Re: Mutt & tmp files
On 2001-11-15 19:11 Florian Bantner wrote: > Hi, > > I am recently busy with email-security. I'm using Mutt and GnuPG > which works greate for me. But one point did attract my attention: > > When writing a new mail which I intend to encrypt via gpg, mutt > creates a tmp file (normaly unter /tmp/.mutt*) which it uses to > 'comunicate' with Vim. This file lasts as long the vim-session is > running. Vim then saves the changes to the file and gives execution > back to Mutt. To prevent things like this, you could mark the text you want to encrypt and filter the block through gpg(1) with ascii-armour on. This way no unencrypted files will be written to disk, of course unless you save before you have encrypted it. Most editors these days can do this operation, if your favourite editor don't support this, I strongly encourage you to begin using an editor which does. It is a very nice feature. Another thing is... You're a bit concerned that root can read your mail. A good advice is to never - NEVER place your private (secret) key on another machine you don't have physical access to or a machine which is owned by others. Public keys only. Store it on a floppy if you have to decrypt messages. Make sure the gpg executable is setuid root to prevent swapping anbd insecure memory, and make sure there is no daemon gathering keystrokes. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. +
Re: Mutt & tmp files
On 2001-11-15 19:11 Florian Bantner wrote: > Hi, > > I am recently busy with email-security. I'm using Mutt and GnuPG > which works greate for me. But one point did attract my attention: > > When writing a new mail which I intend to encrypt via gpg, mutt > creates a tmp file (normaly unter /tmp/.mutt*) which it uses to > 'comunicate' with Vim. This file lasts as long the vim-session is > running. Vim then saves the changes to the file and gives execution > back to Mutt. To prevent things like this, you could mark the text you want to encrypt and filter the block through gpg(1) with ascii-armour on. This way no unencrypted files will be written to disk, of course unless you save before you have encrypted it. Most editors these days can do this operation, if your favourite editor don't support this, I strongly encourage you to begin using an editor which does. It is a very nice feature. Another thing is... You're a bit concerned that root can read your mail. A good advice is to never - NEVER place your private (secret) key on another machine you don't have physical access to or a machine which is owned by others. Public keys only. Store it on a floppy if you have to decrypt messages. Make sure the gpg executable is setuid root to prevent swapping anbd insecure memory, and make sure there is no daemon gathering keystrokes. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. + -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Vulnerable SSH versions
On 2001-11-12 16:54 Ethan Benson wrote: On Tue, Nov 13, 2001 at 10:10:10AM +0900, Howland, Curtis wrote: CH> Which makes me wonder, why ship Woody with 2.2.20 at all? Oh well, not CH> my decision. EB> because 2.4 is not stable yet. *applause* I was hoping for that. Great decision. In fact the only acceptable thing to do when we think of the current 2.4.x mess. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. +
Re: Vulnerable SSH versions
On 2001-11-12 16:54 Ethan Benson wrote: On Tue, Nov 13, 2001 at 10:10:10AM +0900, Howland, Curtis wrote: CH> Which makes me wonder, why ship Woody with 2.2.20 at all? Oh well, not CH> my decision. EB> because 2.4 is not stable yet. *applause* I was hoping for that. Great decision. In fact the only acceptable thing to do when we think of the current 2.4.x mess. Regards, Ãyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Ãyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. + -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: SPAM was RE: INSURE GOOD RECEPTION! VITAL EMERGENCY STRATEGY!!!
On 2001-11-10 00:17 Vineet Kumar wrote: > * Sebastiaan ([EMAIL PROTECTED]) [011109 14:44]: > > High, > > > > On Fri, 9 Nov 2001, Ed Street wrote: > > > > > Hey, > > > > > > Is there *anything* we can do about all this Spam that's getting on this > > > list? > > > > > Yes. We can silently ignore them rather than turn each one into a > lengthy off-topic thread. No. The number of spam messages on these lists is really beginning to irritate me, it's getting bigger day by day. The task of (un)subscribing to the list is pretty easy, so I really don't see the problem of only allowing messages from members on the list. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. +
Re: SPAM was RE: INSURE GOOD RECEPTION! VITAL EMERGENCY STRATEGY!!!
On 2001-11-10 00:17 Vineet Kumar wrote: > * Sebastiaan ([EMAIL PROTECTED]) [011109 14:44]: > > High, > > > > On Fri, 9 Nov 2001, Ed Street wrote: > > > > > Hey, > > > > > > Is there *anything* we can do about all this Spam that's getting on this > > > list? > > > > > Yes. We can silently ignore them rather than turn each one into a > lengthy off-topic thread. No. The number of spam messages on these lists is really beginning to irritate me, it's getting bigger day by day. The task of (un)subscribing to the list is pretty easy, so I really don't see the problem of only allowing messages from members on the list. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. + -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Debconf and noexec on /tmp
On 2001-11-08 16:47 Wichert Akkerman wrote: Previously Emmanuel Lacour wrote: EL> What's the use of noexec flag??? WA> Historic thing mostly with very little practical use these days. At least it's a Good Thing to have around when mounting DOSish floppies and such to avoid having all files marked executable. Executable .tar files is not my kind of fun. Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. +
Re: Debconf and noexec on /tmp
On 2001-11-08 16:47 Wichert Akkerman wrote: Previously Emmanuel Lacour wrote: EL> What's the use of noexec flag??? WA> Historic thing mostly with very little practical use these days. At least it's a Good Thing to have around when mounting DOSish floppies and such to avoid having all files marked executable. Executable .tar files is not my kind of fun. Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. + -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Kernel problem ?
On 2001-09-29 20:14 [EMAIL PROTECTED] wrote: > I was making an iso image from a CD with the following command: > > dd if=/dev/cdrom of=image.iso > > when the image.iso where finished (I think it) there were an error that > look as : > > scsi0: ERROR on channel 0, id 0, lun 0, CDB: 0x03 00 00 00 40 00 > Info fld=0x53f78, Current sd0b:00: sns = f0 3 > ASC=11 ASCQ= 5 > Raw sense data:0xf0 0x00 0x03 0x00 0x05 0x3f 0x78 0x0a 0x00 0x00 0x00 > 0x00 0x11 > 0x05 0x00 0x00 0x00 0x00 > I/O error: dev 0b:00, sector 1375712 > I/O error: dev 0b:00, sector 1375716 > > I don't know where is the problem and I don't find anything over > internet. > > Later, I recorded one CD and when I was verifying if the record is good > I get the same error. I verify that with : md5sum /dev/cdrom Have you tried using head(1) to limit the stream, you might have read beyond end of image. head -c 678039552 /dev/cdrom >image.iso for NON_US potato. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +== cat /dev/urandom >/bin/laden ===+
Re: Kernel problem ?
On 2001-09-29 20:14 [EMAIL PROTECTED] wrote: > I was making an iso image from a CD with the following command: > > dd if=/dev/cdrom of=image.iso > > when the image.iso where finished (I think it) there were an error that > look as : > > scsi0: ERROR on channel 0, id 0, lun 0, CDB: 0x03 00 00 00 40 00 > Info fld=0x53f78, Current sd0b:00: sns = f0 3 > ASC=11 ASCQ= 5 > Raw sense data:0xf0 0x00 0x03 0x00 0x05 0x3f 0x78 0x0a 0x00 0x00 0x00 > 0x00 0x11 > 0x05 0x00 0x00 0x00 0x00 > I/O error: dev 0b:00, sector 1375712 > I/O error: dev 0b:00, sector 1375716 > > I don't know where is the problem and I don't find anything over > internet. > > Later, I recorded one CD and when I was verifying if the record is good > I get the same error. I verify that with : md5sum /dev/cdrom Have you tried using head(1) to limit the stream, you might have read beyond end of image. head -c 678039552 /dev/cdrom >image.iso for NON_US potato. Regards, Øyvind +== http://www.sunbase.org/sunny ===+ | OpenPGP: 0xAD19826C 2000-01-24 Øyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +== cat /dev/urandom >/bin/laden ===+ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: password expire and sshd doesn't allow ppl to change it
On 2001-09-22 03:33 Ethan Benson wrote: > On Sat, Sep 22, 2001 at 10:30:53AM +0200, Luca Gibelli wrote: > > I created a new account for testing purposes and put the following > > limits on its password age: > > known bug in potato's ssh, password expiration simply doesn't work > with it, as soon as it expires ssh denies access flat out. your only > option is either upgrading to woody or backporting the woody ssh > package to potato (probably not very hard at all). > > i recommend backporting the sid ssh packages to potato. if someone > hasn't already done that... In fact I think the OpenSSH distributed with potato should be upgraded. I could not use the version shipped with potato as it did not understand protocol 2 which is a must. When trying to install OpenSSH-2.2p2 (I think) from woody, dependencies with libc6-dev and locales broke, they expect libc6 = 2.1.3-18, but OpenSSH needs libc6-2.2.4-1. Quite weird it needs just that specific version - should not the newer versions also work? Well, it messed up apt-get entirely, and as a very new Debian user (less than a week) not too used to apt-get and dpkg I just reinstalled the whole thing. It resulted in me getting the whole OpenSSH, OpenSSL and zlib, compiling and putting it under a new directory /usr/local/noapt/ to avoid collisions with apt-get. Is there a clean way of upgrading the SSH package and avoid the conflicts? Apart from that, Debian is just GREAT. I've been using RedHat since 1997 or something, but that has undoubtedly changed. I like the philosophy of not moving the bleeding-edge stuff into the stable release before one's sure it WORKS. And Debian does that. Having that in mind, I disagree a bit with myself when asking for an SSH upgrade. :-) When upgrading from RedHat 6.1 (If it works don't fix it) I had to examine their 7.1 release closely due to their unstable gcc episode in 7.0. Finding they included the (in my opinion) unstable 2.4.something kernel, the choice was easy. It had to be Debian. And it will stay that way. - Øyvind +=======+ | OpenPGP: 0xAD19826C 2000-01-24 Oyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. +
Re: setuid changes
On 2001-09-21 13:35 Vineet Kumar wrote: > * Micah Anderson ([EMAIL PROTECTED]) [010921 10:23]: > > > I was thinking it would be nice to see what sort of new setuid > > programs show up on my box each day... then I noticed that these > > are already being logged in /var/log/setuid.today and > > /var/log/setuid.yesterday. What makes these? It appears they come from > > /etc/cron.daily/standard which runs /usr/sbin/checksecurity. > > > > But, what is the point of logging these each day into > > /var/log/setuid.changes if nobody sees them? Why doesn't this list > > get emailed to root? Am I missing something? > > Well, maybe root should go see them? I don't mean to be snotty about > it, but surely you concede that there is a point to logging and not > emailing something; surely you have other logs on your system which > are not emailed to root? > > As root, it's best to be vigilant and actively inspect your system > rather than just wait for alerts to come to you. Yes, inspecting logs is very important to catch up on suspicious events which may be intruding attempts. One of the big probles however, is the big quantity of logging which makes important information to disappear among all the trivial events. One example is the choice of addressing mail to root to some ordinary user so messages won't go unnoticed. I just had to switch that feature off. All kind of trivial events (logging of /var/spool/messages etc) filled up my mailbox, things like key generation by ssh and minor kernel messages. I am tempted to create some kind of perl script which skips all the non-important info and leave all other in place. A script root can run which pulls out info from /var/log/* and other logs around the system. Especially now in these wormy times when the httpd error_log overflows with "file not found" messages. A couple of days ago there were 154.000 hits by those IIS worms around the net on my server in ONE DAY. There is indeed a need for filtering out some kind of information or at least have the choice of lowering the message generation by various programs. Greetings from Norway, Øyvind +===+ | OpenPGP: 0xAD19826C 2000-01-24 Oyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. +
Re: password expire and sshd doesn't allow ppl to change it
On 2001-09-22 03:33 Ethan Benson wrote: > On Sat, Sep 22, 2001 at 10:30:53AM +0200, Luca Gibelli wrote: > > I created a new account for testing purposes and put the following > > limits on its password age: > > known bug in potato's ssh, password expiration simply doesn't work > with it, as soon as it expires ssh denies access flat out. your only > option is either upgrading to woody or backporting the woody ssh > package to potato (probably not very hard at all). > > i recommend backporting the sid ssh packages to potato. if someone > hasn't already done that... In fact I think the OpenSSH distributed with potato should be upgraded. I could not use the version shipped with potato as it did not understand protocol 2 which is a must. When trying to install OpenSSH-2.2p2 (I think) from woody, dependencies with libc6-dev and locales broke, they expect libc6 = 2.1.3-18, but OpenSSH needs libc6-2.2.4-1. Quite weird it needs just that specific version - should not the newer versions also work? Well, it messed up apt-get entirely, and as a very new Debian user (less than a week) not too used to apt-get and dpkg I just reinstalled the whole thing. It resulted in me getting the whole OpenSSH, OpenSSL and zlib, compiling and putting it under a new directory /usr/local/noapt/ to avoid collisions with apt-get. Is there a clean way of upgrading the SSH package and avoid the conflicts? Apart from that, Debian is just GREAT. I've been using RedHat since 1997 or something, but that has undoubtedly changed. I like the philosophy of not moving the bleeding-edge stuff into the stable release before one's sure it WORKS. And Debian does that. Having that in mind, I disagree a bit with myself when asking for an SSH upgrade. :-) When upgrading from RedHat 6.1 (If it works don't fix it) I had to examine their 7.1 release closely due to their unstable gcc episode in 7.0. Finding they included the (in my opinion) unstable 2.4.something kernel, the choice was easy. It had to be Debian. And it will stay that way. - Øyvind +=======+ | OpenPGP: 0xAD19826C 2000-01-24 Oyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. + -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: setuid changes
On 2001-09-21 13:35 Vineet Kumar wrote: > * Micah Anderson ([EMAIL PROTECTED]) [010921 10:23]: > > > I was thinking it would be nice to see what sort of new setuid > > programs show up on my box each day... then I noticed that these > > are already being logged in /var/log/setuid.today and > > /var/log/setuid.yesterday. What makes these? It appears they come from > > /etc/cron.daily/standard which runs /usr/sbin/checksecurity. > > > > But, what is the point of logging these each day into > > /var/log/setuid.changes if nobody sees them? Why doesn't this list > > get emailed to root? Am I missing something? > > Well, maybe root should go see them? I don't mean to be snotty about > it, but surely you concede that there is a point to logging and not > emailing something; surely you have other logs on your system which > are not emailed to root? > > As root, it's best to be vigilant and actively inspect your system > rather than just wait for alerts to come to you. Yes, inspecting logs is very important to catch up on suspicious events which may be intruding attempts. One of the big probles however, is the big quantity of logging which makes important information to disappear among all the trivial events. One example is the choice of addressing mail to root to some ordinary user so messages won't go unnoticed. I just had to switch that feature off. All kind of trivial events (logging of /var/spool/messages etc) filled up my mailbox, things like key generation by ssh and minor kernel messages. I am tempted to create some kind of perl script which skips all the non-important info and leave all other in place. A script root can run which pulls out info from /var/log/* and other logs around the system. Especially now in these wormy times when the httpd error_log overflows with "file not found" messages. A couple of days ago there were 154.000 hits by those IIS worms around the net on my server in ONE DAY. There is indeed a need for filtering out some kind of information or at least have the choice of lowering the message generation by various programs. Greetings from Norway, Øyvind +===+ | OpenPGP: 0xAD19826C 2000-01-24 Oyvind A. Holm <[EMAIL PROTECTED]> | | Fingerprint: EAE5 DCA0 0626 5DAA 72F8 0435 2E2B E476 AD19 826C | +=== 2 + 2 = 5 for extremely large values of 2. + -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
