Re: ARK Rootkit

2002-02-14 Thread Net Llama

Well after spending about 13 seconds searching on Google:
http://packetstorm.widexs.nl/UNIX/penetration/rootkits/

--- Federico Voges <[EMAIL PROTECTED]> wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
> 
> Hi,
> 
> A friend of mine was hacked a few days ago. chkrootkit reports that
> ARK
> (Ambient Root Kit) is installed in the system. Does anyone know where
> I
> can find this rootkit for download?? 
> 
> 
> 
> Some time ago, I found a site with the actual rootkits. But as I'm not
> in that kind of stuff, I din't bookmarked it (too bad).

__
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Linux on Macs

2002-02-14 Thread Tyler Regas

At 02:08 PM 2/14/2002, you wrote:
>The 3400c that i'm getting does have the 240Mhz CPU (thankfully).  Are
>you saying that it can run OS X?  Everything that i've read over the
>past few days seems to suggest otherwise.

You can. The XpOSfacto utility I mentioned and URLed in the last message 
will do it. I was able to run MacOS X 1.0.0.4 on it and the Classic 
environment ran about as fast as it does natively. 1.1.0.x or whatever 
should be even faster :)

> > Finally, you can install any one of the numerous 60x and 740/7400
> > compatible Linux distros. The ones I know of OTTOMH are SuSE,
> > Mandrake,
> > Linux PPC and YellowDog.
>
>I've been looking closely at YellowDog, and it seems fairly well
>polished & maintained.  PPC Linux seems to be a bit out of date (a
>fairly old 2.4.x kernel for example).  I've heard way too many
>instability nightmare stories about Mandrake, so i won't even touch it
>on any architecture.  I was going to consider SuSE, however since I only
>have a 4GB harddrive, i don't see how i'll ever be able to take
>advantage of the 6 CDs.
>
>What are you running on yours?

We don't run any Macs on Linux. I am running Mandrake 8.2 Beta 1 on my 
workstation and I have tomsrtbt on an old Toshiba 286 laptop I have :)

Lon, if you have any questions, drop em my way. As always :)

Ty


___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



ARK Rootkit

2002-02-14 Thread Federico Voges

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Hi,

A friend of mine was hacked a few days ago. chkrootkit reports that ARK
(Ambient Root Kit) is installed in the system. Does anyone know where I
can find this rootkit for download?? 



Some time ago, I found a site with the actual rootkits. But as I'm not
in that kind of stuff, I din't bookmarked it (too bad).

TIA


Federico Voges
Socio gerente

Intrasoft
Malabia 2137 14 A
(1425) Buenos Aires
Argentina

Te/Fax: 54-11-4833-5182
e-mail: [EMAIL PROTECTED]
Web: http://www.intrasoft.com.ar

PGP Public Key Fingerprint: A536 4595 EB6F D197  FBC1 5C3A 145C 2516

-BEGIN PGP SIGNATURE-
Version: PGPsdk version 1.7.1 (C) 1997-1999 Network Associates, Inc. and its 
affiliated companies.

iQA/AwUBPGwoiRRcJRaVKt4XEQJRKQCfdyrWPzdy5hxIA3kLX0K8n9RfPxcAoK/o
m0LsoupZD941zYkRgOvAFpM6
=acQ1
-END PGP SIGNATURE-


___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Linux on Macs

2002-02-14 Thread Net Llama

--- Tyler Regas <[EMAIL PROTECTED]> wrote:
> First, I'm happy to hear you're getting a Mac. The primary reason for

I'm happy too.  I've wanted to play with Linux on a PPC architecture for
a while, and the fact that this is a laptop will make it even more
useful.

> whirl for a while, download some utilities, buy a license for
> Kaliedoscope 
> (http://www.kaleidoscope.net/), give BBedit, MailSmith, and FileBuddy

I was forced to use BBedit in a class in college for a semester and i
hated it with every fiber of my being.  I'm not at all familiar with the
others that you listed.

> a few 
> spins around the block. There are hundreds of other utilities and 
> enhancements to the MacOS that you can check out.

I'd rather enhance Linux running on the Mac, then waste time with Mac
OS. If i could run Mac OSX on this little guy, i'd consider it, but
since i can't, i really don't have much of an interest.  My better half
loves Macs, and i'm gradually convincing her of how good linux is. 
Hopefully this will be the final step.

> Second, while its unlikely that your 3400c will have been upgraded (a 
> complex mobo swapping procedure as there are no CPU upgrades) the
> 240MHz 
> version is pretty speedy. My wife uses here 7300/200 daily and we've
> had 
> MacOS x running on it. That's a 200MHz 604e, btw. If you are still 

The 3400c that i'm getting does have the 240Mhz CPU (thankfully).  Are
you saying that it can run OS X?  Everything that i've read over the
past few days seems to suggest otherwise.

> Finally, you can install any one of the numerous 60x and 740/7400 
> compatible Linux distros. The ones I know of OTTOMH are SuSE,
> Mandrake, 
> Linux PPC and YellowDog.

I've been looking closely at YellowDog, and it seems fairly well
polished & maintained.  PPC Linux seems to be a bit out of date (a
fairly old 2.4.x kernel for example).  I've heard way too many
instability nightmare stories about Mandrake, so i won't even touch it
on any architecture.  I was going to consider SuSE, however since I only
have a 4GB harddrive, i don't see how i'll ever be able to take
advantage of the 6 CDs.

What are you running on yours?

> Then again, maybe you could get a 1400cs that's upgraded to a G3/400
> 2:1 :)

Beggers can't be chosers.  I'm basically getting this PB as a trade for
some other hardware i've got lying about.  

thanks for your input!

=

Lonni J. Friedman  [EMAIL PROTECTED]

Linux Step-by-step help:   http://netllama.ipfox.com

 .

__
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Linux on Macs

2002-02-14 Thread Tyler Regas

First, I'm happy to hear you're getting a Mac. The primary reason for why 
people don't like the MacOS (and this is true of any OS, for that matter) 
is that they don't get to spend enough time with it. Give that thing a 
whirl for a while, download some utilities, buy a license for Kaliedoscope 
(http://www.kaleidoscope.net/), give BBedit, MailSmith, and FileBuddy a few 
spins around the block. There are hundreds of other utilities and 
enhancements to the MacOS that you can check out.

Second, while its unlikely that your 3400c will have been upgraded (a 
complex mobo swapping procedure as there are no CPU upgrades) the 240MHz 
version is pretty speedy. My wife uses here 7300/200 daily and we've had 
MacOS x running on it. That's a 200MHz 604e, btw. If you are still 
interested in running X, fetch a copy of Ryan Rempel's killer XpOSfacto 
(http://eshop.macsales.com/OSXCenter/) utility.

Finally, you can install any one of the numerous 60x and 740/7400 
compatible Linux distros. The ones I know of OTTOMH are SuSE, Mandrake, 
Linux PPC and YellowDog.

Then again, maybe you could get a 1400cs that's upgraded to a G3/400 2:1 :)

Tyler

At 12:46 PM 2/14/2002, you wrote:
>Greetings,
>Anyone have any experience installing/using Linux on Macs (especially
>Powerbooks)?  I'm going to get my hands on an older Powerbook 3400c
>tomorrow, and i'd really really like to put Linux on it.  I will say
>that my experience with Macs in general is very very little.  I've used
>them on a few random occasions, and utterly disliked Mac OS.
>I've already looked at the relevant sections of linux-laptop.net but the
>bulk of the info is just tips & suggestions, not really guides.
>I've found that this little guy is actually supported in SuSE-7.3, which
>might be a good thing.
>Anyone with tips, or useful websites would be appreciated.
>
>thanks,
>Lonni
>
>=
>
>Lonni J. Friedman  [EMAIL PROTECTED]
>
>Linux Step-by-step help:   http://netllama.ipfox.com
>
>  .
>
>__
>Do You Yahoo!?
>Send FREE Valentine eCards with Yahoo! Greetings!
>http://greetings.yahoo.com
>___
>Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
>Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.


___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Linux on Macs

2002-02-14 Thread Net Llama

Greetings,
Anyone have any experience installing/using Linux on Macs (especially
Powerbooks)?  I'm going to get my hands on an older Powerbook 3400c
tomorrow, and i'd really really like to put Linux on it.  I will say
that my experience with Macs in general is very very little.  I've used
them on a few random occasions, and utterly disliked Mac OS.
I've already looked at the relevant sections of linux-laptop.net but the
bulk of the info is just tips & suggestions, not really guides.
I've found that this little guy is actually supported in SuSE-7.3, which
might be a good thing.
Anyone with tips, or useful websites would be appreciated.

thanks,
Lonni

=

Lonni J. Friedman  [EMAIL PROTECTED]

Linux Step-by-step help:   http://netllama.ipfox.com

 .

__
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Fwd: heads up: worm on the loose

2002-02-14 Thread Pam R

On Thursday 14 February 2002 5:13 pm, dep wrote:
> fyi. whatcha think of this?
>
> --  Forwarded Message  --
[snip]

Don't know about the forwarded message, but I was amused by the assortment of 
special header tags in your message. 

Pam
-- 
Linux Step by Step (UK mirror): http://www.pam.roberts.btinternet.co.uk/sxs/
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: security check

2002-02-14 Thread Pam R

On Thursday 14 February 2002 11:31 am, David A. Bandel wrote:
> If you don't pop mail from this machine, turn off inetd completely (you
> don't need it).  

I think that Daddy may need to keep the 2 lines in inetd.conf;
  /var/run/.ppp_socket stream  unixnowait  root
  /usr/sbin/ppp-envoy ppp-envoy -da

so that Kppp or KSaferppp or whatever it is called can run for dialout 
connection?

[snip]

Pam
-- 
Linux Step by Step (UK mirror): http://www.pam.roberts.btinternet.co.uk/sxs/
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: who has built Mozilla from source?

2002-02-14 Thread Tim Wunder

Net Llama wrote:
> --- Tim Wunder <[EMAIL PROTECTED]> wrote:
> 
>>IIRC, just ./configure, no options at all. I'd do it again to make
>>
> 
> That worked.  So, its definitely some of the options I chose.  thanks.

Cool.
BTW, if you pulled from CVS, they recommend NOT using 'cvs update' to 
update the tree, but rather 'make -f client.mk checkout'.

Tim


___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: who has built Mozilla from source?

2002-02-14 Thread Net Llama

--- Tim Wunder <[EMAIL PROTECTED]> wrote:
> IIRC, just ./configure, no options at all. I'd do it again to make

That worked.  So, its definitely some of the options I chose.  thanks.

=

Lonni J. Friedman  [EMAIL PROTECTED]

Linux Step-by-step help:   http://netllama.ipfox.com

 .

__
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Fwd: heads up: worm on the loose

2002-02-14 Thread dep

fyi. whatcha think of this?

--  Forwarded Message  --

Subject: heads up: worm on the loose
Date: Thu, 14 Feb 2002 09:44:11 +
From: "david evlis reign" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]

hi,
this is my first post and i am sorry that i had to be the bearer of
 bad news.
while doing my monthly audit today on my company's external boxes
 (gateways, external mail forwarders/...) i came across some *strang*
 files, which after inspection turned out to be source code to a new
 internet worm... the headers are as follows:

/*** Skelleton for an INET-worm. Plug-in the exploitcode and the
*** scan-routine and it works!
*** You propably have to change the sleep-seconds from 10 to a higher
 value. *** Worms must be linked statically in this case.
*** For educational purposes only! Don't use it in a bad manner.
***/

in fact the exploitcode was a ssh exploit by someone going by the
 name of "zip" and inspecting the source of this "skelleton" worm it
 seems it is cross platform, harbouring shellcode for *bsd, linux and
 solaris. i was totally dismayed and i saved a copy of this and
 another file, then i reformatted...i was not going to let my mail
 server be used to launch attacks on sites.
the other file in which i found was not a worm but a "autorooter" for
 ssh, as ssh-1.2.26 was running on a mail server out of my audit
 space, the attackers had obviously abused a trusted relationship.
the headers are as follows:

a kernerl module:
//
// (ssmod.c) by _dave
//
// Kernel module that bypasses the password check on the x2
// sshd crc32 exploit.
//
// gcc -c -O3 ssmod.c -I/usr/src/linux/include
// /sbin/insmod ssmod.o
//

a scanning module:
/*
** pscan.c - Originally by Volatile
** modified by _dave
**
*/

another file, i am not sure what this does
/* oops.c, part of the autossh package... by _dave */
/* nodupe2.c  by _dave */
/* ssvuln.c */
/* by _dave */


as you can see this exploit is being exploited in the wild...i am too
 afraid to think of the possibilities if that "skelleton" is
 released.

i just hope i have got to the public in time...

- david evlis reign, PhD compsci, CCISP

ps: any further details will be provided to reserachers




_
Join the world’s largest e-mail service with MSN Hotmail.
http://www.hotmail.com


-
--- This list is provided by the SecurityFocus ARIS analyzer
 service. For more information on this free incident handling,
 management and tracking system please see:
 http://aris.securityfocus.com

---

-- 
dep

if you go with the flow you'll get
chopped to pieces by the turbines.
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



RE: winmodem

2002-02-14 Thread Net Llama

The "device manager tab"??  What is that?  What does lspci say it is?

--- zohar <[EMAIL PROTECTED]> wrote:
> I can say that it is winmodem and the device manager tab describes it
> as
> HCF 56K PCI modem.
> 
> -Original Message-
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
> On
> Behalf Of Net Llama
> Sent: Thursday, February 14, 2002 6:47 AM
> To: [EMAIL PROTECTED]
> Subject: RE: winmodem
> 
> Every winmodem is different.  There is no univeral driver, so i don't
> really know what any of this is about.  You haven't even stated what
> kind of modem you have.  Perhaps if you looked at
> http://www.linmodems.org you'd find some answers to your questions.
> 
> --- zohar <[EMAIL PROTECTED]> wrote:
> > I have read somewhere that 14 th issue of newsletter describes the
> > procedure http://www.linuxformat.co.uk/ -
> > 
> > This site contains the code for it, maybe device driver or
> something.
> > http://walbran.org/sean/linux/stodolsk/
> > 
> > Jean Sagi also responded to this saying that he has done it on
> > Mandrake
> > 8.1. Will my installed system of SUSE 7.1 is of kernel 2.4 xxx .Can
> I
> > recompile it using the 2.4.8 kernel or should I use Mandrake 8.1( I
> > have
> > the two CDs of that.
> > 
> > 
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
> > On
> > Behalf Of Net Llama
> > Sent: Wednesday, February 13, 2002 6:02 AM
> > To: [EMAIL PROTECTED]
> > Subject: Re: winmodem
> > 
> > I'm not sure where you read that.  THe kernel version really has
> > nothing
> > to do with the ability to use a winmodem.  Have you looked at
> > linmodems.org ?
> > 
> > --- zohar <[EMAIL PROTECTED]> wrote:
> > > I had read somewhere that the new kernel 2.4 enables to use
> winmodem
> > > for
> > > linux, can you help me.
> 
> =
> 
> Lonni J. Friedman  [EMAIL PROTECTED]
> 
> Linux Step-by-step help:   http://netllama.ipfox.com
> 
>  .
> 
> __
> Do You Yahoo!?
> Send FREE Valentine eCards with Yahoo! Greetings!
> http://greetings.yahoo.com
> ___
> Linux-users mailing list -
> http://linux.nf/mailman/listinfo/linux-users
> Subscribe/Unsubscribe info, Archives,and Digests are located at the
> above URL.
> 
> ___
> Linux-users mailing list -
> http://linux.nf/mailman/listinfo/linux-users
> Subscribe/Unsubscribe info, Archives,and Digests are located at the
> above URL.


__
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: How do you spell leenix?

2002-02-14 Thread Ted Ozolins

On Thursday 14 February 2002 04:56 am, Joel Hammer wrote:
> One funny part of my computer crash.
> My wife called @HOME tech support (They are in Canada), since she thought
> it was our cable modem gone bad.
> They asked which OS she was using. When she said linux, they asked her to
> spell it.
> Joel
>

This does not suprise me at all. ISP's hire people for their tech support  
services who have completed a "tech support course" offered by various 
colleges. These courses teach only how to deal with $MS short-comings. A lot 
of these people have never seen a computer let alone use one prior to taking 
the course. Most of these people actually believe that Windows 9x is an 
operating system. If the answer to your problem isn't on their computer then 
you are SOL. My ISP is Telus (they are the telco here in BC) Their tech 
people do know what linux is. They will inform you that there are a lot of 
users using linux to access the internet but will not support it themselves. 
I once aske if they would at least put a link on their website that would 
point to one of the linux SxS sites. They declined stating that  could be 
interpreted that they support linux:( There are clowns and then there are 
clowns.
-- 
Ted Ozolins (VE7TVO)
Westbank, B. C.
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Web Creation Tool

2002-02-14 Thread Rick Sivernell

On Thu, 14 Feb 2002 00:56:20 -0500
Ian <[EMAIL PROTECTED]> wrote:

> Ted Ozolins wrote:
> > 
> > On Wednesday 13 February 2002 10:48 am, Ronnie Gauthier wrote:
> > > IBM WebSphere.
> > 
> > Just downloaded and at a quick look, wow!
> 
> Also:
> 
> SxS -> HTML
> 
> http://sxs.homeip.net/html.html
> 
> -- 
> Linux SxS [http://sxs.homeip.net/]
> ___
> Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
> Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.

I am glad I am not the only one with no docs.

cheers
-- 
Rick Sivernell
Dallas, Texas  75287
972 306-2296
[EMAIL PROTECTED]
Caldera Open Linux eWorkStation 3.1
Registered Linux User

   .~.
  / v \
 /( _ )\
   ^ ^
In Linux we trust!
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Sendmail Masquerading Question

2002-02-14 Thread Ian

Stew Benedict wrote:
> 
> On Wed, 13 Feb 2002, Ian wrote:
> 
> > I think it was either Kurt or you who said to add
> >
> > set hostname = marchak.homeip.net
> >
> > to my .muttrc file...which I did.  But when mail arrives at the other
> > end, mutt has changed it to marchak.homeip.net, but there's something in
> > the header, I think it's the fact that in the header of the email
> > contains
> >
> > Return-Path: <[EMAIL PROTECTED]>
> >
> > is what is causing the other servers to reject because a direct cut and
> > paste of the From info (from the same header) is
> >
> > From: Ian <[EMAIL PROTECTED]>
> >
> 
> You need to setup masquerading for the envelope and the header, and you
> can also use genericstable to rewrite the From:.  If you take a look at
> Linux Journal's site there's a wrieup I did on a sendmail setup like this
> that I've used successfully at a manufacturing plant where several folks
> were masqued behind one internet account.

I've tucked away yours and David's posts...will have a look-see tonight.

I think the link is: http://www.linuxjournal.com/article.php?sid=4539 in
case anyone else is interested.

>  I do the same thing here and
> run 4 seperate accounts for my various identitities.

You know, a few trips to a good doctor, and you can maybe whittle it
down to one identity. ;-)

-- 
Linux SxS [http://sxs.homeip.net/]
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: How do you spell leenix?

2002-02-14 Thread Michael Scottaline

On Thu, 14 Feb 2002 07:56:13 -0500
Joel Hammer <[EMAIL PROTECTED]> wrote:

> One funny part of my computer crash.
> My wife called @HOME tech support (They are in Canada), since she
> thought it was our cable modem gone bad.
> They asked which OS she was using. When she said linux, they asked her
> to spell it.
===
Kinda makes ya wonder why you called "tech" support in the first place! 
;o)

Mike

-- 
"You can't be a real country unless you have a beer and an airline - it
helps if you have some kind of a football team, or some nuclear weapons,
but at the very least you need a beer."
- Frank Zappa


_
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



How do you spell leenix?

2002-02-14 Thread Joel Hammer

One funny part of my computer crash.
My wife called @HOME tech support (They are in Canada), since she thought it
was our cable modem gone bad.
They asked which OS she was using. When she said linux, they asked her to
spell it.
Joel
 
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: security check

2002-02-14 Thread David A. Bandel

If you don't pop mail from this machine, turn off inetd completely (you
don't need it).  If you do, put a # sign in front of all _except_ pop3,
then stop and start inetd.

Then also run:

netstat -tupan

and look at all your open ports.  If you don't need the service, turn it
off.  If you only need the service locally, block it with iptables from
external use.  You should protect your system with iptables:

iptables -t filter -i  -A FORWARD -m state --state
ESTABLISHED,RELATED -j ACCEPT iptables -t filter -A INPUT -i  -m
state --state ESTABLISHED,RELATED -j ACCEPT iptables -t filter -A FORWARD
-i  -m state --state NEW,INVALID -j DROP iptables -t filter -A
INPUT -i  -m state --state NEW,INVALID -j DROP

replace ext_dev with your external device, i.e., ppp0 (or ppp+), eth0,
etc.

On Wed, 13 Feb 2002 23:35:17 -0600
begin  daddy <[EMAIL PROTECTED]> spewed forth:

> With my recent hacker scare I decided to look into my security.  Here 
> is a portion of my inetd.conf file.  I only use my internet 
> connection receive email (pop3) and surf the internet at this point.  
> What can I turn off?
> 
> #echo dgram   udp waitrootinternal
> discard   stream  tcp nowait  rootinternal
> discard dgram udp waitrootinternal
> daytime   stream  tcp nowait  rootinternal
> daytime dgram udp waitrootinternal
> #chargen stream   tcp nowait  rootinternal
> #chargen dgramudp waitrootinternal
> time  stream  tcp nowait  rootinternal
> time  dgram   udp waitrootinternal
> #
> # These are standard services.
> #
> ftp stream  tcp nowait  root/usr/sbin/tcpd in.ftpd -l -a
> telnet  stream  tcp nowait  root/usr/sbin/tcpd in.telnetd
> 
> #
> # Mail and news
> #
> # Do not uncomment either unless you *really* know what you are doing.
> # Both are started as standalone daemons from the /etc/rc.d scripts.
> #smtp stream  tcp nowait  root/usr/bin/smtpd  smtpd
> #nntp stream  tcp nowait  root/usr/sbin/tcpd  in.nntpd
> 
> #
> # Shell, login, exec and talk are BSD protocols.
> #
> shell   stream  tcp nowait  root/usr/sbin/tcpd in.rshd
> login   stream  tcp nowait  root/usr/sbin/tcpd in.rlogind
> execstream  tcp nowait  root/usr/sbin/tcpd in.rexecd
> talkdgram   udp waitnobody.tty /usr/sbin/tcpd in.talkd
> ntalk   dgram   udp waitnobody.tty /usr/sbin/tcpd in.ntalkd
> #dtalkstream  tcp waitnobody.tty  /usr/sbin/tcpd  in.dtalkd
> 
> #
> # Pop and imap mail services et al
> #
> pop2stream  tcp nowait  root/usr/sbin/tcpd ipop2d
> pop3stream  tcp nowait  root/usr/sbin/tcpd ipop3d
> imapstream  tcp nowait  root/usr/sbin/tcpd imapd
> #
> # The Internet UUCP service.
> #
> uucp  stream  tcp nowait  uucp/usr/sbin/tcpd  /usr/sbin/uucico -l
> #
> # Tftp service is provided primarily for booting.  Most sites
> # run this only on machines acting as "boot servers." Do not uncomment
> # this unless you *need* it.
> #
> #tftp dgram   udp waitroot/usr/sbin/tcpd  in.tftpd
> #bootps   dgram   udp waitroot/usr/sbin/tcpd  bootpd
> #
> #  This is for the finger service
> # 
> finger  stream  tcp nowait  nobody  /usr/sbin/tcpd in.fingerd -u
> /var/run/.ppp_socket stream  unixnowait  root
> /usr/sbin/ppp-envoy ppp-envoy -da
> #
> # Finger, systat and netstat give out user information which may be
> # valuable to potential "system crackers."  Many sites choose to 
> disable
> # some or all of these services to improve security.
> #
> #systat   stream  tcp nowait  nobody  /usr/sbin/tcpd  /bin/ps -auwwx
> #netstat stream   tcp nowait  nobody  /usr/sbin/tcpd  /bin/netstat --inet
> #
> # Authentication
> #
> authstream  tcp nowait  root/usr/sbin/in.identd in.identd
> swatstream  tcp nowait.400 root/usr/sbin/tcpd swat
> #
> # End of inetd.conf
> 
> Sometime in the near future I would like to use this box as a gateway 
> to a home network.  Would I need to reactivate anything at that 
> point?  Thanks for the input.  
> 
> Mark
> ___
> Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
> Subscribe/Unsubscribe info, Archives,and Digests are located at the
> above URL.

Ciao,

David A. Bandel
-- 
Focus on the dream, not the competition.
-- Nemesis Racing Team motto
Internet (H323) phone: 206.28.187.30
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Sendmail Masquerading Question

2002-02-14 Thread Stew Benedict


On Wed, 13 Feb 2002, Ian wrote:

> I think it was either Kurt or you who said to add
> 
> set hostname = marchak.homeip.net
> 
> to my .muttrc file...which I did.  But when mail arrives at the other
> end, mutt has changed it to marchak.homeip.net, but there's something in
> the header, I think it's the fact that in the header of the email
> contains
> 
> Return-Path: <[EMAIL PROTECTED]>
> 
> is what is causing the other servers to reject because a direct cut and
> paste of the From info (from the same header) is
> 
> From: Ian <[EMAIL PROTECTED]>
> 

You need to setup masquerading for the envelope and the header, and you
can also use genericstable to rewrite the From:.  If you take a look at 
Linux Journal's site there's a wrieup I did on a sendmail setup like this
that I've used successfully at a manufacturing plant where several folks
were masqued behind one internet account.  I do the same thing here and
run 4 seperate accounts for my various identitities.

If you need more details, holler.

Stew Benedict

___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.



Re: Sendmail Masquerading Question

2002-02-14 Thread David A. Bandel

On Wed, 13 Feb 2002 22:43:41 -0500
begin  Ian <[EMAIL PROTECTED]> spewed forth:

[snip]
> 
> But no matter what combination of DM / CM / CG (shooting wildly at then
> end) I cannot prevent it from mailing out [EMAIL PROTECTED] when I
> send from the sendmail box.  Which of course bounces as domain doesn't
> exist.

Remove the CG item(s).  You need:
DMmarchak.ca
FEATURE(masquerade_envelope) (this goes in your .mc file, then rebuild w/
m4)

you can always test:
sendmail -bt
/tryflags hs
/try esmtp [EMAIL PROTECTED]
/try local [EMAIL PROTECTED]

(all should resolve completely (and finally) to [EMAIL PROTECTED])

D to quit.

Ciao,

David A. Bandel
-- 
Focus on the dream, not the competition.
-- Nemesis Racing Team motto
Internet (H323) phone: 206.28.187.30
___
Linux-users mailing list - http://linux.nf/mailman/listinfo/linux-users
Subscribe/Unsubscribe info, Archives,and Digests are located at the above URL.