TaoSecurity Blog

I've been trying Webmin on FreeBSD, Solaris 8, and HP-UX 11i today. Once I repatriate my AIX box from my employer, I intend to install Webmin on it as well. For FreeBSD, I installed the package provided by the FreeBSD project. For Solaris, I used the package provided by Webmin. For HP-UX, I downloaded the tarball and installed from source. I tried the version packaged by HP with their port of Apache and Tomcat, but couldn't get it to install on its own. Webmin uses its own "miniserv.pl" so Apache is not needed. Webmin is a Web-based, cross-platform system administration tool. Although I'm not a huge fan of Web-based interfaces , Webmin is slick. I recommend installing the Swelltech theme , which is cleaner than the default. Using Webmin I successfully installed the lsof package for FreeBSD and Solaris . I didn't have any luck with the same package for HP-UX . Webmin allows you to run commands through the Web browser, so once lsof was installed ...

Today I was asked for my recommendation for a "security 101" book. I hadn't given the subject much thought, although I think Ed Skoudis' Counter-Hack is a great place to start. I looked around my office and found a book Addison-Wesley sent me last year: Internet Site Security by Erik Schetina, Ken Green, Jacob Carlson. After thumbing through the book, I've decided it's excellent. I won't review it on Amazon.com, since my policy is to only review books I've read. Still, a mention here is worthwhile. This book is so solid I adopted its "assess -> protect -> detect -> respond" security process model to replace the "plan -> prevent -> detect -> respond" version in my own book, just to avoid reinventing the wheel. They also correct state the risk equation as "risk = threat X vulnerability X asset value." If you're looking to get your feet wet in security, or if you're a manager who needs to...

No sooner had I posted the entry on Sysmon than it detected a network problem. Two of my systems were unreachable. They both sat of a DMZ leg of my gateway. After troubleshooting at various layers I narrowed the issue down to a faulty NIC in the gateway. How often does that happen? Unfortunately the bad NIC is a Intel PRO/100+ Dual Port Server Adapter (PILA8472) . When trying to ping out from the NIC to the DMZ, here's the sort of traffic the NIC generated: 00:39:18.628691 192.168.60.1 > 192.168.60.3: icmp: echo request 00:39:19.638731 0:0:0:0:0:0 > 0:0:0:0:0:0 sap 00 I (s=0,r=0,C) len=80 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 00:39:20.648696 0:0:0:0:0:0 > 0:0:0:0:0:0 sap 00 I (s=0,r=...

I thought the best I could do for help running FreeBSD on laptops was Linux on Laptops , until I learned of the FreeBSD Laptop Compatibility List . This site even had an entry for my Thinkpad a20p . There's an article at Freebsd.org and another database of information also available. I've had various versions of FreeBSD running on this laptop since I tried installing FreeBSD 4.1.1 . I plan to install FreeBSD 5.2 REL once issues in the todo list are solved.

While reading a recent Network Computing magazine article, I noticed an interesting discussion of "DNS-based route optimizers." These sounded like the products which confused IDS operators four years ago. I read about it in an earlier NWC article . This December 2003 article states: "Handling external Web requests... is accomplished by advertising a low DNS TTL of about 10 seconds. This forces the end user's DNS server to request an updated IP address every 10 seconds... the device will provide the external IP address that will provide the best path through the network." The whole idea with DNS-based systems is to trick clients into visiting the server that's "closest" to them in Internet space. By "closest" I mean the one offering the lowest latency. It's a performance enhancement for visitors. NWC's graphic does a nice job explaining the system. Notice the mention of "probes." The review mentions ICMP and TCP-b...

While perusing the newgroups at unix.derkeiler.com , I learned a new way to get FreeBSD. The FreeBSD Project publishes .iso images of its release software, like 4.9 REL or 5.1 REL. Easy enough. Mirrors for these distributions are available at FreeBSD mirrors . However, I discovered the FreeBSD Snapshots site offers .iso images of the latest version of each tree, e.g., 4-stable and 5-current. You can download the .iso and finish with a system running the newest FreeBSD, assuming they work on your hardware. If you're more conservative, they maintain a "security release" of the 4.8 distribution as well, which right now is 4.8-RELEASE-p13. You can even finger their server to learn the newest builds available there: finger @snapshots.jp.freebsd.org [snapshots.jp.freebsd.org] FreeBSD/i386: The latest version of FreeBSD -CURRENT is: 5.2-CURRENT-20031227-JPSNAP The latest version of FreeBSD 4-STABLE is: 4.9-STABLE-20031202-JPSNAP FreeBSD/alpha: The latest version of FreeB...

People complain about FreeBSD's '/stand/sysinstall' program, but I wish I could have used it yesterday when adding an 8 GB HDD to my NetBSD box. I loosely followed the official documentation but laughed when I read "Now we create some disklabel partitions, editing the tempfile as already explained. The result is...", followed by a disklabel output created from scratch! This reminded me of the "intuitively obvious" phrase from my college calculus books. Here's how I did it. This is what the disk looked in dmesg output: wd1 at pciide0 channel 0 drive 1: wd1: drive supports 16-sector PIO transfers, LBA addressing wd1: 8063 MB, 16383 cyl, 16 head, 63 sec, 512 bytes/sect x 16514064 sectors wd1: 32-bit data port wd1: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2 (Ultra/33) wd1(pciide0:0:1): using PIO mode 4, Ultra-DMA mode 2 (Ultra/33) (using DMA data transfers) First I ran fdisk. Notice the BIOS never seems to get the HDD geometry corre...