Also Refer:
From: Vik BajajNewsgroups: sci.techniques.xtallography Subject: Re: STX: Securing Crystallographic computers from electronic intruders/hackers?? - Deception Toolkit (http://www.all.net/dtk/)?? Date: 11 Nov 1998 21:40:21 GMT Organization: Science and Technology Wing Xref: daresbury sci.techniques.xtallography:5136 Lachlan Cranswick wrote: > The program consists of both a TCP-Wrapper - and Perl scripts > that emulate fack buggy deamons/services on un-used ports. > The strategy being to disable as many un-needed network services > as possible and put as many fake deamon scripts up as feasible. > (and the TCP Wrappers on used services). (On a network, this > would be installed on as many computers as possible). This is a generally bad idea; there are far better ways to do intrusion detection! Installing fake daemons may provide some limited information, but it also opens up your system to a host of attacks. A better solution is to secure your system and utilize a comprehensive intrusion detection and management system. At the network-level, this implies control and logging of connections and connect attempt; at the host leve, it implies binary checksums and distributed system event logging. Crystallography labs are becoming well-known targets for script hackers as of late.
> HOW do I "set the sticky bit" of /tmp?
It is indicated by a t in the executable bit of the ls listing
drwxrwxrwt 6 root root 1024 May 28 00:04 /tmp
^ small `t' mean sticky and executable
and you set it chmod as usual.
chmod o+t /tmp
See the chmod man page for more information.
http://www.cert.org/incident_notes/IN-99-01.html Automated Scanning and Exploitation http://www.cert.org/incident_notes/IN-98-06.html Probes with Spoofed IP Addresses http://www.cert.org/incident_notes/IN-98-05.html Advanced Scanning http://www.cert.org/incident_notes/IN-98.04.html New Tools Used for Widespread Scans http://www.cert.org/incident_notes/IN-98.02.html The most frequent reports involve well-known vulnerabilities in mountd, IMAP, and POP3. These services are installed and enabled by default in some operating systems. See the following advisories for more information: sunrpc (TCP port 111) and mountd (635) http://www.cert.org/advisories/CA-98.12.mountd.html IMAP (TCP port 143) http://www.cert.org/advisories/CA-98.09.imapd.html POP3 (TCP port 110) http://www.cert.org/advisories/CA-98.08.qpopper_vul.html
(23) telnet (53) dns (79) finger (80) web (110) pop (111) SunRPC & NFS (UDP and TCP) (143) imap (1080) socks (2049) nfs (UDP) (6000) X
You may want to add the "-u" option to ls to see last-accessed times rather than last-modified times (esp to help gauge how harmful it would be to unsetuid the file).
Some users report that when they use Change Case to change the filenames to upper case, Windows Explorer shows filename with an initial capital and the rest is lower case after this change. In fact, this is NOT a bug of Change Case. This is a problem of Windows. If the length of folder/file name is less than or equal to 8 and the folder/file name is in upper case, Windows Explorer will display it with an initial capital. But if you use DIR command in MS-DOS prompt or in Netscape Navigator or FTP clients, you will see the filename is really upper case. This is designed by Windows.
Change Case is a CARDWARE. If you are using the program, please send a postcard to
Hai Li
No. 1607 Unit 133
Beijing Institute of Technology
Beijing 100081
PR China
Newsgroup: comp.os.ms-windows.networking.win95 In article [3403e909.767220765@harrogateX51], we heard from "jegan@shipway.u-net.com (James Egan)", who said: >IMHO an important requirement is to be able to force lowercase in >filenames. Win95 tends to mix and match upper and lower case which can >cause unneccessary problems on unix machines. Before anyone else gets confused, let's note that Unix also uses mixed upper and lower case. Or at least, Unix users often do. The difference is that Unix requires you to access the file with the same case that it was originally created. Win95 doesn't care what case you use, and will happily read file "README.TXT" when it is asked for "readme.txt" - Unix will simply insist the file does not exist. The Unix method is known as Case Sensitive, and the Windows method is Case Preserving. It's only a matter of convention that most users will give their file names in lower case on Unix machines. And it's a matter of poor programming that even telling a Windows NT command-line FTP client "put filename.dat filename.dat" may result in a file on the remote machine called "FILENAME.DAT". Alun. ~~~~ --- Texas Imperial Software | Try WFTPD, the Windows FTP Server. 1602 Harvest Moon Place | Available at the web site Cedar Park TX 78613 | http://www.wftpd.com Fax +1 (512) 378 3246 | or email me at alun@texis.com Phone +1 (512) 257 2578 | Now accepting credit card orders! =================================================================== ***** WFTPD Pro, an NT Service FTP Server supporting multiple ***** ** simultaneous virtual hosts, is now available for $80 per copy **
CARDWARE to Bill Klein 7907 Wavell Rd. Cote St. Luc Quebec, Canada H4W-1M1
ALL: ALL: spawn ((/bin/echo -n "user = %u\nclient = %h\nserver = %H\nprocess = %d\nPID = %p\ndate = "; /bin/date) | /bin/mail -s "Unauthorized access" root &)
Certainly, Wietse's rpcbind is an excellent choice for tightening up the portmapper. However, I'd have to ask why any RPC services are required on a web server -- I'm assuming that it's open to the outside world to access. I'd recommend going through every active network port and eliminating those that are not _essential_ to running the web server, at a minimum. YMMV. Cheers, Ken Kenneth R. van Wyk Vice President, Chief Technology Officer Para-Protect Services, Inc. krvw@para-protect.com http://www.para-protect.com
"Man pages for the portmapper say you can stuff "-A" or "-a 255.255.255.0,my.net.work.0" to only allow RPC from these places (the first means "my networks"); I've tried this, but it didn't do anything -- that is, I could still tickle anything RPC-ish from anywhere."
From: l.cranswick@dl.ac.uk (Lachlan Cranswick) Newsgroups: comp.sys.sgi.admin Subject: Re: How Secure is IRIX O2 6.5.3 Mountd??? Date: Sat, 22 May 1999 20:11:21 LOCAL Organization: Daresbury Laboratory, UK "Molte excellanto!" (as they say in the Latin) Using the pmap_dump approach works well and the portmapper is now refusing to consider requests from non-authorised machines (probing if files exist, etc). (though authorized machines can still probe around for files using the mount command) pmap_dump within ftp://ftp.porcupine.org/pub/security/portmap_4.tar.gz To see rejected requests in the SYSLOG file, I put the -v (verbose) option in the /etc/config/portmap.options -------- > pmap_dump > stuff > /sbin/killall portmap > /usr/etc/portmap `cat /etc/config/portmap.options` > pmap_set < stuff Lachlan. ======== [following post Re: does portmap read the config file on startup] (Please forgive laziness on my part: Script to load portmap in /etc/init.d/network - and loads the /etc/config/portmap.options explicitely Lachlan. In article <7i6jnu$97o$1@niri.ncsa.uiuc.edu> slevy@ncsa.uiuc.edu (Stuart Levy) writes: >In article, >Lachlan Cranswick wrote: > [...] >>Another one from the ministry of silly questions - the man page for portmap >>mentions it reads the /etc/config/portmap.option during system >>initialisation. By what command can you get it to reread it again >>without all the servers it is using having to be restarted as well? >Well -- you *could* pick up & compile Wietse Venema's "portmap" replacement. >Needn't install his portmap variant, but the package includes programs >pmap_dump and pmap_set for saving and re-loading the list of registered >services. So you'd say > pmap_dump > stuff > /sbin/killall portmap > /usr/etc/portmap `cat /etc/config/portmap.options` > pmap_set < stuff >and get all the service registrations back without having to reboot. >(Disclaimer: I haven't actually tried this with SGI's portmap, only with >Venema's on Irix 6.3 and earlier, a while back. But it should work on >any portmap, I think.) > Stuart Levy, slevy@ncsa.uiuc.edu
rpcinfo -p machinename.domain rpcinfo: can't contact portmapper: rpcinfo: RPC: Authentication error; why = Failed (unspecified error)
S/KEY and OPIE. S/Key -- This one-time password system from Bellcore provides authentication over insecure networks. It’s designed to defeat eavesdroppers "listening" for login name and password transmittals. The user's secret password never crosses the network during login or when executing other commands requiring authentication such as the UNIX passwd or su commands. No secret information is stored anywhere, including the host being protected, and the underlying algorithm is public knowledge. The remote end of this system can run on any locally available computer, including PC’s and Mac’s. RFC 1938 is based on Bellcore's S/KEY implementation. Note that OPIE is a replacement for S/Key with additional security enhancements. For more information: ftp://thumper.bellcore.com/pub/nmh/docs/skey.txt To download: ftp://thumper.bellcore.com/pub/nmh/ OPIE (One Time Passwords in Everything), an S/Key derivative (the name was changed to avoid trademark infringement) developed by the US Naval Research Laboratory (NRL) and other institutions over the past few years. Per the README file included with the distribution: "OPIE is derived in part from the BSD Unix software developed at UC Berkeley, in part from the S/Key (TM) software developed at Bell Communications Research (Bellcore), and also includes enhancements developed at NRL." OPIE implements the IETF One-Time Passwords (OTP) standard as per RFC 1938.
Level 1 ISO-9660 defines names to be the familiar 8+3 convention that
MS-DOS users have suffered through for many years: eight characters for the
name, a period ("full stop" for those of you in the U.K.), followed by
three characters for the file type, all in upper case. The only allowed
characters are A-Z, 0-9, '.', and '_'. There's also a file version number,
separated from the name by a semicolon, but it's usually ignored.
24. Can you give a short explaination of ISO-9660?
ISO-9660 is an international standard that defines a filesystem for
CD-ROMs. Almost all systems support ISO-9660.
Level one ISO-9660 is similar to an MS-DOS filesystem. Filenames are
limited to eight single-case characters, a dot, and a three character
extension. Filenames cannot contain special characters, (no hyphens,
tildes, equals, or pluses). Only single case letters, numbers, and
underscores. Directory names cannot have the three digit extension,
just eight single-case characters.
All alphabetics are in UPPER case; some software maps this to lower case.
Either the file name or the extension may be empty, but not both ("F."
and ".E" are both legal file names).
There is a "File Version Number" which can range from 1-32767, and is
separated from the extension by a semi-colon. The file version number
is ignored on many systems.
Here are some examples of legal and illegal filenames:
Legal Illegal Why
TEST_1C.TXT TEST-1C.TXT hyphen
TEST1C.TXT TEST 1C.TXT space
TEST.1C TEST.1C.TXT more than 1 period
README Readme not single case
Subdirectories are allowed to nest up to eight levels deep.
Level two ISO-9660 allows longer filenames, up to 32 characters.
But many of the other restrictions still apply. Level two discs
are not usable on some systems, particularly MS-DOS.
"Or you can get the GNU tar program (1.12) and just use it like:
tar --rsh-command=/usr/sbin/ssh --tape-length=(length of tape in bytes) \
-cvpMf host:/dev/st0 /"
"Tar throughput over a network can be greatly increased using: ftp://src.doc.ic.ac.uk/packages/buffer/ I use a buffer at end of the network socket: tar ... | buffer | ssh host buffer -oAlso, use a fastest encryption method, which in 1.2.26 is blowfish, for backups."
Among the products that support this rapid deployment method are Symantec's Norton Ghost, Altiris' RapiDeploy and Micro House International's ImageCast.
Deploying Windows NT Workstation 4.0 with this method can take minutes per PC - much faster than typical operating system upgrades, which take several hours to install. Using the system preparation tool can translate into substantial cost savings for customers.
The Microsoft system preparation tool for Windows NT Workstation 4.0 is available free of charge to Microsoft customers that have a current Microsoft Select or Enterprise Agreement."
From: "Andrew" grof@home.com Newsgroups: comp.infosystems.www.servers.unix,comp.infosystems.www.servers.misc Subject: Re: Log file rotation - what a nightmare with Apache :-( Date: Thu, 06 May 1999 12:35:23 GMT Try this, it works: mv /path/to/old/log/file /path/to/new/log/file touch /path/to/new/log/file kill -HUP [pid of apache] the last line can be done using the file that contains the pid of apache... eg. kill -HUP `cat /path/to/httpd.pid` or if you wanted, you could grep through your ps aux (althogh the previous is better) kill -HUP `ps aux | grep httpd | tail -1` Oh the power! :) You can get past without HUP'ing Apache... It is needed. It shouldn't hurt you. If you have problems restarting than it is likely your .conf files are screwed and you would have had problems down the line anyways. Fix 'em now while you can. Good luck with it! Andrew
#! /usr/local/bin/bash HTTPD_LOGS_DIR=/opt/httpd/logs # path to httpd log dir HTTPD_PID=/opt/httpd/logs/httpd.pid # path to httpd pid YYMMDD=`/usr/bin/date +%Y%m%d` cd $HTTPD_LOGS_DIR mv -f access_log access_log.$YYMMDD mv -f error_log error_log.$YYMMDD kill -USR1 `cat $HTTPD_PID` sleep 15 gzip -9f access_log.$YYMMDD error_log.$YYMMDD
Hi Lachlan, I now have a foolproof (?) way to prevent caching. Adding a random parameter to the URL will always fetch it again eg http..../icsd/tmp/myFile.wrl?$RANDOM is the same as: http..../icsd/tmp/myFile.wrl - except the former is not cached if $RANDOM is a random string eg a number generated by perl: srand(); $RANDOM=substr(rand(99),0,2); #2 digit random no. Alan Hewat, ILL Grenoble, FRANCEtel (33) 4.76.20.72.13 ftp://ftp.ill.fr/pub/dif fax (33) 4.76.20.76.48 http://www.ill.fr/dif/
From: "Joshua Slive" <slive+news@finance.commerce.ubc.ca> Newsgroups: comp.infosystems.www.servers.unix Subject: Re: Apache Redirect/ReWrite for redirecting old->new domains? Date: 7 Jul 1999 17:21:47 GMT Organization: The University of British Columbia Frampton Steve R <3srf@qlink.queensu.ca> wrote: > Hello: > I'm having some difficulty getting Apache to redirect page requests with > an informative message. My place of employment is moving from their old > domain name to a new one. We now have both of these domain names active, > both of which point to the same server. Although we will be phasing out > the old address very soon, people continue accessing the pages at the old > address, hence the reason for the redirect. > Putting something like <META HTTP-EQUIV="refresh" > "CONTENT=05;URL=http://newdomain.com/newpage"> in all our pages is not > an optimal solution because (a) there are hundreds of pages that would > need to be updated, (b) this solution doesn't display an informative > message before the redirect, and (c) Apache provides a better solution. I think that your syntax is a little off. Check the Apache docs for the relevant directives. What I would do is something like RewriteEngine On RewriteRule ^/~test/(.*) /redirector.shtml/$1 Then configure /redirector.shtml as an SSI parsed document looking something like <HTML> <HEAD><TITLE>This page has moved</TITLE> <META HTTP-EQUIV="refresh" CONTENT="05;URL=http://newdomain.com/~test/<!--#echo var="PATH_INFO" -->"> <BODY> <H1>This page has moved</H1> <P>The new location is <A HREF="http://newdomain.com/~test/<!--#echo var="PATH_INFO" -->">here</A>. You will be redirected automatically in 5 seconds. Please update your bookmarks. </BODY> </HTML> This is completely untested, and probably has errors, but it should get you started. You could also use a cgi script instead of the SSI
mark@knm.org wrote: > I have several virtual hosts which I would like to share the same > directory, but instead of pointing to index.html I would like to have > different index pages for each. > What you want is this <VirtualHost www.ford.com> ... DocumentRoot /usr/local/webpages DirectoryIndex ford_index.html </VirtualHost> <VirtualHost www.chevy.com> ... DocumentRoot /usr/local/webpages DirectoryIndex chevy_index.html </VirtualHost> Note this chenges the index.html default to the supplied one in all the subdirectories in your document tree as well, but only for the virtual host in question. The Pilgrim
Subject: Re: Firewall positioning CERT paper on firewall security issues and best practices. http://www.cert.org/security-improvement/modules/m08.html Contrary to some answers you may have received: a) never leave a web server where it is not protected (in front of a firewall) b) do not allow inbound connections through a firewall to your internal network (unless you are a security expert and know the risks or you have it checked by a security expert) c) so that leaves you with 1 primary option: get a single firewall and use 3 interfaces: 1 to your internal network, 1 to a DMZ (a semi-secure area that is designed for serving inbound requests) and 1 to the Internet. ..more complex answers are available but require in-depth knowledge of the situation and the expertise to evaluate the options...
My personal preference (may not be available or may be different
of various unix-flavors, YMMV) is:
route add -blackhole 62.2.252.230 127.0.0.1
And *any* packets from the offendee are simply dropped by the kernel.
Or, if it is in your purview, similarly at your firewall or router.
Apache with SSL or with the mod_ssl package, and with the "put" module
seems to work fine for me.
Add mod_ssl mod_ssl-2.2.6-1.3.6.tar.gz from
http://www.engelschall.com/sw/mod_ssl
Use
configure --with-apache=[apache-srcdir]
Carefully generate SSL certificates, including an unsigned certificate
for starting Apache correctly.
The man pages should be linked from /usr/local/apache/man to
/usr/local/man.
Add apache-contrib-1.0.4 from
http://www.apache.org/dist/contrib/modules/1.3/
Use
make all install APXS=/usr/local/apache/bin/apxs
Then edit your httpd.conf appropriately to enable the PUT module only
in SSL or HTTPS mode.
From: lars@hyperreal.org (Lars Eilebrecht) Newsgroups: comp.infosystems.www.servers.unix,linux.redhat.rpm,linux.redhat.misc,comp.os.linux.networking Subject: Re: Apache-SSL, mod_ssl, and RedHat Secure Web Server Date: Tue, 27 Apr 1999 23:05:20 +0200 My recommendation: mod_ssl, because it has more features and is easier to install.
#!/sbin/sh
#
# /etc/init.d/ssh
PATH=/usr/bin:/bin
SSHD=/usr/local/sbin/sshd
case $1 in
'start')
echo "Starting sshd...\c"
if [ -x $SSHD ]; then
$SSHD
echo "done."
else
echo "sshd not found."
fi
;;
'stop')
pid=`/usr/bin/ps -eo pid,comm | /usr/bin/awk '{ if ($2 == $SSHD) print $1 }'`
if test "$pid"
then
kill $pid
fi
;;
*)
echo "usage: /etc/init.d/ssh {start|stop}"
;;
esac
/etc/rc2.d/S98ssh'.
--------------------------------------------------
#! /bin/sh
#
# start the ssh deamon
# Start the ssh deamon
if [ -f /etc/sshd ] ; then
echo "starting ssh daemon"
/etc/sshd -b 1024
fi
This is probably old news, but I found no mention of it on ssh's website or in the 1.2.26 code tree. Under IRIX 6.4 and 6.5 a non-root user can't ssh in. ssh -v on the client side and sshd -d on the server reveal the problem to be a failed call to setprid() (at least, that's what the debug message said). I tracked this down to code within the #ifdef HAV_SGI_PROJ_H section of sshd.c (quoted below). In my case, the real error is because setprid is never called, because naccts = 0. A later if-test tests err for zero-ness, but because the variable was never initialized, this test succeeds, generating the debug message and bailing out. This all has to do with the fact that IRIX 6.x uses a system of projects to keep track of user activity on systems with billable accounts. The system is managed with /etc/project and /etc/projid, roughly equivalent to /etc/passwd and /etc/group. My IRIX machines use NIS accounts, so I haven't put any entries in these files. Because they're empty, naccts = 0. The real problem here is a basic one: the author assumed that the err variable would autmatically be initialized to zero upon declaration. Even with gcc, this isn't true under IRIX 6.x. When I changed line 3676 of sshd.c from "int err;" to "int err = 0;", the login worked." ..... "I edited the sshd.c and changed the err variable definition to include an initialization to zero (ie. 'int err = 0;'). Compiled it, tested it, worked fine. Moral of the story: don't trust uninitialized variables. I'm kinda surprised the ssh guys let this through."
In article [l.cranswick.287.0BB3D43D@dl.ac.uk],
Lachlan Cranswick [l.cranswick@dl.ac.uk] wrote:
>What Network Promiscuous Mode Ethernet Detector software/programs
>are available to try and sus out if anyone is sniffing?
There is no one perfect way to detect promiscuous interfaces on remote hosts-
the 'neped.c' uses a trick to 'sus out' certain versions of Linux, but that
won't find a 'passive' sniffer (cut the transmit leads on the NIC).
You'd be better served buying _good_ ethernet switches and putting any
hosts that are at all a risk on their own switched port, then you
no longer have to worry about passive sniffing. To be really safe,
DO NOT ASSIGN AN IP ADDRESS TO THE SWITCH. Use the console RS-232 port only.
>I have found one but the ftp address it refers to has disappeared.
>"NEtwork Promiscuous Ethernet Detector" (neped.c)
> ftp://apostols.org/AposTools/snapshots/neped
Neped is available from these URLs as of 5/24/99:
http://www.dislessici.org/sources/neped.c
http://metalab.unc.edu/pub/Linux/distributions/trinux/src/netmap/neped.c
http://www.sekurity-net.com/exploits/unix/neped.c
#!/bin/sh
## Cheap-ass promiscuous mode watcher/action-taker
## Written by axon
##
## Requires "NEtwork Promiscuous Ethernet Detector" (neped.c)
## ftp://apostols.org/AposTools/snapshots/neped/neped.c
##
## This program must be run as root, or neped must be set-uid root.
##
#########################################################################
##
## Config Options!
##
######
# Command or shell script that's run when promisc.
promisccmd="promisc.sh" # mode card is found. This might shut down a
# service, or e-mail an administrator. Up to you.
# (you must write a promisc.sh script or change
# this variable)
# Command or shell script that's run when
nopromisccmd="nopromisc.sh" # promisc. mode ceases. This might page
# an administrator or restart a service.
# (you must write a nopromisc.sh script or
# change this variable)
while true
do
while true
do
# Counts number of lines
neped=`neped eth0 | wc -l` # that are returned
# by neped.
if [ $neped -gt 8 ];then # This runs the command of your
$promisccmd # choice when promisc. mode
break # is detected
neped eth0|grep "*>" >> promisc.log # appends output of neped to promisc.log
fi
done
while true
do
# Counts number of lines
neped=`neped eth0 | wc -l` # that are returned
# by neped.
if [ $neped = 8 ];then # This runs the command of your
$nopromisccmd # choice when promisc. mode
break # ceases
fi
done
done
chfn Trojaned! User->r00t chsh Trojaned! User->r00t inetd Trojaned! Remote access login Trojaned! Remote access ls Trojaned! Hide files du Trojaned! Hide files ifconfig Trojaned! Hide sniffing netstat Trojaned! Hide connections passwd Trojaned! User->r00t ps Trojaned! Hide processes top Trojaned! Hide processes rshd Trojaned! Remote access syslogd Trojaned! Hide logs linsniffer Packet sniffer! fix File fixer! z2 Zap2 utmp/wtmp/lastlog eraser! wted wtmp/utmp editor! lled lastlog editor! bindshell port/shell type daemon! tcpd Trojaned! Hide connections, avoid denies
Under Construction.