TaoSecurity Blog

Amazon.com just posted my four star review of Network Security Hacks . My review probably sounds a little harsher than I intended, but I was worn down trying to get SPADE to integrate with a version of Snort newer than 2.0.5. The review mentions finding Spade 030125.1 on a Polish student's FTP site , which seems to be the only place it exists, aside from an old Archive.org copy. It seems the snort.conf v. 1.85 is the last to include SPADE directions in its text, even though the contrib directory has a really old SPADE version (Spade-092200.1.tar.gz), from Sep 00. Anyway, from the review: "'Network Security Hacks' (NSH) has something for nearly everyone, although it focuses squarely on Linux, BSD, and Windows, in that order of preference. Administrators for commercial UNIX variants (Solaris, AIX, HP-UX, etc.) should be able to apply much of the book's advice to their environments, but they are not the target audience. NSH is written for admins needing quic...

Amazon.com just posted my five star review of Secure Architectures with OpenBSD . From the review: "About a year ago I read and reviewed Michael Lucas' excellent "Absolute OpenBSD." That book covered OpenBSD 3.2 and the CURRENT of that time, pre-3.3. Palmer and Nazario's "Secure Architectures with OpenBSD" (SAWO) addresses OpenBSD 3.4, which at the time of writing is just behind the current release (3.5). Lucas' book is an excellent introduction to OpenBSD by a relative outsider; SAWO is a more detailed discussion by insiders. Each has its strengths and I highly recommend both."

Do you run one of the BSDs? If so, consider sending the output of the dmesg command to the New York City BSD User's Group dmesg board . This is a great way to share information on supported hardware. I learned about this site through BSDNews.com . A response to that story mentioned this site which tracks SMP systems running FreeBSD.

If you're on a SANS mailing list you might have received the following email from "Stephen Northcutt." I haven't decided if it's true or not. I'm wondering why I would have received it, unless someone forged the message after acquiring a SANS email list? The alternative means Stephen Northcutt himself is making some odd claims... "From - Thu Jun 24 22:27:26 2004 X-UIDL: 40a19c3900000b29 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: ...edited... X-ClientAddr: 63.100.47.56 Received: from 63-100-47-56.sans.org (63-100-47-56.sans.org [63.100.47.56]) ...edited... Date: Fri, 25 Jun 2004 2:14:37 +0000 Message-Id: From: Stephen Northcutt Subject: Stephen Northcutt needs your help Precedence: bulk Errors-To: Sender: To: Richard Bejtlich (SD599258) ...edited... Hello, This note is intended for U.S. citizens and is a personal note from Stephen Northcutt. For the past few weeks CERT and SEI, DoD government funded organizations, have be...

Yesterday I reported my results burning CDs with FreeBSD. This morning I tried creating a DVD of the Fedora Core 2 distribution. After I downloaded the 4.1 GB .iso from a mirror, I used MD5 to verify the checksum matched. Since the .iso was ready to burn, I set up my Plextor burner. First I checked the media, which was Memorex 4X DVD-R 4.7GB (pictured at left, purchased at buy.com ). I had already installed dvd+rw-tools , available in the ports tree as sysutils/dvd+rw-tools . Using the dvd+rw-mediainfo command, I checked the DVD in the burner: # dvd+rw-mediainfo /dev/cd0 INQUIRY: [PLEXTOR ][DVDR PX-708A ][1.06] GET [CURRENT] CONFIGURATION: Mounted Media: 11h, DVD-R Sequential Media ID: ProdiscS03 Current Write Speed: 4.0x1385=5540KB/s Write Speed #0: 4.0x1385=5540KB/s Write Speed #1: 2.0x1385=2770KB/s Write Speed #2: 1.0x1385=1385KB/s GET [CURRENT] PERFORMANCE: Write Performance: 4.0x1385=5540KB/s@[0 ->...

I needed to become familiar with burning CDs on FreeBSD to support plans for live CD-based systems. I recently bought a Plextor PX-708UF DVD+-R/RW CD-R/RW drive and an Adaptec DuoConnect PC Card Adapter . I already reported on how these appear to FreeBSD. For testing purposes and to create my own media set, I duplicated the three CD-ROMs released as Fedora Core 2 . To convert the CD-ROM into a .iso file for burning, I used this syntax: dd if=/dev/cd0 of=/var/iso/fedora_core_disc3.iso bs=2048 Here's a few notes on this command. /dev/cd0 is how my Plextor drive appears to FreeBSD. My laptop's native CD/DVD reader is /dev/acd0. I could not get this command to work without including 'bs=2048'. I learned why after reading a FreeBSD Diary entry: "Data on CDs is written in blocks of 2 kB. By default dd reads 512 bytes at a time, and the CD driver doesn't support this. It would work if you use bs=2k." When I tried dd without the bs=2048 argument, I got t...

I'm not a big Linux user, but a lot of people like Fedora Core . Using the same methodology I used with FreeBSD and OpenBSD , I just installed Fedora Core 2 on a spare HDD on my laptop, then transferred that HDD to the Soekris. Here are a few notes on peculiarities of Fedora. I chose a "custom installation," and selected "no packages." That still deployed about 562 MB of packages as part of the base OS installation. Thankfully only the first CD was needed. When I finished the installation, I rebooted the laptop to edit key files to allow serial access. I made important changes to /etc/grub.conf, thanks to this Remote Serial Console HOWTO : # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that # all kernel and initrd paths are relative to /boot/, eg. # root (hd0,0) # kernel /vmlinuz-version ro root=/dev/hda2 # ...