TaoSecurity Blog

After reading PHK's Why Bother? article, I wondered about the goals of the FreeBSD project. I found them in the handbook : "1.3.2 FreeBSD Project Goals Contributed by Jordan Hubbard. The goals of the FreeBSD Project are to provide software that may be used for any purpose and without strings attached. Many of us have a significant investment in the code (and project) and would certainly not mind a little financial compensation now and then, but we are definitely not prepared to insist on it. We believe that our first and foremost 'mission' is to provide code to any and all comers, and for whatever purpose, so that the code gets the widest possible use and provides the widest possible benefit. This is, I believe, one of the most fundamental goals of Free Software and one that we enthusiastically support. That code in our source tree which falls under the GNU General Public License (GPL) or Library General Public License (LGPL) comes with slightly more strings attached...

In the October issue of Daemon News , Poul-Henning Kamp asks "Why Bother?" He wants to know why people use FreeBSD when Linux gets most of the attention from users and vendors. He also wants to know why developers should continue to work on FreeBSD. I will tailor my response for FreeBSD, as that is the BSD with which I am most familiar. Some of my arguments will apply to other variants. Some of my reasons even apply to other open source operating systems, like Linux. Few will apply to closed operating systems, least of which Windows. 1. FreeBSD is open source , with a business-friendly license . Being an open source, BSD-licensed operating system means I am free to modify the OS as I see fit and can continue to support and evolve any part of it, should the official developers decide to abandon any aspect of the project. I can use FreeBSD in commercial projects as long as I retain the copyright notice and disclaimer with the product. 2. FreeBSD is an integrated, co...

As a former intelligence officer and computer network defender I was asked my thoughts on the US Air Force 's new computing deal with Microsoft . In short, Microsoft will provide core server software, maintenance and upgrade support, and Dell will supply more than 525,000 Microsoft desktop Windows and Office software licenses to the Air Force. From a business perspective, this is an important deal for Microsoft. For all of their seeming independence, the services tend to watch each other closely to see what technological advances are being considered or pursued. When the Navy began work on its Navy Marine Corp Intranet (NMCI), Air Force leaders scrambled to "catch up" to match the "progress" the Navy was assumed to be making. (NMCI has since produced mixed results for the Navy and financial woes for EDS , prime NMCI contractor.) I have first-hand knowledge of the Air Force's response to NMCI. In the fall of 2000, the AFCERT sent me to Washington, DC...

On Wednesday I mentioned that a chapter from my book appeared in a new form at Informit.com. A snort-users reader asked how Sguil differed from ACID and BASE . In short, there are five reasons: 1. Sguil is a real-time interface to Snort alerts (and more). 2. Sguil is a Snort alert management system with integrated analyst accountability features. 3. Sguil offers growing alert handling capabilities. 4. Sguil is built to minimize "window management," "form management," and other non-analytical tasks. 5. Most importantly, Sguil is not limited to investigating events using Snort alert data alone. To read explanations of each point, please see my response to the snort-users mailing list. You'll also find in that message three "features" that are not present in Sguil. I should have mentioned that Sguil is the single tool most likely to provide analysts with the information they need to make a decision . With Sguil, a Snort alert is not the end of t...

While browsing the tcpdump-workers mailing list I came across a post describing the The Meta Traffic Processor PCI Card . This device "is a standard 32-bit/33MHz, PCI half-card with two copper Ethernet ports. The MTP appears to the host's operating system as a standard network interface card capable of enforcing from 600 to 1500 stateful policies to capture and/or block specific packets. The policies can be directly derived from public domain signatures or they can be completely user defined." These "policies" can be Snort rules or one day BPF filters. The product appears to be the result of work done for a NSF grant . Metanetworks founder Livio Ricciulli described his project to NANOG in May 04. I had heard from a .mil type that DoD was working with a vendor to run Snort-like applications in hardware. Perhaps this is what he meant? I intend to contact Livio to see if his card works with FreeBSD.

Several recent Blog entries described ways to keep FreeBSD applications up-to-date. Based on my use of these tools, this is how I chose to update one of my servers this morning. First I updated the ports tree, INDEX-5, and INDEX.db: cd /usr/ports portsnap fetch portsnap update make fetchindex portsdb -u Next I checked to see which applications needed to be updated: janney:/usr/ports# portversion -v -l " bash-3.0.15 freebsd-update-1.6 sudo-1.6.8.1 I prefer to update applications by using precompiled packages provided by the FreeBSD team. Unfortunately, the packages-5-stable FTP site hasn't been updated since 15 Nov. I decided to press ahead and update these three packages on my own by building the upgrades from source. I used portupgrade to (in the order of the switches shown), be verbose, update all packages whose versions are outdated, update packages that depend on the package being updated, update packages that the package being u...

Last night the FreeBSD ports tree broke the 12,000 mark. The tree has added about 2000 ports per year for the past four years. This graph shows the number of ports added per year since 1995. I commend FreshPorts for providing such an excellent interface to the tree, and for keeping up with the growth in the number of applications available. FreshPorts recently integrated VuXML data, allowing users to visually see what port versions have a security issue. More details and information on other upgraded FreshPorts features are available here .