TaoSecurity Blog

After trying 60 Free Minutes with Ubuntu 10.10 in Amazon EC2 yesterday, I decided to take the next step and try the AWS Free Usage Tier . This blog post by Jay Andrew Allen titled Getting Started (for Free!) with Amazon Elastic Cloud Computing (EC2) helped me. One important caveat applies: this activity will not be completely free. The AMI chose uses a 15 GB filesystem, and the terms of the free usage stipulate no more than a 10 GB filesystem. I'll pay $0.50 per month for the privilege of using a prebuilt Ubuntu AMI. Since I'm an AMI n00b, I decided to pay the $0.50. At some point when I am comfortable creating or trusting 10 GB AMIs, maybe I'll switch. First I visited http://aws.amazon.com/ec2/ and signed up for Amazon EC2. At Amazon Web Services Sign In, I chose to "Identity Verification by Telephone." When I completed sign up I received three emails: 1) Amazon Virtual Private Cloud Sign-Up Confirmation; 2) Amazon Elastic Compute Cloud Sign-Up Confirm...

I decided to try Ubuntu in the Cloud because 1) I had a few minutes this afternoon and 2) it's free. If you follow the directions on their Web site you'll have access to an Ubuntu 10.10 server for 60 minutes, hosted by Amazon Elastic Compute Cloud (Amazon EC2) . It's really simple, so easy a caveman could do it. (Ouch.) First make sure you have a public-private SSH key pair. richard@neely:~$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/home/richard/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/richard/.ssh/id_rsa. Your public key has been saved in /home/richard/.ssh/id_rsa.pub. The key fingerprint is: c6:e0:9c:84:74:3d:2d:09:b3:a2:e5:97:7b:63:59:da richard@neely The key's randomart image is: +--[ RSA 2048]----+ | . +o o | | . o o= . | | + + o | | + = = | | . . * S . | | . o = | | ...

I hear and read a lot about how IT is supposed to innovate to enable "the business." Anytime I see "IT" in one part of a sentence and "the business" in another, a little part of me dies. Somewhere there is a Nirvana where "thought leaders" understand that there is no business without IT , that IT is as part of the business as the sales person or factory worker or janitor, and that IT would be better off not constantly justifying its existence to "the business." But I digress. I want to address the "innovation" issue in this post. CIO magazine recently published an interview with Vinnie Mirchandani titled Taking Business Risks With Your IT Budget . I liked what Mr Mirchandani had to say, although I'm going to omit his multiple references to "cloud." Instead, consider how he sees innovation in IT: More [CIOs] want to be [innovators], but organizations don’t let them... In the 1980s, we talked about IT as a...

In my last post I lamented a problem with Sendmail on FreeBSD. I was trying to troubleshoot a problem sending email from FreeBSD's periodic scripts to Gmail. I've determined that, as crazy as this sounds, Gmail is broken. (Some of you are probably not surprised. If you want to skip the drama and see the bottom line, scroll to the bottom of the post.) Let me start my case by showing network transcripts of one successful "periodic" email and one unsuccessful "periodic" email. I'm not going to change any email addresses in this post. The following email is delivered successfully . Computer vm.taosecurity.com sits behind NAT so the public IP is 73.128.35.11. The entries prior to the SMTP transactions (e.g. 074.125.091.027.00025-073.128.035.011.57184: and similar) were added by Tcpflow, which I used to render the transcript manually. 074.125.091.027.00025-073.128.035.011.57184: 220 mx.google.com ESMTP my6si2476635qcb.101 073.128.035.011.57184-074.125.0...

Thanks for the help with my script issue recently. I was wondering if anyone has seen this problem with Sendmail? I aliased root to "taosecurity at gmail dot com" as shown below. (I used the real email address on the computer.) This is a fresh install of FreeBSD 8.1. $ uname -a FreeBSD vm.taosecurity.com 8.1-RELEASE FreeBSD 8.1-RELEASE #0: \ Mon Jul 19 02:55:53 UTC 2010 \ root@almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 vm# diff -u /etc/aliases /etc/aliases.orig --- /etc/aliases 2010-11-18 10:30:37.000000000 -0500 +++ /etc/aliases.orig 2010-11-18 10:30:26.000000000 -0500 @@ -18,7 +18,6 @@ # root's email from here. # root: me@my.domain -root: taosecurity at gmail dot com # Basic system aliases -- these MUST be present MAILER-DAEMON: postmaster vm# newaliases /etc/mail/aliases: 28 aliases, longest 21 bytes, 300 bytes total My /etc/mail and /var/spool directories are pristine from the factory" vm# ls -al /etc/mail total 300 drwxr-xr-x 2 ro...

Thanks to @sevanjaniyan and @cperciva for helping with my FreeBSD startup script issue. By removing the ${barnyard2_flags} argument from the command_args section I was able to start barnyard2 properly: root 45842 54.9 0.5 18572 11116 ?? Ss 7:15PM 0:00.00 /usr/local/bin/barnyard2 -D -U -d /nsm/r200a -f snort.unified2 -c /usr/local/etc/nsm/barnyard2.conf In other words, the script has this now: . /etc/rc.subr name="barnyard2" load_rc_config $name rcvar=`set_rcvar` # set some defaults : ${barnyard2_enable="NO"} : ${barnyard2_conf="/usr/local/etc/barnyard2.conf"} : ${barnyard2_flags="-D"} command="/usr/local/bin/barnyard2" command_args="-c ${barnyard2_conf}" run_rc_command "$1" I made changes to some other startup scripts and needed to commit them via Git. I did it this way. richard@macmini:~/taosecurity_freebsd_sguil$ git status # On branch master # Changes to be committed: # (use "git reset HEAD ....

Has anyone encountered this situation? I've found several startup scripts on FreeBSD that result in duplicate arguments passed during startup. For example: vm# uname -a FreeBSD vm.taosecurity.com 7.3-RELEASE FreeBSD 7.3-RELEASE #0: Sun Mar 21 06:15:01 UTC 2010 root@walker.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 vm# pkg_info sancp-1.6.1_3 A network connection profiler vm# cat /etc/rc.conf # -- sysinstall generated deltas -- # Fri Nov 12 16:36:42 2010 # Created: Fri Nov 12 16:36:42 2010 # Enable network daemons for user convenience. # Please make all changes to this file, not to /etc/defaults/rc.conf. # This file now contains just the overrides from /etc/defaults/rc.conf. defaultrouter="10.10.1.1" hostname="vm.taosecurity.com" ifconfig_em0="inet 10.10.1.13 netmask 255.255.255.0" sshd_enable="YES" sancp_enable="YES" sancp_interface="em0" vm# cat /usr/local/etc/rc.d/sancp #!/bin/sh # # PROVIDE: sancp # ...