TaoSecurity Blog

Several months ago I posted how I used Colin Percival's freebsd-update program to perform a binary upgrade from FreeBSD 5.4 to 6.0 remotely over SSH. Thanks to Colin's latest work , I was able to successfully perform a binary upgrade from FreeBSD 6.0 to 6.1 remotely over SSH. hacom:/root/upgrade# uname -a FreeBSD hacom.taosecurity.com 6.0-SECURITY FreeBSD 6.0-SECURITY #0: Tue Apr 18 08:56:09 UTC 2006 root@builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386 hacom:/root# fetch http://www.daemonology.net/freebsd-upgrade-6.0-to-6.1/upgrade-6.0-to-6.1.tgz upgrade-6.0-to-6.1.tgz 0% of 4706 kB hacom:/root# sha256 upgrade-6.0-to-6.1.tgz SHA256 (upgrade-6.0-to-6.1.tgz) = 29075fc5711e0b20d879c69d12bbe5414c1c56d597c8116da7acc0d291116d2f hacom:/root# tar -xzvf upgrade-6.0-to-6.1.tgz x upgrade x upgrade/upgrade.sh x upgrade/6.1-index x upgrade/6.0-index hacom:/root# cd upgrade hacom:/root/upgrade# ./upgrade.sh^M^M Examining system... done. The followin...

Last year I described performing a binary upgrade of FreeBSD 6.0 to 6.1. Today I tried a similar process for FreeBSD 6.1 to 6.2, using Colin Percival 's instructions for 6.1 to 6.2-RC1. shuttle01# mkdir /usr/upgrade shuttle01# cd /usr/upgrade shuttle01# fetch http://www.daemonology.net/freebsd-update/upgrade-to-6.2.tgz upgrade-to-6.2.tgz 100% of 18 kB 120 kBps shuttle01# tar -xzf upgrade-to-6.2.tgz shuttle01# cd upgrade-to-6.2 shuttle01# sh freebsd-update.sh -f freebsd-update.conf -d /usr/upgrade -r 6.2-RELEASE upgrade Looking up update.FreeBSD.org mirrors... 1 mirrors found. Fetching public key from update1.FreeBSD.org... done. Fetching metadata signature for 6.1-RELEASE from update1.FreeBSD.org... done. Fetching metadata index... done. Fetching 2 metadata files... done. Inspecting system... done. The following components of FreeBSD seem to be installed: kernel/smp world/base world/dict world/doc world/manpages The following components of FreeBSD...

Recently I posted FreeBSD Binary Upgrade News about developments with Colin Percival's FreeBSD Update tool. Today I performed a remote (via SSH) upgrade from FreeBSD 7.0-BETA2 to FreeBSD 7.0-BETA3 using FreeBSD Update. I document the process below so you can see how easy it is and for my future reference. Here is uname output to show the OS version prior to upgrading. # uname -a FreeBSD myhost.mydomain.com 7.0-BETA2 FreeBSD 7.0-BETA2 #0: Fri Nov 2 16:47:33 UTC 2007 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 I wasn't sure if the version of FreeBSD Update packaged with FreeBSD 7.0-BETA2 would natively support this process, so I gave it a try. # freebsd-update -r 7.0-BETA3 upgrade usage: freebsd-update [options] command ... [path] Options: -b basedir -- Operate on a system mounted at basedir (default: /) -d workdir -- Store working files in workdir (default: /var/db/freebsd-update/) -f conffile -- Read confi...

Yesterday I took control of a system running FreeBSD 5.4. I wanted to upgrade it to FreeBSD 6.0. I considered using cvsup to upgrade the userland and kernel, but I wanted an easier way. I also wanted to end up with a completely GENERIC system that would work well with freebsd-update. I decided to follow Colin Percival's FreeBSD 5.4 to FreeBSD 6.0 binary upgrade instructions. This process worked flawlessly. I am not going to repeat the steps here, but I will point out a few details. In step 2 of his process, Colin uses freebsd-update to create a base-modified file. Mine had these contents: # cat base-modified /.cshrc /boot/defaults/loader.conf /boot/kernel/kernel /boot/kernel/linker.hints /etc/group /etc/hosts /etc/manpath.config /etc/master.passwd /etc/motd /etc/passwd /etc/pwd.db /etc/shells /etc/spwd.db /etc/ttys /root/.cshrc /usr/share/man/cat1/crontab.1.gz /usr/share/man/cat1/tcpdump.1.gz /usr/share/man/cat1/uname.1.gz /usr/share/man/cat8/ifconfig.8.gz /usr/share/man/wha...

I detest having to upgrade core FreeBSD packages like Perl that are relied upon by so many other applications. All of my systems are old and dog slow, so I tend to install software on FreeBSD using its native package system. For example, before installing a package, I set this environment variable: setenv PACKAGESITE ftp://ftp6.freebsd.org/pub/FreeBSD/ports/i386/packages-5-stable/Latest/ Replace '6' with the number of the mirror closest to you. That command tells pkg_add to not use the default RELEASE packages, but to look for the latest STABLE package. Those packages are built by the FreeBSD ports cluster and are kept fairly current. The problem with such a system is that the packages may get ahead of my upgrade plans. For example, if my system is running Perl 5.8.6_2 and the ports cluster is building packages that look for Perl 5.8.7, I will eventually run into trouble. That happened this weekend. I installed security/metasploit , which was built as a package for Perl 5...

If you've read my previous posts on FreeBSD binary upgrades you'll see that Colin Percival's work on this subject has been one of my favorite additions to FreeBSD during the last few years. I recommend reading the latest two posts on Colin's blog for even more good news: FreeBSD minor version upgrades and FreeBSD major version upgrades using FreeBSD update . I plan to deploy FreeBSD 7.0 in production soon, and the native capability to upgrade the OS using binary means is incredibly welcome. I build sensors to inspect and capture traffic, not recompile themselves. Congratulations and thanks to Colin for all of his work in this area and for integrating FreeBSD update into the base OS. On another FreeBSD note, I need to try this: Building bootable FreeBSD/i386 images .

I'd like to mention a few FreeBSD news items. First, FreeBSD 6.2 was released Monday. I am not rushing to install it but I plan to deploy it everywhere. I have a subscription to FreeBSDMall.com , so I don't need to download any .iso's at the moment. I plan to upgrade all existing FreeBSD 6.1 systems using Colin Percival's 6.1 to 6.2 binary upgrade script . I am particularly glad to see that Colin's freebsd-update utility is now part of the base system. Second, FreeSBIE 2.0 , a FreeBSD live CD based on FreeBSD 6.2, was just released . I plan to download and try it out, at least in a VM. I'll probably burn a CD to use for testing FreeBSD support on various hardware. Third, this BSDNews.com story pointed me to a site watching developments in FreeBSD 7.0 , called What's cooking for FreeBSD 7.0? . It provides a quick summary of features expected in the next major version of FreeBSD. Keeping with the development theme, the Oct-Dec 2006 status report...

In my last post I discussed upgrading from FreeBSD 7.0 to 7.1. In this post I'll mention packages that needed to be updated. In the last post I showed two installed packages using the native pkg_info command. neely# pkg_info cdrtools-2.01_6 CD/CD-R[W] and ISO-9660 image creation and extraction tools dvd+rw-tools-7.0 DVD burning software At this point I could have used pkg_delete to remove them, and added the newest packages via pkg_add. Because that is easy, I decided to show an alternative that might be better for systems with many packages. I decided to use Portupgrade to update packages installed on the system. Portupgrade was not on the box so I added it via pkg_add. I used the -n switch to do a "dry run" to see what version would be added. neely# pkg_add -vrn portupgrade scheme: [ftp] user: [] password: [] host: [ftp.freebsd.org] port: [0] document: [/pub/FreeBSD/ports/i386/packages-7.1-release/Latest/portupgrade.tbz] ---> ftp.freebsd.org:...

I am happy to announce that progress is being made towards the release of FreeBSD 7.0. This announcement says the release cycles for FreeBSD 7.0 and 6.3 have begun. The first 7.0-BETA1 .iso's you might want to test on a fresh system have been published. The announcement says "Instructions on using FreeBSD Update to perform a binary upgrade from FreeBSD 6.x to 7.0-BETA1 will be provided via the freebsd-stable list when available." The FreeBSD 7.0 release schedule is available, and it shows FreeBSD 7.0 is scheduled for publication on 17 Dec 07. I would love to see this happen, but it's likely to take place about a month later. However, given the time between now and December, it's possible 7.0 will arrive by the end of the year. It looks like the todo list is rather small. While researching this story I found Bruce Mah's FreeBSD Release Documentation Snapshot Page . A large amount of documentation for each release is published there. When available I w...

I discovered a system running NetBSD 2.0 in my lab and decided to upgrade it to NetBSD 2.0.2 . I read that "this is also the first binary security/critical update since NetBSD 2.0." I found a thread which gave various forms of advice on updating to NetBSD 2.0.2 from 2.0. Here is what I did. When I started the system was running NetBSD 2.0. bash-2.05b# uname -a NetBSD juneau.taosecurity.com 2.0 NetBSD 2.0 (GENERIC) #0: Wed Dec 1 10:58:25 UTC 2004 builds@build:/big/builds/ab/netbsd-2-0-RELEASE/ i386/200411300000Z-obj/big/builds/ab/ netbsd-2-0-RELEASE/src/sys/arch/i386/compile/GENERIC i386 First I downloaded base.tgz, comp.tgz, kern-GENERIC.tgz, man.tgz, misc.tgz, and text.tgz into a directory I created called /usr/tmp. The FTP server directory listing shows what was available in total. juneau# ftp ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0.2/i386/binary/sets/ Trying 204.152.190.13... Connected to ftp.netbsd.org. ...edited... ftp> ls 229 Entering Extended Passive ...

Previously for this blog I've described my reliance on precompiled FreeBSD packages, rather than building everything from source. Today that tendency bit me. I tried to run Thunderbird and Firefox after updating my packages and saw the following errors. orr:/home/richard$ thunderbird /libexec/ld-elf.so.1: /usr/local/lib/libplds4.so.1: Undefined symbol "gethostbyname_r" orr:/home/richard$ firefox /libexec/ld-elf.so.1: /usr/local/lib/libplds4.so.1: Undefined symbol "gethostbyname_r" That's a pain, since researching the problem without Firefox could be clumsy. Luckily (or unluckily) I remembered encountering this exact problem earlier. This may indicate a problem that needs to be fixed on the package building systems, but I can show you how to recover. First I figured out where /usr/local/lib/libplds4.so.1 originated. orr:/var/db/pkg$ grep -R plds * nspr-4.6.3_1/+CONTENTS:lib/libplds4.a nspr-4.6.3_1/+CONTENTS:lib/libplds4.so nspr-4.6.3_1/+CONTENTS:lib/lib...

Last night I attended the northern Virginia ISSA monthly meeting. The guest speaker was Dean Iacovelli, Security Systems Architect for the Microsoft Mid-Atlantic district. His overall theme was "beyond patching." Dean supports over 200 enterprise customers, for which he serves as "security pinata ." Several ISSA members took him to task for Microsoft's security failings, but I thought Dean was diplomatic and handled their mildly aggressive questions well. Dean said that the patching approach to security is becoming a "second or third line defense, like backups. You patch regularly but hope you don't need them." As evidence he cited the decreasing window of time between announcement of a vulnerability and release of an exploit. Patches are still the best way to fix a vulnerability in broken software, so Microsoft has been pursing multiple initiatives to improve their patches. First, Microsoft is migrating from multiple update sites (e.g., O...

The purpose of this post is not to bash Microsoft, but I am going to point out why I prefer relying on open source platforms, especially for sensitive systems. One of the advantages of the open source model is that anyone can identify and evaluate changes. This is especially true of open source projects like FreeBSD . Let's look at a recent security advisory in ntpd to demonstrate what I mean. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-09:11.ntpd Security Advisory The FreeBSD Project Topic: ntpd stack-based buffer-overflow vulnerability Category: contrib Module: ntpd Announced: 2009-06-10 Credits: Chris Ries Affects: All supported versions of FreeBSD. Corrected: 2009-06-10 10:31:11 UTC (RELENG_7, 7.2-STABLE) 2009-06-10 10:31:11 UT...

I am happy to announce the publication at TaoSecurity.com of Keeping FreeBSD Up-To-Date . I wrote this article to answer questions I've received over the past few months on how to apply security fixes to a FreeBSD system. While the official Handbook is excellent, I thought a case-study approach would be enlightening for some readers. I thought it would be interesting to see a box begin life as FreeBSD 5.2.1 RELEASE, and then progress through a variety of security fixes applied in different ways. The article's sections include: Introduction FreeBSD Versions Learning About Security Issues Starting with the Installation Binary OS and Userland Updates with FreeBSD Update Applying Kernel Patches Manually Applying Userland Patches Manually, Part 1 Applying Userland Patches Manually, Part 2 CVSup to 5_2 Security Branch Beyond the Security Branch STABLE: The End of the Line The "Next" STABLE Conclusion Acknowledgements References Sections show commands to run, explanati...

Just in time to raise my spirits after my SMC NIC debacle, FreeBSD 5.2.1 was released, along with Snort 2.1.1 . All I need now is barnyard 0.2 and I'll release a new install guide for Sguil using those tools and MySQL 4.0.x . Remember to download FreeBSD .iso images using one of the mirrors . If you want to upgrade you can go the binary-only route using freebsd-update . I just saw that OpenSSh 3.8 was released too. There's a FreeBSD HEADS-UP message for the new version.

In my post NSM-Friendly VMware Lab Setup I mentioned wanting to use NSMNow to install Sguil on Ubuntu 8.04 for student use in my next class. I had tried the Securix-NSM live CD but I had not tried installing Sguil using the same project's NSMNow scripts. I just did it: root@twsu804:/usr/local/src# wget http://www.securixlive.com/download/nsmnow/NSMnow-1.1.1.tar.gz --22:14:38-- http://www.securixlive.com/download/nsmnow/NSMnow-1.1.1.tar.gz => `NSMnow-1.1.1.tar.gz' Resolving www.securixlive.com... 202.191.61.156 Connecting to www.securixlive.com|202.191.61.156|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 164,613 (161K) [application/x-gzip] 100%[====================================>] 164,613 53.85K/s 22:14:42 (53.80 KB/s) - `NSMnow-1.1.1.tar.gz' saved [164613/164613] root@twsu804:/usr/local/src# tar -xzvf NSMnow-1.1.1.tar.gz NSMnow-1.1.1/ NSMnow-1.1.1/NSMnow-core NSMnow-1.1.1/RELEASE.NOTES NSMnow-1.1.1/templ...

I previously reported running FreeBSD 6.0 on my Hacom Lex Twister VIA 1 GHz Nehemiah. Today I decided to install Debian on it. I will warn you now that the majority of this post is documentation for my own reference, and the hope it might help someone else. If you're looking for short, pithy security insights, today is not your day. I used a USB-connected external CD burner as my installation source. The Hacom is very temperamental with it. I had to disable all booting sources except the USB-CD. Next I booted the Hacom with the USB-CD off. Once I got an error from the BIOS about a lack of bootable devices, I then turn on the USB-CD and press to try booting again. Installing Debian on the Hacom was fairly painless. I did not add any packages with aptitude during the installation. That meant the following packages were installed. hacom:~# dpkg --list Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed |/ Err?...