December 2003 - Legacy - lists.gtalug.org

Debian attacker may have used new exploit
by robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy＠public.gmane.org 02 Dec '03

02 Dec '03

On Wed, 3 Dec 2003, Chris Keelan wrote: > They've /always/ taken security seriously. The wisest approach to Here here. The Debian people take security very seriously. This is evident all over the distribution. Rob -- Robert Brockway B.Sc. email: robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org, zzbrock at uqconnect.net Linux counter project ID #16440 (http://counter.li.org) "The earth is but one country and mankind its citizens" -Baha'u'llah -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Sendmail for smtp routing..
by jerome-mhXWc29+iYPyG1zEObXtfA＠public.gmane.org 02 Dec '03

02 Dec '03

hi, would it be possible to route all mails to a different mail server whos recipient belongs to mydomain.com only.. TIA, -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by cbbrowne-HInyCGIudOg＠public.gmane.org 02 Dec '03

02 Dec '03

> what I don;t understand about this, is how could they know that this was > the exploit the hacker used, what if there is something else? The attacker left some binaries lying around, and an analysis of their contents showed up code pointing at that particular exploit. It is, of course, conceivable that the attacker might have used some other unknown mechanism, and left the binaries around to mislead them into believing that particular attack was used. But that is rather like finding your home burgled, and, seeing normal burglary tools lying around, assuming that it was, instead, black-ops NSA agents trying to make it LOOK like an ordinary burglary. Forgive me if I were to wonder, in such a case, if you were not just a little bit off your rocker... -- let name="cbbrowne" and tld="ntlug.org" in name ^ "@" ^ tld;; http://www3.sympatico.ca/cbbrowne/spreadsheets.html Rules of the Evil Overlord #96. "My door mechanisms will be designed so that blasting the control panel on the outside seals the door and blasting the control panel on the inside opens the door, not vice versa." <http://www.eviloverlord.com/> -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by rufmetal-MwcKTmeKVNQ＠public.gmane.org 02 Dec '03

02 Dec '03

On Tue, 2 Dec 2003 18:01:31 -0500 (EST) Justin Zygmont <jzygmont-tEQKYFGiemxAYG7eUwYNkWD2FQJk+8+b at public.gmane.org> wrote: > I guess they're going to take security a bit more seriously now? hehe Read the Debian Investigation Report After Server Compromises at <http://linuxtoday.com/security/2003120202726SCDBSV>. They've /always/ taken security seriously. The wisest approach to is to assume that you're going to get 0wn3d and plan accordingly. Ask yourself: if this were a certain proprietary company, would this news leak out so quickly, and would said organization publish a detailed post-mortem as soon as one is available? I think that Debian getting 0wn3d demonstrates not only that the FS community is committed to security but that this commitment actually pays off. ~ C -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Encrypted filesystems?
by linux-cOjNTMaGA5U＠public.gmane.org 02 Dec '03

02 Dec '03

On Tue, Dec 02, 2003 at 01:54:49PM -0500, Thomas Gibson wrote: > Just curious if anyone on the list knows what's > available(, has had experience, etc) WRT encrypted > filesystems under Linux? I see some older stuff on > the web related to TCFS but was not able to find > anything current. I am looking for a solution in > which all encryption is done in the client. I use loop-aes. http://loop-aes.sf.net/ It's good for swap, as well as for filesystems. - Ian -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

2 1

SMC Cable/DSL 4port router
by james.knott-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 02 Dec '03

02 Dec '03

Madison Kelly wrote: > > Back when those routers first came out SMC was really the only one on > the market and thus I sold a number of them. A -lot- of them later > failed. I switched to using Linksys (now Cisco) and I haven't had a > single failure yet. > > Madison A friend of mine has an SMC Barricade. It's been running well for a couple of years. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

SMC Cable/DSL 4port router
by james.knott-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 02 Dec '03

02 Dec '03

Tim Writer wrote: > James Knott <james.knott-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> writes: > > >>Terry Tanski wrote: >> >>>Hi all, >>>Anyone have any comments on the SMC Cable/DSL 4port router (SMC7004VBR)? >>>How does it compare to the DLINK (604) or the LinkSys (SR41)? Does it have >>>half-decent firewall capabilities? >> >>>Terry >> >>I have the wireless version of that. It seems to be OK. What capabilities >>were you looking for? > > > Well, I worked on the wireless version for a while and was not at all > impressed. The firewalling capabilities are only applicable to the Internet > connection, i.e. you cannot firewall your wireless LAN from your traditional > LAN. You can use MAC based ACLs to prevent wireless users from going out to > the Internet but you can't stop them from accessing your wired LAN. You can > also restrict wireless traffic but you can't implement a deny by default > policy, i.e. you cannot deny everything except the few services you want to > allow, you can only deny specific services. > > The bottom line: as long as you're not using wireless and you're using NAT, > it will give you a basic level of protection simply due to the use of private > IPs with NAT. IOW, it's okay for a simple home setting but I wouldn't use it > in a business setting. > I've got mine between my Linux firewall and cable modem. This way, the only way into my home network, is via CIPE VPN or SSH. Anyone wanting to access the internet will have to get past the 124 (actually 104) bit WEP, and yes I'm aware of it's weakness. It would be nice if you could turn around the firewall part of it, so that you could filter the wireless and plug the WAN side into the local network. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by jzygmont-tEQKYFGiemxAYG7eUwYNkWD2FQJk+8+b＠public.gmane.org 02 Dec '03

02 Dec '03

I guess they're going to take security a bit more seriously now? hehe On Tue, 2 Dec 2003, Robert Brockway wrote: > On Tue, 2 Dec 2003, Justin Zygmont wrote: > > > what I don;t understand about this, is how could they know that this was > > the exploit the hacker used, what if there is something else? > > I believe the attacker left some clues such as binaries lying around and > these were reverse engineered, revealing the exploit. I understand the > Redhat & Suse security teams worked with the Debian developers on this > one. > > It isn't impossible that there is another exploit but I consider it > unlikely. Occam's Razor suggests it is likely only one exploit was used. > If I leave the front door open and the back door open a burglar will > probably only enter through one of them. The burglar may not even > discover the other is open. > > There might be other exploits on the Debian servers but that is as likely > to be the case as on any other box. A properly patched box shouldn't have > any known security problems. > > Rob > > -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

SOT: shitfs in spam trends and topics
by jzygmont-tEQKYFGiemxAYG7eUwYNkWD2FQJk+8+b＠public.gmane.org 02 Dec '03

02 Dec '03

I was toying with an ICQ bot the other night, it would answer the same questions with different answers, I was hoping I could hack it and find a way to take control of it. Anyone know if that's possible? I mean there has to be a way of controlling it. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Encrypted filesystems?
by cbbrowne-HInyCGIudOg＠public.gmane.org 02 Dec '03

02 Dec '03

> Just curious if anyone on the list knows what's > available(, has had experience, etc) WRT encrypted > filesystems under Linux? I see some older stuff on > the web related to TCFS but was not able to find > anything current. I am looking for a solution in > which all encryption is done in the client. I use CFS, which is fairly widely available in packaged form, which "plays" as an NFS server. It's a bit slow, but it is pretty portable, requiring no kernel mods, which strikes me as a win. -- (format nil "~S@~S" "aa454" "freenet.carleton.ca") http://cbbrowne.com/info/linuxxian.html "You can only examine 10 levels of pushdown, because that's all the fingers you have to stick in the listing." -- Anonymous programmer - "TOPS-10 Crash Analysis Guide" -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0