TaoSecurity Blog

In the October issue of Daemon News , Poul-Henning Kamp asks "Why Bother?" He wants to know why people use FreeBSD when Linux gets most of the attention from users and vendors. He also wants to know why developers should continue to work on FreeBSD. I will tailor my response for FreeBSD, as that is the BSD with which I am most familiar. Some of my arguments will apply to other variants. Some of my reasons even apply to other open source operating systems, like Linux. Few will apply to closed operating systems, least of which Windows. 1. FreeBSD is open source , with a business-friendly license . Being an open source, BSD-licensed operating system means I am free to modify the OS as I see fit and can continue to support and evolve any part of it, should the official developers decide to abandon any aspect of the project. I can use FreeBSD in commercial projects as long as I retain the copyright notice and disclaimer with the product. 2. FreeBSD is an integrated, co...

As a former intelligence officer and computer network defender I was asked my thoughts on the US Air Force 's new computing deal with Microsoft . In short, Microsoft will provide core server software, maintenance and upgrade support, and Dell will supply more than 525,000 Microsoft desktop Windows and Office software licenses to the Air Force. From a business perspective, this is an important deal for Microsoft. For all of their seeming independence, the services tend to watch each other closely to see what technological advances are being considered or pursued. When the Navy began work on its Navy Marine Corp Intranet (NMCI), Air Force leaders scrambled to "catch up" to match the "progress" the Navy was assumed to be making. (NMCI has since produced mixed results for the Navy and financial woes for EDS , prime NMCI contractor.) I have first-hand knowledge of the Air Force's response to NMCI. In the fall of 2000, the AFCERT sent me to Washington, DC...

On Wednesday I mentioned that a chapter from my book appeared in a new form at Informit.com. A snort-users reader asked how Sguil differed from ACID and BASE . In short, there are five reasons: 1. Sguil is a real-time interface to Snort alerts (and more). 2. Sguil is a Snort alert management system with integrated analyst accountability features. 3. Sguil offers growing alert handling capabilities. 4. Sguil is built to minimize "window management," "form management," and other non-analytical tasks. 5. Most importantly, Sguil is not limited to investigating events using Snort alert data alone. To read explanations of each point, please see my response to the snort-users mailing list. You'll also find in that message three "features" that are not present in Sguil. I should have mentioned that Sguil is the single tool most likely to provide analysts with the information they need to make a decision . With Sguil, a Snort alert is not the end of t...

While browsing the tcpdump-workers mailing list I came across a post describing the The Meta Traffic Processor PCI Card . This device "is a standard 32-bit/33MHz, PCI half-card with two copper Ethernet ports. The MTP appears to the host's operating system as a standard network interface card capable of enforcing from 600 to 1500 stateful policies to capture and/or block specific packets. The policies can be directly derived from public domain signatures or they can be completely user defined." These "policies" can be Snort rules or one day BPF filters. The product appears to be the result of work done for a NSF grant . Metanetworks founder Livio Ricciulli described his project to NANOG in May 04. I had heard from a .mil type that DoD was working with a vendor to run Snort-like applications in hardware. Perhaps this is what he meant? I intend to contact Livio to see if his card works with FreeBSD.

Several recent Blog entries described ways to keep FreeBSD applications up-to-date. Based on my use of these tools, this is how I chose to update one of my servers this morning. First I updated the ports tree, INDEX-5, and INDEX.db: cd /usr/ports portsnap fetch portsnap update make fetchindex portsdb -u Next I checked to see which applications needed to be updated: janney:/usr/ports# portversion -v -l " bash-3.0.15 freebsd-update-1.6 sudo-1.6.8.1 I prefer to update applications by using precompiled packages provided by the FreeBSD team. Unfortunately, the packages-5-stable FTP site hasn't been updated since 15 Nov. I decided to press ahead and update these three packages on my own by building the upgrades from source. I used portupgrade to (in the order of the switches shown), be verbose, update all packages whose versions are outdated, update packages that depend on the package being updated, update packages that the package being u...

Last night the FreeBSD ports tree broke the 12,000 mark. The tree has added about 2000 ports per year for the past four years. This graph shows the number of ports added per year since 1995. I commend FreshPorts for providing such an excellent interface to the tree, and for keeping up with the growth in the number of applications available. FreshPorts recently integrated VuXML data, allowing users to visually see what port versions have a security issue. More details and information on other upgraded FreshPorts features are available here .

Now that we've seen how to keep the ports tree up-to-date using tools like Portsnap, and seen how to generate an INDEX-5 file with 'make index', I'd like to offer an alternative INDEX-5 generation mechanism. Matthew Seaman's Portindex is a Perl tool replacing a similar application of the same name. The old version was pulled from the ports tree when the developer started acting strangely. Here's the problem Portindex solves. If you use CVSup to update your ports tree, you will not have an INDEX-5 file. The INDEX-5 file included in CVS was reportedly always out-of-date, so you had to issue a command like 'portsdb -U' or 'make index' to create the INDEX-5 file. This was very time-consuming. Portindex is a much faster alternative, once you've set up the system. Portindex is available in the ports tree as sysutils/p5-FreeBSD-Portindex , so installation is easy (as long as your ports tree is updated!) My installation is based on Matthew...