Dear Linux-security subscribers: ... there will be none (see subject). As most of you probably know by now RedHat has announced that it will not release another free Linux distribution, i.e., RH 9 will be the last. Support for RH 7.x will end at the end of this year, support for RH 9 will end at the end of April. What are the alternatives? Alternative 1: Fedora Linux There exists a product called Fedora Linux, which RedHat seems to promote as the successor of the free RedHat distributions. Currently, you can download "Fedora core 1". Fedora will be a "community supported" product whatever that means. While the transition from RedHat Linux to Fedora Linux will be easy - the two are very similar - there are uncertainties connected with Fedora Linux that make its suitability for production systems questionable: 1) it has been announced that there will be three core releases every year of Fedora Linux. This sounds as if using Fedora Linux will be like living on the edge: always the newest and greatest - not necessarily good for stability. 2) with three core releases every year, it is completely unclear how long older releases will be supported: support for 2 years would mean that at every point in time upto 6 distributions would have to be supported, 9 distributions, if the support lasts over 3 years. Very unlikely. 3) it is completely unclear how how fast the Fedora team will come up with security updates after the discovery of a severe security hole. Note a community based distribution not necessarily has to be slow with security updates - Debian is the best counter example, but Debian also has the opposite strategy than Fedora: stability is more important than new features every few months. Alternative 2: SuSE Despite recently being bought by Novell SuSE support for free distributions still seems to be strong (I receieved on email from SuSE.com confirming that). SuSE is definitely high quality, has fast releases for fixing security problems, is rpm based. Support for older releases seems to be at least 2 years (SuSE still support SuSE 7.2, which came out about 2 years ago). All of that make it the perfect candidate for production systems. However, it will be different and will take some time to get used to. Alternative 3: Debian Debian is a community based distribution. It is high quality. And it has reasonable support for older distributions. However, it is not rpm based. And more importantly, almost no support for Debian systems from commercial vendors exists. If you rely on commercial compilers, software libraries, etc. Debian is not for you. The most appealing plan (at least from my perspective) for the SFU distributions is the following: 1) support for RH 7.1 and 7.2 will disappear at the end of this year. 2) support for RH 9 will disappear at the end of April. 3) we will be supporting Fedora Linux, at least on a test basis. 4) I will try to start supporting SuSE Linux, probably starting with version 9. This will require work - currently we have no experience with building SuSE distributions. 5) ACS runs a large number of systems that run RH 7.3. These systems rely on this particular version of the OS, because they use commercial software packages that only work with this particular version of glibc. For that reason we will be trying to support RH 7.3 (we probably have to rename it to something else) beyond Dec. 31 by backporting security updates to RH 7.3. Right now we cannot say how long we will be able to continue that support, but alternatives to that approach would be very expensive. I would like to hear your comments, suggestions, wishes, etc. with respect to these issues. In any case this will not be an easy transition. Cheers, Martin -- Martin Siegert Manager, Research Services WestGrid Site Manager Academic Computing Services phone: (604) 291-4691 Simon Fraser University fax: (604) 291-4242 Burnaby, British Columbia email: siegert@sfu.ca Canada V5A 1S6
This directory provides parameters for particular devices on the system. Most systems have at least two directories, cdrom and raid, but customized kernels can have others, such as parport, which provides the ability to share one parallel port between multiple device drivers.
The cdrom directory contains a file called info, which reveals a number of important CD-ROM parameters:
Issue the following responses to the queries from the command:
n (create a new partition)
p (will make it a "primary" partition)
1 (starting cylinder)
w (write partition table and quit)
/sbin/mke2fs -b 2048 /dev/hdd
mkdir /mnt/dvd
mount /dev/hdd /mnt/dvd
You can create, delete, and edit files & directories under /mnt/dvd in the same way that you would for any other file systems
Unmount the disk with the command:
umount /mnt/dvd
(Make ATAPI CD/DVD Devices look like SCSI devices under Linux)
/sbin/modprobe ide-scsi
ln -sf /dev/scd0 /dev/cdrom
ln -sf /dev/scd1 /dev/cdrom1
cdrecord -scanbus
cdrecord -scanbus dev=ATAPI
cdrecord -dao -v speed=24 dev=ATAPI:0,0
mke2fs -b 2048 /dev/scd1
mke2fs -b 2048 /dev/hdd
mount /dev/hdd /storage/dvd
mondoarchive -L -s 2220m -E /web_disc -Oi -d /storage/dvd
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -g -Oi -d /storage/dvd
mondoarchive -L -E /web_disc -Oi -d /storage/dvd -g -B "mount /storage/dvd" -A "umount /storage/dvd" -s 2220m
mondoarchive -L -g -E "/web_disc /web_logs" -Oi -d /web_disc/ccp14/temp
mondoarchive -S /tmp -T /tmp -L -E "/web_disc /web_logs" -S /web_disc/ccp14/temp -Oi -d /web_disc/ccp14/temp
mondoarchive -Oi -d /mnt/zip -g -B "mount /mnt/zip" -A "umount /mnt/zip" -s 100m
mondoarchive -L -s 2220m -E "/web_disc /web_logs" -Ow -d 1,1,0
mondoarchive -S /tmp -T /tmp -Ow 1 -d /dev/scd1 -L -s 2220m -E "/web_disc /web_logs"
Verify an existing archive (16 is speed):
mondoarchive -Vc 16
mondoarchive -S /tmp -T /tmp -L -s 2220m -E "/web_disc /web_logs" -Oi -d /tmp/isos
cdrecord dev=1,1,0 -v blank=fast
cdrecord -dao -v dev=1,1,0 -data -eject 1.iso
Mount and view an ISO image:
mkdir /mnt/isoimage
mount -t iso9660 -o loop 1.iso /mnt/isoimage
information on MATSHITA DVD-RAM LF-D310
Panasonic LF-D311 IDE DVD-RAM/R
http://www.cdrinfo.com/hardware/panasonic-lfd311/page2.shtml
Burn Baby Burn - Setting up and burning DVD-Rs on your linux workstation
http://www.comet.ucar.edu/strc/wes/documents/dvd-r_setup.htm
If you are experiencing pop-ups generated by one of these malicious programs, you may want to remove the pop-up program from your computer. One program that attempts to detect and to uninstall pop-up programs is available at http://download.cnet.com/downloads/0-10106-108-63806.html. We have no relationship with the individuals who created this software and cannot vouch for it ourselves.
> HOW do I "set the sticky bit" of /tmp?
It is indicated by a t in the executable bit of the ls listing
drwxrwxrwt 6 root root 1024 May 28 00:04 /tmp
^ small `t' mean sticky and executable
and you set it chmod as usual.
chmod o+t /tmp
See the chmod man page for more information.
To enable plain-text passwords:
1. Start->Run.
2. Type regedit.
3. Add the DWORD value to the Registry entry EnablePlainTextPassword (reg Dword) 1 in the following Registry location:
Win98: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSETUP
WinNT: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters
NOTE: In the string "EnablePlainTextPassword"there are no spaces and case is important.
A system of simultaneous linear equations is written
Ax = b
where A is the coefficient matrix, b is the right hand side, and x is the solution. A is assumed to be a square matrix of order n, but some of the individual routines allow A to be rectangular. If there are several right hand sides, the system is
AX = B
where the columns of B are the individual right hand sides, and the columns of X are the corresponding solutions. The basic task is to compute X, given A and B.
djbdns is a DNS package by DJ Bernstein that consists of
From: werner@visaw.rus.uni-stuttgart.de (Andreas Werner)
Newsgroups: comp.sys.sgi.admin
Subject: Re: sshd
Date: 8 Apr 2000 19:42:51 GMT
Organization: Comp.Center (RUS), U of Stuttgart, FRG
there are lots of ways to do this, but the SGI typical way is:
1. Create a file /etc/init.d/sshd containing the following:
====================================
#! /bin/sh
#
# start up ssh server at boot
#
case "$1" in
'start')
if /sbin/chkconfig sshd ; then
if test -x /usr/local/sbin/sshd; then
/usr/local/sbin/sshd
fi
fi
;;
'stop')
/sbin/killall sshd sshd1
;;
*)
echo "usage: $0 {start|stop}"
;;
esac
#
====================================
2. Create two links:
# ln -s ../init.d/sshd /etc/rc0.d/K01sshd
# ln -s ../init.d/sshd /etc/rc2.d/S99sshd
3. Create a config variable:
# chkconfig -f sshd on
That's all, including the possibility to configure the daemon
on or off woth the 'chkconfig' command.
For the experts: Yes, I know that the 'killall' command will
kill user ssh daemons, too, but that's exactly the thing I want
when the machine shuts down ;-)
To: Exploit-Dev
Subject: Re: ssh-1.2.27 remote buffer overflow - exploitable
Date: Mon Nov 08 1999 21:24:17
Author: Daniel Jacobowitz
Message-ID: [19991109112417.A30046@drow.res.cmu.edu]
On Tue, Nov 09, 1999 at 01:48:53AM -0000, Frank wrote:
> This is submitted to the Freebsd bug tracking system, although there
> are doubtless other vendors who leave this package, despite the
> existence of the ssh-2.X. While Debian appears to be immune, I was
> able to crash my ssh daemon (much to my dismay), and there appears
> the potential to execute arbitrary code, as long as you encrypt it
> first...
>
> Here is the freebsd report.. it describes the method to crash a
> remote Ssh daemon (lets hope you ran sshd from your xinetd, etc).
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=14749
>
And here's a patch. Not tested, as I don't use the rsaref glue on any
machine here.
Dan
/--------------------------------\ /--------------------------------\
| Daniel Jacobowitz |__| SCS Class of 2002 |
| Debian GNU/Linux Developer __ Carnegie Mellon University |
| dan@debian.org | | dmj+@andrew.cmu.edu |
\--------------------------------/ \--------------------------------/
--- rsaglue.c.orig Tue Nov 9 11:12:32 1999
+++ rsaglue.c Tue Nov 9 11:17:58 1999
@@ -139,6 +139,10 @@
input_bits = mpz_sizeinbase(input, 2);
input_len = (input_bits + 7) / 8;
+ if(input_bits > MAX_RSA_MODULUS_BITS)
+ fatal("Attempted to encrypt a block too large (%d bits, %d max) (malicious?).",
+ input_bits, MAX_RSA_MODULUS_BITS);
+
gmp_to_rsaref(input_data, input_len, input);
rsaref_public_key(&public_key, key);
@@ -172,6 +176,10 @@
input_bits = mpz_sizeinbase(input, 2);
input_len = (input_bits + 7) / 8;
+ if(input_bits > MAX_RSA_MODULUS_BITS)
+ fatal("Received session key too long (%d bits, %d max) (malicious?).",
+ input_bits, MAX_RSA_MODULUS_BITS);
+
gmp_to_rsaref(input_data, input_len, input);
rsaref_private_key(&private_key, key);
So you can install the bzipped JDE, obtain bzip2 and install this extraction software.
MIMEDefang can inspect and modify e-mail messages as they pass through your mail relay. MIMEDefang is written in Perl, and its filter actions are expressed in Perl, so it's highly flexible.
Summary posted on the WGET Mailing List
SUMMARY:
Any strength encryption can be exported without a license to anybody
except governments in all countries but the terrorist 7 (Cuba, Iran,
Iraq, North Korea, Libya, Syria, Sudan).
"Government" is limited to entities performing governmental functions or
producing munitions.
"Retail" products can be exported to Governments without a license.
"Retail" products now include web-based products with equivalent
functionality to those you would traditionally consider to be retail
(generally available, and not easily morphed into something or so
complicated that you need a service agreement--but this standard
doesn't apply to web-based products, so long as the functionality is
equivalent)
Publically available source code can be downloaded without restriction
(you have to give the Bureau of Export Administration (BXA) the url),
but if you enter into an license to allow someone to commercially
develop a product based on the software AND you charge a royalty or
license fee, you have to report the name, address and description of
the intended product to BXA.
You can sell anything to ISPs and telcos without a license, and they
can provide services based on this to all entities except governments.
A license is required if the ISP or telco wants to provide a non-retail
service specific to government end-users.
There are certain review and reporting requirements, which should be
reviewed with the full text of the regulation at:
http://www.bxa.doc.gov/Encryption/pdfs/Crypto.pdf
Most companies implement a Reverse DNS check to see where the download
is coming from and compare that against a Restricted Countries and Parties
("terrorist" countries and known terrorists). This mechanism can certainly
be spoofed, but it is a best effort approach. Kinda silly in some cases,
but it is U.S. Export Law.
|
5.6. Can I use ssh to protect services like FTP or POP?If you want to avoid sending FTP passwords in cleartext over the net, you can use ssh to encrypt your command channel. This will still leave your data channel open to all attacks on TCP, and will not work through a firewall. You can either use ftpsshd by Per-Erik Martin at http://www.docs.uu.se/~pem/hacks/ for SSH1, or you can do this by hand. SSH1: Suppose you are on a host called myhost and want to initiate a ftp connection to ftphost. On myhost, you do myhost$ ssh -L 1234:ftphost.example.com:21 ssh-serverThis logs you on to ftphost and also forwards connections to 1234 on myhost to ftphost. Note: You need to use -g if you're forwarding to localhost (SSH1 only). Then, in another window, you do myhost$ ftp localhost 1234 220 ftphost FTP server (Foonix 08/15) ready. Name: (myhost:yourname): 331 Password required for yourname Password: 230 User yourname logged in.This works if the remote ftp daemon accepts PORT commands which specify a different host from the one the command channel appears to come from, and if the ftp client always uses PORT. This is true for vanilla UNIX ftp client and ftpd servers; it may not work for more advanced ftpds, such as wu-ftpd. For servers which do not accept this, you can see wether you ftp client supports passive mode, and wether the ftp server accepts PASV. Note, however, that unencrypted ftp data connections are still vulnerable to session hijacking and snooping. SSH2: Just use sftp instead. :-) For POP, Stephane Bortzmeyer (bortzmeyer@pasteur.fr) has written a script which protects the mail transfer and passwords ussing ssh. It requires no modification to existing POP servers or clients, and is available from ftp://ftp.internatif.org/pub/unix/gwpop/ . Or, you can use similar means for secure POP: myhost$ ssh -L 1234:popserver.example.com:110 ssh-server Other services could be secured by similar means.
5.7. Can I use ssh across a Socks firewall?
Socks 4 and 5 support should work in 1.2.16 or later. Socks support in version 2.0.11 and later should work.
|
Newsgroups: comp.security.unix Subject: Re: secure pop from sniffing From: [bglbv@my-deja.com] X-Newsreader: Gnus v5.7/Emacs 20.6 Date: 06 Jun 2000 20:29:54 +0100 "Bernd Dürrer" [duerrer@ika.ruhr-uni-bochum.de] writes: > "kukulkan" [isman@fsksm.utm.my] schrieb im Newsbeitrag > news:393C65B2.5A676C14@fsksm.utm.my... > > any software/methods to secure pop(esp. Eudora users) from being sniff?I > > have ssh here to protect remote login and file transfer, but still it > > has no meaning If I cannot have the pop to be secure .. > You want to use the port forwarding capabilities of SSH: Have a look at > http://www.employees.org/~satch/ssh/faq/ssh-faq-5.html#ss5.6 > > If this doesn't help you, please post what SSH implementation on what OS > your pop users are using. I don't think Eudora supports the SSH protocol at all. What it might support is: (a) APOP (Authenticated POP), which involves transmitting a (non-replayable) hash of the POP password and of a challenge sent by the POP server. The POP password is distinct from the password used for interactive logins. (b) POP over an SSL tunnel (to port 995 rather than 110). If I remember correctly, Eudora can do (a) but not (b), while Netscape Messenger can do (b) [but not (a)?]. It's probably wise to support both. And to make the POP passwords different from the login passwords in any case. Also make sure your POP server has no known security holes. (Some versions of Qpopper are to be avoided, for example.) |
From: eitz@weh.rwth-aachen.de (Holger Eitzenberger) Newsgroups: comp.security.unix Subject: Re: secure pop from sniffing Date: 7 Jun 2000 09:22:00 GMT Organization: RWTH Aachen Lines: 16 On Tue, 06 Jun 2000 10:45:06 +0800, isman@fsksm.utm.my (kukulkan) wrote: >any software/methods to secure pop(esp. Eudora users) from being sniff?I >have ssh here to protect remote login and file transfer, but still it >has no meaning If I cannot have the pop to be secure .. You may want to use APOP (authenticated POP3), which i use also. Both QPopper (on server side) and fetchmail (on client side) support it. APOP uses an encrypted one-time key to get mail. Holger -- + GnuPG Public Key -> finger eitz@jonathan.weh.rwth-aachen.de + |
|
Using APOP at NCSA - What is APOP?
|
http://www.cert.org/incident_notes/IN-99-01.html Automated Scanning and Exploitation http://www.cert.org/incident_notes/IN-98-06.html Probes with Spoofed IP Addresses http://www.cert.org/incident_notes/IN-98-05.html Advanced Scanning http://www.cert.org/incident_notes/IN-98.04.html New Tools Used for Widespread Scans http://www.cert.org/incident_notes/IN-98.02.html The most frequent reports involve well-known vulnerabilities in mountd, IMAP, and POP3. These services are installed and enabled by default in some operating systems. See the following advisories for more information: sunrpc (TCP port 111) and mountd (635) http://www.cert.org/advisories/CA-98.12.mountd.html IMAP (TCP port 143) http://www.cert.org/advisories/CA-98.09.imapd.html POP3 (TCP port 110) http://www.cert.org/advisories/CA-98.08.qpopper_vul.html
(23) telnet (53) dns (79) finger (80) web (110) pop (111) SunRPC & NFS (UDP and TCP) (143) imap (1080) socks (2049) nfs (UDP) (6000) X
From: Barry Margolin [barmar@bbnplanet.com] Newsgroups: comp.security.unix Subject: Re: Port Numbers List. Enjoy. In article [37de9d3b.528020403@news1.cal.metronet.ca], Jim Hutchison [Jim Hutchison] wrote: >There's a few posters wanting to know what services are associated >with certain port numbers. Here's a list I've been working with that >has been a great help. What's the Yes/No at the end of each line? >0 ICMP Click attack Yes ICMP doesn't have a port number, since it's not TCP or UDP. >19 UDP Chargen Yes >21 TCP Detects if someone is trying to FTP to you. No >23 TCP Detects if someone is trying to Telnet to you. No >53 TCP DNS Yes >129 TCP Password Generator Protocol Yes >137 TCP Netbios name (DoS attacks) Yes >138 TCP Netbios datagram (DoS attacks) Yes >139 TCP Netbios session (DoS attacks) Yes >555 TCP Stealth Spy - Beta 3 No >666 TCP Attack FTP No >1027 TCP ICQ Yes >1029 TCP ICQ Yes >1032 TCP ICQ Yes >1080 TCP Used to detect Wingate sniffers. Yes >1243 TCP Sub Seven (Also see TCP 6776 and TCP 6711) No >1981 TCP Shockrave No >2140 UDP Deep Throat No >2989 UDP Rat No >3150 UDP Deep Throat No >5000 2 TCP Detects & blocks Sokets de Trois v1. Yes >5001 TCP Detects & blocks Sokets de Trois v1. Yes >6711 TCP Sub Seven (Also see TCP 1243 and TCP 6776) No >6776 TCP Sub Seven (Also see TCP 1243 and TCP 6711) No >6969 TCP Gate Crasher No >7300 TCP Net Monitor No >7301 TCP Net Monitor No >10067 UDP Portal of Doom No >10167 UDP Portal of Doom No >12076 TCP GJamer No >12345 TCP Netbus No >12346 TCP Netbus No >20000 TCP Millennium No >20001 TCP Millennium No >21554 TCP GirlFriend No >23456 TCP EvilFTP No >30100 TCP NetSphere No >30102 TCP NetSphere No >31337 UDP Backorifice (BO) No >31337 TCP Netpatch No >31338 UDP Deep BO No >31785 TCP Hack'a'Tack No >31789 UDP Hack'a'Tack No >31791 UDP Hack'a'Tack No >40421 TCP Master's Paradise - Hacked No >40422 TCP Master's Paradise - Hacked No >40423 TCP Master's Paradise - Hacked No >40425 TCP Master's Paradise - Hacked No >50505 TCP Detects & blocks Sokets de Trois v2. No >54320 TCP Backorifice 2000 No >54321 UDP Backorifice 2000 No >65000 TCP Devil No
7777 Unreal, Klingon Honor Guard 22450 Sin 26000 Quake 26900 Hexen 2 26950 HexenWorld 27015 Half-life 27500 QuakeWorld 27910 Quake 2 28910 Heretic 2
"You can diagnose most memory leaks with Performance Monitor and several Microsoft Windows NT Server 4.0 Resource Kit utilities. (For a list of resource kit tools, see the sidebar "Resource Kit Tools for Diagnosing and Monitoring Memory Leaks.")"
The TNEF implementation defines several TNEF-specific attributes, each of which corresponds to a particular MAPI property. These attributes are used to encode their respective MAPI properties into the TNEF stream. In addition, a special attribute is defined that can be used to encapsulate any MAPI property that does not have a specific attribute corresponding to it. The reason these attributes are defined instead of simply using a uniform encoding method for all MAPI properties is to enable backward compatibility with non-MAPI-compliant software that is using TNEF such as Microsoft Mail 3.x and its transport providers.
The remainder of this appendix describes the structure and syntax of a TNEF stream, the mapping between MAPI properties and TNEF attributes, and important considerations for certain TNEF attributes."
So... why psybnc? There are a variety of other open source bnc's available for you to download, most notably EZBounce and plain-ol BNC. Both of these do the exact same basic thing as psybnc: hide your real host. But that's about where the similarity ends. I've been using psy for a long time now, and I love with all the features that it offers.
12,248,097
The attacking Windows machines generate maximum-size 64k byte UDP packets, but only the first 1500 byte "fragment" of each packet carries the packet's port "666" destination. Therefore, for every identified "666" packet blocked, approximately 43 additional maximum-size "packet fragments" were also blocked. We therefore estimate that our filters running in Verio's router blocked at least 538,916,268 malicious packets that night.
May 17/18/19/20th - Attack 6. The exact dates and times are unknown because we were completely shielded by the configuration of Verio's router. But when we checked the router's "UDP/666" hit counter on the morning of Monday May 21st we found that the blocked "666" count had jumped from its previous value of 12,248,097 to a whopping 54,528,114 packets, leading us to conclude that the filters had weathered, by this time, at least :
2,399,237,016 malicious packets.
- nearly 2.4 BILLION malicious packets.
1. Thank God someone's finally exposing this charlatan
2. You both make good points, but we're still leaning in Steve's direction
3. Steve walks on water; you're a moron, and so's your old man
> Is there a way to completely fool (or block) OS detection from scanners (like nmap, queso, > etc.) using the Linux OS? What about Windoze? Under linux try iplog ( http://ojnk.sourceforge.net/ ) with -z as option. I've been using it for a while, and it works like a charm. Under windows, i have absolutely no idea.
If you describe your intermediate forms using Zephyr's Abstract Syntax Description Language (ASDL), we can generate data-structure definitions in C, C++, Java, Standard ML, and Haskell."
Adding Shortcuts to Windows 95
If you would like to add a shortcut to your program in the Start Menu,
you can use the undocumented API call that is used in the setupkit.
Declarations
You must declare the following in the declarations section of a project.
Declare Function fCreateShellLink Lib "STKIT432.DLL" _
(ByVal lpstrFolderName as String, ByVal lpstrLinkName _
as String, ByVal lpstrLinkPath as String, ByVal _
lpstrLinkArgs as String) As Long
Use
To add a shortcut to the Start Menu, you call the function with these parameters:
Where to place the link in relation to the Programs folder on the Start Menu.
Name or Text to appear in the link.
Path of the file to link to.
Arguments for the file.
For instance, to add a shortcut to the desktop, you would use the following code:
lngResult = fCreateShellLink("....Desktop", _
"Link to my program", "C:\Path\Program.exe","")
Tip by James Limm
Visual Basic
Adding shortcuts in Windows 95
It's easy to create your own shortcuts. The secret to creating shortcuts with Visual Basic
lies in this VB 4.0 setup kit declaration:
Declare Function fCreateShellLink _
Lib "STKIT432.DLL" _
(ByVal lpstrFolderName as String _
ByVal lpstrLinkName as String _
ByVal lpstrLinkPath as String _<
ByVal lpstrLinkArgs as String ) As Long
The first parameter asks where to place the link (shortcut) relative to
the Start menu's Programs folder. The second parameter is the name or
text to appear with the link. Next comes the file's path; the final
parameter handles any arguments. So, to place a shortcut on the desktop,
try this code:
iLong = fCreateShellLink("....Desktop", _
"My Link to Success", "C:PathSuccess.exe","")
"By utilizing the ITU-T T.128 compliant application sharing function, users can increase meaningful communication by collaborating on any shared X, Control Windows, and most Open GL applications as easily as if they were running the application natively. By sharing the actual application, users can easily see what others are doing without having to travel across town or to send a fax. Users need not have copies of the application on their machine in order to share it. The host opens the application, and other users view it on their screens simultaneously. The host may choose to give control to someone else in the conference. Changes made appear on everyone's monitors. Once the users are finished, they may save changes made in the session to the host's machine."
Dear Colleagues
I was alerted to this article by an article in "PC-Pro"
magazine, December edition page 251. The journalist drew attention
to this and a few other funny effects that occur, especially when
using Excel with Visual Basic programming. I imagine quite a lot
of people use Excel across CLRC - I do, so I will be somewhat more
sceptical of the results & check them somewhat more.
Here's the Reference & Abstract from Elsevier's website.
http://www.elsevier.nl/locate/csda
========================================================
Computational Statistics And Data Analysis Vol. 31 (1) pp. 27-37
Copyright (c) 1999 Elsevier Science B.V. All rights reserved.
"On the accuracy of statistical procedures
in Microsoft Excel 97"
B.D. McCullough, Berry Wilson
Federal Communications Commission,
445 12th St. SW Room 2C-134, ,
Washington, DC 20554, USA
Received 1 June 1998; Revised 1 December 1998
Abstract
The reliability of statistical procedures in Excel
are assessed in three areas: estimation (both
linear and nonlinear); random number generation;
and statistical distributions (e.g., for calculating
p -values). Excel's performance in all three areas
is found to be inadequate. Persons desiring to conduct
statistical analyses of data are advised not to use Excel.
===========================================================
(I did the highlighting)
Robert Paynter,
Energy Research Unit, RAL
Other Information
The "hit profile" of an adult-oriented site is amazingly different from any other kind of site. Because there are relentless, insatiable hordes of visitors, it is almost impossible to control the bandwidth requirements of such sites in a manner that will satisfy the visitors, the adult site customer, and our other customers. The peak hit frequency of some adult sites is extreme; even when access is blocked to restrict bandwidth, the impact on servers is more than noticeable."
"Aren't PCs just toy machines?"
"Any provider who tells you this has either never used an unrestricted Unix on the PC platform, or is trying to justify their misguided and unnecessarily expensive investment in inflexible "corporate mentality" equipment. When compared to commercial Unix vendor equipment that costs ten times as much, a properly configured PC-based server provides superior price/performance ratio, overall reliability, and spare parts availability. Don't be fooled by the legacy of DOS!"
From: Ole Michaelsen [omic+usenet@fys.ku.dk]
Newsgroups: comp.security.unix
Subject: Re: secure a user to his home directory and disable him from viewing anything outside his own directory
Date: 08 Jun 2000 20:08:34 +0200
Organization: University of Copenhagen
dwaynekuan@my-deja.com writes:
>
> how do i totally shut him down to his own home directory??
I found this on freshmeat. Maybe that's what you need?
Path: news.freshmeat.net!not-for-mail
Approved: scoop@freshmeat.net (Patrick Lenz)
Message-ID: [8hnrkf$9vo$2@mail.freshmeat.net]
NNTP-Posting-Host: freshmeat.net
NNTP-Posting-Date: 8 Jun 2000 10:13:35 GMT
Xref: news.freshmeat.net fm.announce.console:3910
application: Linux Intrusion Detection System 0.9.5a
author: Xie Hua Gang [xhg@gem.ncic.ac.cn]
license: GPL
category: Console/Firewall and Security
urgency: medium
homepage: http://freshmeat.net/redir/homepage/939982897/
download: http://freshmeat.net/redir/download/939982897/
description:
The Linux Intrusion Detection System is a patch which enhances the
kernel's security. When it is in effect, chosen files access, all
system/network administration operations, any capability use, raw
device, mem, and I/O access can be made impossible even for root. You
can define which program can access which file. It uses and extends the
system capabilities bounding set to control the whole system and adds
some network and filesystem security features to the kernel to enhance
the security. You can finely tune the security protections online, hide
sensitive processes, receive security alerts through the network, and
more.
Changes:
Transition to 2.2.16 kernel, bugfix for protecting mount point, bugfix
for port scanner detector in the kernel.
|> http://freshmeat.net/news/2000/06/08/960459276.html
Wouldn't something like making his shell be 'chroot sh -i $HOME' do the trick? [Please excuse me if I'm missing something obvious] -- Texas Imperial Software | Try WFTPD, the Windows FTP Server. Find us 1602 Harvest Moon Place | at web site http://www.wftpd.com or email Cedar Park TX 78613 | us at alun@texis.com. VISA / MC accepted. Fax +1 (512) 378 3246 | NT-based ISPs, be sure to read details of
> dwaynekuan@my-deja.com writes: > > > how do i totally shut him down to his own home directory?? man 2 chroot
From: clive@nsict.org (Clive Jones) Newsgroups: comp.security.unix Subject: Re: secure a user to his home directory and disable him from viewing anything outside his own directory Date: 9 Jun 2000 01:02:25 +0100 Organization: National Society for the Inversion of Cuddly Tigers In article [87em673j67.fsf@bglbv.my-deja.com], [bglbv@my-deja.com] wrote: >Yes, although the likelihood of unwittingly introducing a security >hole that makes it possible for the user to break out of the chroot >jail shouldn't be underestimated. That's not the only thing not to underestimate. Messing with chroot when you don't understand the implications fully can give people root expoits, not just a way out of the jail. An obvious example would be accidentally including su, login, or similar in their environment, when they can modify their personal version of /etc/passwd - but that's just the tip of the iceberg. --Clive.
Things get tricky for works that were in their first term when the law changed in 1978. Works copyrighted between January 1, 1950 and December 31, 1963 still had to be renewed in order to be protected for a second term. If renewed, the second term was extended to sixty-seven years, for a total of a ninety-five year term, see above.) If renewal was not applied for, the copyright protection ended on December 31 of the twenty eight year.
Works copyrighted between January 1, 1964 and December 31, 1977 were automatically renewed for a second term. Thus, no registration of the renewal was required."
APIC WORLDWIDE - Three Important Copyright Points
The United States affords protection to the authors of
certain original works as provided by the United States Code on Copyright.
In order to avoid the problems involved in copyright infringement it is
important to understand the fundamentals of copyright law. Three important
points are:
The notice of copyright
Just what does copyright protect
The duration of copyright
1. Notice Of Copyright
It is not necessary to attach a copyright notice to a work in order for
that work to be copyrighted. However, in order to be eligible for certain
damages in a lawsuit, the copyright notice must be attached.
A copyright notice should contain:
the symbol © (THE LETTER C IN A CIRCLE), or the word "Copyright" or the
abbreviation "Copr.", and; the year of first publication of the work, and;
the name of the owner of copyright in the work.
Example: ©1997 Jane Doe
2. What Types of Work Does Copyright Protect?
Copyright protects original works of expression. These works include:
literary
dramatic, including accompanying music
pantomimes and choreographic
pictorial, graphic and sculptural
motion pictures and other audiovisual
sound recordings, and
architectural
3. Duration of Copyright
Before 1978:
published: Copyright expires 75 years from the date of publication not
published: Copyright expires 12/31/02
1978 through present:
individually owned: life of author plus 50 years owned by employer of
author: 75 years from date of publication or 100 years from date of
creation, whichever occurs first.
Berne Convention
In 1989 the United States joined the Berne Convention for the Protection of
Literary and Artistic Works. The Berne Convention is an international
copyright treaty signed by 96 countries. The regulations are far more
stringent than United States copyright laws. The Berne Convention recently
extended the term of protection to the life of the author plus 75 years.
The United States law is expected to follow suit.
Fair Use
See 17 United States Code Section 107- Limitations on Exclusive Rights:
Fair Use- For certain purposes, such as criticism, comment, news reporting,
teaching (including multiple copies for classroom use), scholarship or
research, is not an infringement of copyright. In making this determination
of fair use these 4 factors must be considered: purpose and character of
use, whether of a commercial nature or for nonprofit
educational purposes;
the nature of the copyrighted work;
the amount and substantiality of the portion used
in relation to the copyrighted work as
a whole; and
the effect of the use upon the potential market
for or value of the copyrighted work.
Public Domain
Public domain is a legal term which refers to the end of term of copyright
and thereafter. You can be certain that you would never come across any
erotic photography on the web that would be considered public domain.
Remember, copyright begins with the creator of a work (a photo, an article,
etc.) and continues through that author's life plus 50 years. Only then is
that work in the "public domain". Anyone who simply puts up sites with
photos they grabbed elsewhere off the Internet is most certainly infringing
someone's copyrights. You can be certain that this includes all celebrity
images as well. A celebrity image with all applicable model releases would
allow the copyright owner economic freedom to sell or assign the rights to
that image.
The Public Domain is made up of all those works, that for whatever reason
are not protected by copyright Works in the Public Domain are free to use
without permission. These include:
originally non-copyrightable
expired copyright
authored by the Federal Government
specifically granted to the Public Domain
Australia outlaws e-mail forwarding
By: Thomas C Greene in Washington
Posted: 05/03/2001 at 08:10 GMT
Outrageously strict Internet copyright laws which have
just gone into effect throughout Australia make it illegal to forward an
e-mail memo without the author's permission, and could result in fines of
$60,000 or five years in the slam, according to a story by the Aussie
Sunday Telegraph.
"It's quite possible that the forwarding of an e-mail
could be a technical infringement of copyright," an unnamed legal advisor
to Oz Attorney General Daryl Williams told the paper.
"E-mailing is a 'communication' under the Digital
Agenda Act, and so is putting something up on a Web site," the source added.
This could rank as the world's most copyright-friendly and
common-sense-hostile piece of legislation yet devised. And that's not all:
Aussies recently revealed a widespread national neurosis by entertaining,
in the state of South Australia, an Internet censorship bill which would
criminalize the posting any material which cops deem offensive to children
- that's anything, anywhere.
The bill would require Net content to be child-friendly according to the
country's movie certification scheme; but, in a twist straight out of
Kafka, it's not possible for Webmasters to get their sites reviewed by the
relevant authority before they get busted.
Which is to say nothing of the lunacy of reducing
on-line discourse and dialogue to infant babble. Clearly, the Puritanical
delight in censoring impure thoughts and regulating the pleasure of others
has once again got out of control down under.
Over half a century ago the English writer Norman Douglas had occasion to
observe that "all mankind is at the mercy of a handful of neurotics".
So much for progress. ®
Aussie AG denies e-mail penalty, sort of
By: Thomas C Greene in Washington
Posted: 05/03/2001 at 16:50 GMT
We've been buried in reader responses, most originating in Australia,
pointing us to a statement in clear contradiction of a Sunday Telegraph
story indicating that Australia's new copyright regulations could result in
penalties for forwarding an e-mail memo, which we picked up here.
"Contrary to alarmist media reports, sharing e-mail is not banned by law,"
Australian Attorney General Daryl Williams says in a press release issued
Monday.
"Amendments to the Copyright Act that came into effect today do not ,outlaw
the practice of forwarding personal e-mails to other people. That would be
ridiculous," he observes.
A court would need to find that the contents of the e-mail were an
"original literary work", he adds. But while he decries media
sensationalism firmly enough, he doesn't quite deny the possibility that
forwarding e-mail can land one in hot water with the same finality.
"For example, if the e-mail was simply a joke that everyone had been
re-hashing for years, it is doubtful it would have the necessary
originality to be protected by copyright. Similarly, a casual exchange of
personal information or office gossip would probably not be original enough
to have copyright in it." (our emphasis)
That's not quite the same as saying that some doofus original limerick or
ode to precious bodily fluids as in the case of the now famous, possibly
bogus, Claire Swire e-mail could not be disputed in court.
One reader scolded us for repeating what we'd read in the papers. "The
Sunday Telegraph. A source for NEWS? Are you serious?!" they ask.
Well, we thought we were.... ®
> On 08 Jun 2000 12:17:06 +0200, Emmanuel Michon wrote: > > >Is it possible to get inside the local network without breaking the > >gateway security first? > > For one possibility (source routed packets) read > > http://www.robertgraham.com/pubs/firewall-seen.html#3.1 As far as I understand Linux is about sanely configured in this case, and has the following default settings: accept_source_route - BOOLEAN Accept packets with SRR option. (default TRUE) rp_filter - INTEGER 2 - do source validation by reversed path, as specified in RFC1812 Recommended option for single homed hosts and stub network routers. Could cause troubles for complicated (not loop free) networks running a slow unreliable protocol (sort of RIP), or using static routes. 1 - (DEFAULT) Weaker form of RP filtering: drop all the packets that look as sourced at a directly connected interface, but were input from another interface. 0 - No source validation. It seems that this setting is reasonable; but I could also disable definitely with accept_source_route=FALSE -- Emmanuel Michon
From: nick@webthing.com (Nick Kew)
Newsgroups: comp.security.unix
Subject: Re: One-to-many nat: can such a network be penetrated?
Date: Thu, 8 Jun 2000 13:31:13 +0000
Organization: The Holy Book of the Great Bludner
In article [7wbt1c1nq5.fsf@sdesigns.com],
Emmanuel Michon [emmanuel_michon@sdesigns.com] writes:
> let's consider a local network of computers with private addresses,
> let's say 172.15.0.0/255.255.0.0. Such addresses cannot be routed
> on the internet.
Methinks you got your address range wrong, but we'll let that pass.
> One of them acts as a gateway, with an ethernet 172.15.12.12 and
> also another network interface to the internet, with a public address.
> Is it possible to get inside the local network without breaking the
> gateway security first?
Somewhere on the 'net:
/sbin/route add -network [your.private.net] -gateway [your.public.address]
(or whatever the syntax for route on your OS may be)
Add a rule to block traffic arriving at the external interface for an
internal address.
--
Nick Kew
"Stallman was there to put them right. This is a man who treats copyright as damage and routes around it - as Nick Mailer from the Campaign for Unmetered Telecoms found out over lunch when Stallman roasted him for daring to use the non-open Zend PHP compiler, and told him that the only honourable thing to do was to sit down and write his own. For the man who started the GNU project, this probably seems reasonable, but the rest of us could only sit back in awe. "
The Net Authority Acceptable Internet Usage Guidelines (NA-AIUG) are based solely on the desirable morals of civilized society. Their basic effect is to simply organize and prioritize all that is blasphemous in the eyes of God. It is only natural for one of the tools of His creation to be adapted and molded into a form that He finds acceptable. Net Authority merely acts as a catalyst for that process."
For more information on our databases, please click here.
In these times of widespread chaos and blatant defiance of our Lord, we must work together. With our help and yours, the Internet can become a much safer, more enjoyable, and friendly environment to work in."
General Blasphemy
Registered General Blasphemy Offenders: 2801
The general blasphemy list contains information on people who have either read, distributed, or been involved in any way with blasphemic materials on the internet. General blasphemy is material that is considered evil when viewed through the eyes of God.
"``Why are we hiding from the police, daddy?'' ``They use Emacs, son, and we use vi.''
DragonLinux is small and compact in nature. The total file size is around 20 megabytes. If you need more utilities or applications that are not included in the distribution, simply grab them from the nearest internet site and install them!"
"Peer review often doesn't work (Score:3, Interesting)
by Anonymous Coward on Wednesday July 28, @09:17PM EDT (#107)
Back when I was in grad school, my research happened to make a notable contribution to a hot topic at the time. I was (usually with other authors)
submitting papers to IEEE journals at a rate of about 1 per 3-6 months. I also attended several conferences and got to know a lot of the major contributors in
my research area.
Typically, every submission got sent to 3 experts for review. My professor (and one of his collegues) even forwarded to me several papers they were asked to
review. I noticed a couple of things regarding peer review:
The second argument is that the CTEA falls foul of the US Constitution's guarantee of freedom of speech. A third road, not pressed before the Supreme Court, treats the CTEA as a violation of the judge-made "public trust" doctrine, which, in its narrowest form, holds that Congress cannot give away public lands and waters to private individuals.):
A: There is a problem with NT - it wouldn't boot from partitions above 2G. You have to place NT partition under 2G or make a small FAT-16 partition at the beginning of the disk where NT could put its boot files. Alternatively you may install a patch for FAT-16 boot sector that comes with Partition Manager version 2.38, which could boot NT from the partitions above 2G. For installation procedures, please, refer to readme.txt file that is included with version 2.38."
From: Henry Whincup
Cc: "freebsd-users@uk.freebsd.org"
Subject: Re: Installing in cylinder in > 1024
List-Archive: http://listserver.uk.freebsd.org/pipermail/freebsd-users/
Date: Wed, 28 Mar 2001 11:37:43 +0100 (BST)
This looks like it may help: From 'man boot0cfg':
--
-o options
A comma-separated string of any of the following options may be
specified (with ``no'' prepended as necessary):
packet Use the disk packet (BIOS Int 0x13 extensions) interface,
as as opposed to the legacy (CHS) interface, when doing
disk I/O. This allows booting above cylinder 1023, but
requires specific BIOS support. The default is `nopacket'.
--
However you can use grub if you prefer (I think there was an article on it
at http://www.daemonnews.org/).
As for 4.3 it is in the process of being released, so soon-ish!
cheers
Henry
Shock New Zealand survey reveals how firms are 'sabotaging' their own ability to be found on the Internet
Web Rank, Christchurch, 23-Jul-03: Respected search optimisation company Web Rank has today launched a study on the search engine compatibility of the websites of the country's leading organisations.
The study reveals that every website belonging to our top 100 businesses contains significant design flaws that make it harder for them to be found in search engines, thereby negatively impacting the potential revenue of the organisation.
"In designing their sites as they have done, nearly all of New Zealand's top performing companies are sabotaging their own ability to be found by their target market(s)," says Director Kalena Jordan.
Most Internet users rely on search engines to find product and service providers. Unless they know the exact website address (URL) or search by the company or brand name, they will try to find what they are looking for by using keywords that describe a product or service's features, benefits or attributes.
Web Rank's extensive analysis, which is available at www.webrank.biz/Top100NZ.htm, reveals where major New Zealand corporations have overlooked search engine visibility in designing their websites. The report also advises how these websites can be improved to help potential customers find their sites easier and increase business generated online.
Amongst the many findings, the report revealed that:
- Every top 100 Kiwi company website had defects that hindered their ability to be found in search engines,
- A quarter could not be found for their chosen search terms in either US or New Zealand search engines,
- 34% are not listed in popular New Zealand search engines,
- Almost a third are not listed in popular US search engines, and
- One-in-eight use techniques that could get their site penalised on search engines for "spamming."
The authors say it is amazing that firms may spend hundreds of thousands of dollars on website design and related marketing, but that they often overlook search engine compatibility. "What is the point of paying so much money for a web site that will never be found?" says Ms Jordan.
Why is search engine optimisation important?
Search engine compatibility is loosely defined as employing design elements that help search engines index a website and "understand" it's relevance to a search query. To make a site more compatible with search engines Web Rank, and other Search Engine Optimisation (SEO) experts correct design flaws and implement techniques to ensure a website attracts highly relevant, targeted traffic via those engines.
"Search engine optimisation is the technique of attaining a higher ranking in search engines and directories for relevant search queries, via changes to a site to make it more search engine compatible," explains Ms Jordan.
UK studies by Forrester Research show that four-fifths of people find websites by using search engines. According to Australasian market research firm, RedSheriff, four of the 20 most popular New Zealand websites are search engines. In addition, 55% of online purchases in the US are made on websites found through search listings.
How to improve the search-ability of a website
Every effective website should include within the HTML code for each page a TITLE Tag, a META Description Tag, a META Keywords Tag and text-based content. Search engines rely on this information to determine how relevant a website is to any given search query.
These elements are often overlooked by webmasters, or are too short and generic to be effectively picked up by many search engines in connection to a search query. Search engine optimisation of a website involves changing the code to include more keywords and phrases that relate to the products and services offered by the business, as well as changes to the site's structural design to ensure it can be indexed and matched to relevant searches.
Web Rank's "Search Engine Compatibility and the Top 100 New Zealand Company Web Sites" report offers businesses comprehensive suggestions on how to improve the search-ability of their website. Using case examples, Web Rank highlights typical mistakes and advises on how these could be improved.
The report considers how to use graphics, correct tagging, the right keywords in text, how important links from other sites can be and how firms can avoid being penalised in the search rankings from the inadvertent use of "spam" techniques.
"By ignoring the most important method used by people browsing the Internet, these companies are sacrificing an enormous opportunity to attract more traffic to their websites," says Ms Jordan.
"Websites are often a very large expense for these companies, ranging from a few thousand to hundreds of thousands of dollars. To invest such a massive amount of time, money and effort into an online presence and not ensuring it can be found is like constructing a storefront without any doors.
She continues, "It is obvious from the findings of this study that New Zealand companies need to invest in search engine optimisation services to ensure their sites are more search engine compatible and therefore visible to their target markets."
File sharing applications such as KaZaA, Morpheus and Gnutella. Computers that have been broken into and then used to launch attacks. See http://www.cert.org/current for a list of currently active attacks that affect Microsoft Windows and Linux machines.
Streaming media servers.
Game servers.
These can all be legitimate uses of the network. However, total traffic is stressing our Internet capacity.
We are taking the following actions to manage performance:
Using measurement tools to detect computers that are using excessive amounts of Internet bandwidth for extended periods of time. For example, machines that are found to be using bandwidth of 2 Megabits per second or more over a 10-minute period are removed from the network and the responsible parties notified.
Continuing of "traffic shaping" of several popular file sharing applications across all network users at Columbia. This shaping began several months ago, and consists of limiting the bandwidth that is taken up by these applications. Since these applications use the TCP protocol, they automatically adjust to this limit by running a little more slowly.
Installing a faster Internet router. This new router will also facilitate more sophisticated traffic shaping than our current router is able to handle. It will also be able to handle extremely high numbers of packets (usually associated with Denial of Service attacks).
Continuing to monitor and analyze performance.
What you can do to help:
If you use a popular file-sharing application such as KaZaA, Morpheus, Gnutella, etc., please be considerate of others on the network and make the necessary configuration changes to:
1. Not share files from your computer. Don't be a KaZaA supernode.
2. Limit the bandwidth of your file sharing and/or the number of connections to your machine.
3. Similarly, media and game servers should be throttled in such a way that they do not consume inordinate amounts of bandwidth.
Please keep in mind that there are potential legal ramifications to sharing copyrighted materials such as music and videos.
You may want to add the "-u" option to ls to see last-accessed times rather than last-modified times (esp to help gauge how harmful it would be to unsetuid the file).
The US National Aeronautics and Space Administration (NASA)
has taken delivery of a desktop-sized supercomputer which draws no
more power than a hair dryer, based on Field Programmable Gate Array
(FPGA) technology instead of a CPU.
FPGA chips can reconfigure themselves thousands of times a second,
making it possible for numerous applications to run simultaneously. This
setup simply leapfrogs over Moore's Law, yielding a desktop box with
1000 times the power of one running on a CPU.
The power boost comes from the ability of an FPGA array to maximize
the use of transistors. A CPU is designed to handle many different sorts
of tasks, so only a fraction of its transistors is in use at any given time.
An FPGA array, by contrast, can dedicate as many of its transistors as
needed for a task on the fly.
During a pwatkins incursion, izzo has brought this ASCII text stamper (borrocks) to the attention of readers of rmit.cs.chat. (For those unfamiliar, a stamper 'imprints' an ascii art image on/over some text) I quote from the homepage:
"A late modification to satisfy the Oxford Toff types is the addition of the "PANTS" stamp."
config.cache should always be removed if you have changed the CC, CXX, CFLAGS or CXXFLAGS environment vars."
Also see the WAI HTML Techniques and CSS Techniques documents.
Some users report that when they use Change Case to change the filenames to upper case, Windows Explorer shows filename with an initial capital and the rest is lower case after this change. In fact, this is NOT a bug of Change Case. This is a problem of Windows. If the length of folder/file name is less than or equal to 8 and the folder/file name is in upper case, Windows Explorer will display it with an initial capital. But if you use DIR command in MS-DOS prompt or in Netscape Navigator or FTP clients, you will see the filename is really upper case. This is designed by Windows.
Change Case is a CARDWARE. If you are using the program, please send a postcard to
Hai Li
No. 1607 Unit 133
Beijing Institute of Technology
Beijing 100081
PR China
Newsgroup: comp.os.ms-windows.networking.win95 In article [3403e909.767220765@harrogateX51], we heard from "jegan@shipway.u-net.com (James Egan)", who said: >IMHO an important requirement is to be able to force lowercase in >filenames. Win95 tends to mix and match upper and lower case which can >cause unneccessary problems on unix machines. Before anyone else gets confused, let's note that Unix also uses mixed upper and lower case. Or at least, Unix users often do. The difference is that Unix requires you to access the file with the same case that it was originally created. Win95 doesn't care what case you use, and will happily read file "README.TXT" when it is asked for "readme.txt" - Unix will simply insist the file does not exist. The Unix method is known as Case Sensitive, and the Windows method is Case Preserving. It's only a matter of convention that most users will give their file names in lower case on Unix machines. And it's a matter of poor programming that even telling a Windows NT command-line FTP client "put filename.dat filename.dat" may result in a file on the remote machine called "FILENAME.DAT". Alun. ~~~~ --- Texas Imperial Software | Try WFTPD, the Windows FTP Server. 1602 Harvest Moon Place | Available at the web site Cedar Park TX 78613 | http://www.wftpd.com Fax +1 (512) 378 3246 | or email me at alun@texis.com Phone +1 (512) 257 2578 | Now accepting credit card orders! =================================================================== ***** WFTPD Pro, an NT Service FTP Server supporting multiple ***** ** simultaneous virtual hosts, is now available for $80 per copy **
CARDWARE to Bill Klein 6950 Fielding, Apt 606 Montreal, Quebec H4V 1P7 Canada
An excerpt from e:\winnt\system32\drivers\etc\hosts: 127.0.0.1 ad.doubleclick.net That line prevents the DoubleClick ads from loading, and so prevents me from clicking the ads, as well as preventing my computer from having to load the ads.
ALL: ALL: spawn ((/bin/echo -n "user = %u\nclient = %h\nserver = %H\nprocess = %d\nPID = %p\ndate = "; /bin/date) | /bin/mail -s "Unauthorized access" root &)
Certainly, Wietse's rpcbind is an excellent choice for tightening up the portmapper. However, I'd have to ask why any RPC services are required on a web server -- I'm assuming that it's open to the outside world to access. I'd recommend going through every active network port and eliminating those that are not _essential_ to running the web server, at a minimum. YMMV. Cheers, Ken Kenneth R. van Wyk Vice President, Chief Technology Officer Para-Protect Services, Inc. krvw@para-protect.com http://www.para-protect.com
From: "Derrick Young" [derrick.young@washingtondc.ncr.com] Newsgroups: comp.security.unix Subject: Re: Restrict ROOT logon Date: Wed, 29 Sep 1999 15:18:48 -0400 look in /etc/default - there should be a file /etc/default/login - there should be an entry #console=/dev/console If you remove the comment (#) from this line and save the file then you will limit the root login to the console. Note, you will be able to su to root from any session - but not from the login prompt.
Here's a modified copy of the original ruleset using the
quick keyword:
block in quick all
pass in all
In this case, IPF looks at the first rule:
block in quick all
The packet matches and the search is over. The packet is
expunged without a peep. There are no notices, no logs, no
memorial service. Cake will not be served.
3.2. Implicit Allow; The "keep state" Rule
The job of your firewall is to prevent unwanted traffic
getting to point B from point A. We have general rules
which say "as long as this packet is to port 23, it's okay."
We have general rules which say "as long as this packet has
its FIN flag set, it's okay." Our firewalls don't know the
beginning, middle, or end of any TCP/UDP/ICMP session. They
merely have vague rules that are applied to all packets.
We're left to hope that the packet with its FIN flag set
isn't really a FIN scan, mapping our services. We hope that
the packet to port 23 isn't an attempted hijack of our tel-
net session. What if there was a way to identify and autho-
rize individual TCP/UDP/ICMP sessions and distinguish them
from port scanners and DoS attacks? There is a way, it's
called keeping state.
We want convenience and security in one. Lots of peo-
ple do, that's why Ciscos have an "established" clause that
lets established tcp sessions go through. Ipfw has estab-
lished. Ipfwadm has setup/established. They all have this
feature, but the name is very misleading. When we first saw
it, we thought it meant our packet filter was keeping track
of what was going on, that it knew if a connection was
really established or not. The fact is, they're all taking
the packet's word for it from a part of the packet anybody
can lie about. They read the TCP packet's flags section and
there's the reason UDP/ICMP don't work with it, they have no
such thing. Anybody who can create a packet with bogus
flags can get by a firewall with this setup.
Where does IPF come in to play here, you ask? Well,
unlike the other firewalls, IPF really can keep track of
whether or not a connection is established. And it'll do it
with TCP, UDP and ICMP, not just TCP. Ipf calls it keeping
state. The keyword for the ruleset is keep state.
9.1. Localhost Filtering
A long time ago at a university far, far away, Weitse
Venema created the tcp-wrapper package, and ever since, it's
been used to add a layer of protection to network services
all over the world. This is good. But, tcp-wrappers have
flaws. For starters, they only protect TCP services, as the
name suggests. Also, unless you run your service from
inetd, or you have specifically compiled it with libwrap and
the appropriate hooks, your service isn't protected. This
leaves gigantic holes in your host security. We can plug
these up by using ipf on the local host. For example, my
laptop often gets plugged into or dialed into networks that
I don't specifically trust, and so, I use the following rule
set:
pass in quick on lo0 all
pass out quick on lo0 all
block in log all
block out all
pass in quick proto tcp from any to any port = 113 flags S keep state
pass in quick proto tcp from any to any port = 22 flags S keep state
pass in quick proto tcp from any port = 20 to any port 39999 >< 45000 flags S keep state
pass out quick proto icmp from any to any keep state
pass out quick proto tcp/udp from any to any keep state keep frags
It's been like that for quite a while, and I haven't suf-
fered any pain or anguish as a result of having ipf loaded
up all the time. If I wanted to tighten it up more, I could
switch to using the NAT ftp proxy and I could add in some
rules to prevent spoofing. But even as it stands now, this
box is far more restrictive about what it presents to the
local network and beyond than the typical host does. This
is a good thing if you happen to run a machine that allows a
lot of users on it, and you want to make sure one of them
doesn't happen to start up a service they wern't supposed
to. It won't stop a malicious hacker with root access from
adjusting your ipf rules and starting a service anyway, but
it will keep the "honest" folks honest, and your weird ser-
vices safe, cozy and warm even on a malicious LAN. A big
win, in my opinion. Using local host filtering in addition
to a somewhat less-restrictive "main firewall" machine can
solve many performance issues as well as political night-
mares like "Why doesn't ICQ work?" and "Why can't I put a
web server on my own workstation! It's MY WORKSTATION!!"
Another very big win. Who says you can't have security and
convienence at the same time?
"Man pages for the portmapper say you can stuff "-A" or "-a 255.255.255.0,my.net.work.0" to only allow RPC from these places (the first means "my networks"); I've tried this, but it didn't do anything -- that is, I could still tickle anything RPC-ish from anywhere."
> *** A fragmentation attack against IP Filter *** > > April 6th, 2001 > > Thomas Lopatic> > The research for this advisory was supported by > >