulnerable to dictionary or social engineering attacks. For example, if you use your kid's name, someone who knows you, may try that first. On the other hand, if you were to use a sequence of characters generated by md5sum, that password would be resistant to those types of attacks. One method to reduce the risk of weak passwords, is to allow a fixed number of wrong passwords, before locking the account. The account can be locked for a period of time or until reset by the admin. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

VPN question
by james.knott-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 21 Dec '03

21 Dec '03

Justin Zygmont wrote: > On Sat, 20 Dec 2003, Fraser Campbell wrote: >>If by bringing up phone lines you're meaning the old argument of cable being >>shared versus DSL not being shared then I don't agree that any distinction >>needs to be made in that respect ... either way you're connecting to the >>share network known as the Internet. Also, last I had Rogers, it appears >>that my cable connection was switched (I only saw my own traffic and >>broadcast traffic. > > > I see, that clears things up quite a bit. Further on this. Those point of sale terminals, where you use your debit or credit cards, use encryption, even on dial up phones. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

VPN question
by james.knott-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 21 Dec '03

21 Dec '03

Justin Zygmont wrote: > On Sat, 20 Dec 2003, Fraser Campbell wrote: >>If by bringing up phone lines you're meaning the old argument of cable being >>shared versus DSL not being shared then I don't agree that any distinction >>needs to be made in that respect ... either way you're connecting to the >>share network known as the Internet. Also, last I had Rogers, it appears >>that my cable connection was switched (I only saw my own traffic and >>broadcast traffic. > > > I see, that clears things up quite a bit. Further on this. Those point of sale terminals, where you use your debit or credit cards, use encryption, even on dial up phones. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

anti-spam spam...
by davidjpatrick-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 21 Dec '03

21 Dec '03

Tom Legrady wrote: > I was astounded yesterday, to receive a "Nigerian" style email from > India .... > > Those darned Indians ... first they take our shoe factory jobs, then > they take our programming jobs, they've replaced our MDs, now they're > moving in on nigerian swindlers. And you thought MS was a threat to > world peace! Are you familiar with the concept of "spam-baiting" ? The best laugh I've had in a while was the result of a visit to www.419eaters.com That such an email originated from India would only add an hilarious twist ! cheers, djp -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

2 1

VPN question (ssh)
by fraser-Txk5XLRqZ6CsTnJN9+BGXg＠public.gmane.org 21 Dec '03

21 Dec '03

On December 21, 2003 03:50 am, you wrote: > > Also encryption doesn't stop people from being dumb. For example > > allowing password based authentication with sshd leaves a rather weak > > link in the chain (depending on users to use good passwords), IWO if you > > use strong encryption with weak authentication you might as well not > > bother. > > but the password is encrypted in transfer right? maybe i'm wrong about > this, but doesn't ssh use asymetric encryption initially, then symetric > after the session key is established? Yes, your username and password are encrypted in transit. My point was that if you allow password authentication and your root password is g0d, all the encryption in the world cannot protect you. Better to make the authentication barrier a lot higher ... require key based authentication, ensure that all private keys are passphrase protected, don't allow root login unless it's essential, restrict access to ssh by ip if it doesn't cause too much heartache, etc. Another example would be with VPNs. Let's say Justin Inc. installed a VPN, employees gotta have access from home after all! Now your poor employees can't handle installing X.509 certificates, it's too much work for you to manage them and ahh who cares it's all encrypted anyway. So in the interest of keeping things simple you setup pre-shared key authentication with a pre-shared key of "justin's vpn" ... you've now created a solution where the data is secure in transit but very insecure in other ways. Authentication barrier is low, guesswork can potentially lead an attacker to full vpn access to your network. Secure webservers are another example. image a "secure" webserver that allows telnet access from all over the Internet, that stores credit cards in an unencrypted form in a database, etc. Sure the data in transit is tough to get at but the data at rest is easy pickings. Anyway, now I'm rambling about stuff that likely had nothing to do with your original question, time to go fishing :-) -- Fraser Campbell <fraser-Txk5XLRqZ6CsTnJN9+BGXg at public.gmane.org> http://www.wehave.net/ Georgetown, Ontario, Canada Debian GNU/Linux -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

When will the persecution of MS *end*?!
by scotta-cpI+UMyWUv9BDgjK7y7TUQ＠public.gmane.org 21 Dec '03

21 Dec '03

On Sat Dec 20,2003 10:27:35 AM David J Patrick wrote: > I used Stacker on my zip100 work disks. Now I have data trapped untill > the day when I set up a Win3.1 box and install the Stacker4 disks I > found at Goodwill. > That day is a long way off, but I guard the floppies that constitute > the shred of hope > that someday I'll get those files back ! If you haven't already, you would be wise to make duplicates of those floppies, and also burn images of them to a CD-ROM. Floppies lose their magnetism over time and thus have a shelf life of ~10-20 years. They may no longer read when you get around to trying to use them. You should do the same with the zip100 disks. -- ** Scott Allen scotta-cpI+UMyWUv9BDgjK7y7TUQ at public.gmane.org ** ** Toronto, Ontario, Canada ** -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

VPN question (ssh)
by jzygmont-tEQKYFGiemxAYG7eUwYNkWD2FQJk+8+b＠public.gmane.org 21 Dec '03

21 Dec '03

> On December 20, 2003 07:00 pm, Fraser Campbell wrote: > > > If you care about your traffic being private at all some encryption just > > makes sense ... encryption can be at the app layer (ssh, https, secure > > imap, etc.), at the network layer (vpn) or at both the app and network > > layer. > > Also encryption doesn't stop people from being dumb. For example allowing > password based authentication with sshd leaves a rather weak link in the > chain (depending on users to use good passwords), IWO if you use strong > encryption with weak authentication you might as well not bother. but the password is encrypted in transfer right? maybe i'm wrong about this, but doesn't ssh use asymetric encryption initially, then symetric after the session key is established? -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

VPN question
by jzygmont-tEQKYFGiemxAYG7eUwYNkWD2FQJk+8+b＠public.gmane.org 21 Dec '03

21 Dec '03

On Sat, 20 Dec 2003, Fraser Campbell wrote: > On December 20, 2003 01:15 am, Justin Zygmont wrote: > > > Just a thought about VPN's and a hope to get back on topic to fun linux > > things, I was wondering if anyone knows why an encrypted VPN is so > > important using a phone line when it's usually just a point to point link > > with no chance of interception? > > If you're talking about a private phone line dialed onto a private network > then I think you have to be doing some pretty serious data pushing to worry > about encryption ... if you're sending credit card numbers, tax records or > business secrets -- and if it's possible that someone would know that you're > doing it and find value in the information -- then it's probably worth > encrypting for the little overhead involved (cpu utilization for vpn-type > encryption at modem speeds would be a pittance). If your phone line usage is > sporadic and doesn't involve much sensitive information then I wouldn't see > the value in encryption (though I suppose with such low overhead, why not?). > > If however you're phone line is connecting to the Internet then encryption > becomes more important. Let's say your data travels through 10 different > networks (pretty common) to get to it's destination, anyone with admin access > (or at least wire access) can potentially intercept your traffic. If you > care about your traffic being private at all some encryption just makes sense > ... encryption can be at the app layer (ssh, https, secure imap, etc.), at > the network layer (vpn) or at both the app and network layer. > > If by bringing up phone lines you're meaning the old argument of cable being > shared versus DSL not being shared then I don't agree that any distinction > needs to be made in that respect ... either way you're connecting to the > share network known as the Internet. Also, last I had Rogers, it appears > that my cable connection was switched (I only saw my own traffic and > broadcast traffic. I see, that clears things up quite a bit. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

LF smaller distro to use as foundation to build a custom server onto
by robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy＠public.gmane.org 20 Dec '03

20 Dec '03

On Sun, 21 Dec 2003, Fraser Campbell wrote: > Debian starts at less than 100MB, how much more than that figure you end > up at depends on the development libraries you will install. When building a server I normally start with a base Debian Stable install and skip both tasksel (low granularity task selection) and dselect (high granularity task selection) and just apt-get exactly what the box needs. The extensive dependency tree built into apt handles it all nicely. Rob -- Robert Brockway B.Sc. email: robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org, zzbrock at uqconnect.net Linux counter project ID #16440 (http://counter.li.org) "The earth is but one country and mankind its citizens" -Baha'u'llah -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0