Re: [expert] hack attack analysis second attempt

2002-12-03 Thread Lorne
Good news guys. I will send this as a new topic so that it doesn't get missed. We got sidetracked and got to discussing colortail. It is a simple little tool for graphically coloring information. It doesn't compile in Mandrake 9.0. It gives errors. I've been in contact with the author and he

RE: [expert] Hack attack analysis

2002-11-30 Thread Franki
: Saturday, 30 November 2002 1:11 AM To: [EMAIL PROTECTED] Subject: [expert] Hack attack analysis Well guys... it has been 5 years since somone got in. They finally did it. I've been using the floppy disk coyote linux for years now. They aren't keeping up it seems and the last update I got

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Lorne
On Friday 29 November 2002 11:57 pm, James Sparenberg wrote: On Fri, 2002-11-29 at 22:53, Lorne wrote: Thanks. That is an excellent idea! Now I have to try to remember how to keep the tail of a log constantly writing to the monitor. I KNOW I can do it, just so long since I have, I forget

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Lorne
On Saturday 30 November 2002 12:00 am, Vox wrote: This time Lorne [EMAIL PROTECTED] becomes daring and writes: Thanks. That is an excellent idea! Now I have to try to remember how to keep the tail of a log constantly writing to the monitor. I KNOW I can do it, just so long since I have, I

Re: [expert] Hack attack analysis

2002-11-30 Thread Lorne
but trouble and ran out of time. rgds Frank -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Lorne Sent: Saturday, 30 November 2002 1:11 AM To: [EMAIL PROTECTED] Subject: [expert] Hack attack analysis Well guys... it has been 5 years since somone got

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Charlie
On November 30, 2002 09:58 am, Lorne wrote: snip OOH! I like that too! I imagine you can tell it key words to color? Here catch: http://www.student.hk-r.se/~pt98jan/colortail.html for the app's 'homepage'. Regards; -- Charlie Edmonton,AB,Canada Registered user 244963 at

RE: [expert] Hack attack analysis

2002-11-30 Thread Franki
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Lorne Sent: Sunday, 1 December 2002 1:28 AM To: [EMAIL PROTECTED] Subject: Re: [expert] Hack attack analysis On Saturday 30 November 2002 04:17 am, Franki wrote: Two good tools for stopping hacks from

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Vox
This time Lorne [EMAIL PROTECTED] becomes daring and writes: On Saturday 30 November 2002 12:00 am, Vox wrote: This time Lorne [EMAIL PROTECTED] becomes daring and writes: Thanks. That is an excellent idea! Now I have to try to remember how to keep the tail of a log constantly writing

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Vox
This time Charlie [EMAIL PROTECTED] becomes daring and writes: On November 30, 2002 09:58 am, Lorne wrote: snip OOH! I like that too! I imagine you can tell it key words to color? Here catch: http://www.student.hk-r.se/~pt98jan/colortail.html for the app's 'homepage'. Cool! :) Now

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Lorne
On Saturday 30 November 2002 11:13 am, Charlie wrote: On November 30, 2002 09:58 am, Lorne wrote: snip OOH! I like that too! I imagine you can tell it key words to color? Here catch: http://www.student.hk-r.se/~pt98jan/colortail.html got it. Looking at it now. for the app's 'homepage'.

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Lorne
On Saturday 30 November 2002 12:05 pm, Vox wrote: Yes, that's that :) What I do is: - turn everything back to white (too many damn colors make it hard to notice things for me...the default config is a pain for my eyes) - Mark the name of my workstation in a dark color (same with

Re: [expert] Hack attack analysis

2002-11-30 Thread J. Craig Woods
This posts warrants another posting. For all of you that are new to security, i.e. firewalls, services binding to ports, and os level securtity, these are good suggestions. Good job, Franki. I would, as well, add another level or step: this would include file security, and rootkit checking. To

Re: [expert] Hack attack analysis

2002-11-30 Thread James Sparenberg
I'll second chrootkit. I actually use it pro-actively on all of my servers and re-actively on ones people suspect have been hacked and want me to test. It has found problems and from what one of my friends tells me ... a hacker (They managed to find a salesman who was creating his own network

Re: [expert] Hack attack analysis

2002-11-30 Thread Carroll Grigsby
On Saturday 30 November 2002 03:27 pm, James Sparenberg wrote: I'll second chrootkit. I actually use it pro-actively on all of my servers and re-actively on ones people suspect have been hacked and want me to test. It has found problems and from what one of my friends tells me ... a hacker

Re: [expert] Hack attack analysis

2002-11-30 Thread James Sparenberg
On Sat, 2002-11-30 at 15:48, Carroll Grigsby wrote: On Saturday 30 November 2002 03:27 pm, James Sparenberg wrote: I'll second chrootkit. I actually use it pro-actively on all of my servers and re-actively on ones people suspect have been hacked and want me to test. It has found problems

Re: [expert] Hack attack analysis [OT]

2002-11-30 Thread Carroll Grigsby
On Saturday 30 November 2002 07:17 pm, James Sparenberg wrote: On Sat, 2002-11-30 at 15:48, Carroll Grigsby wrote: On Saturday 30 November 2002 03:27 pm, James Sparenberg wrote: I'll second chrootkit. I actually use it pro-actively on all of my servers and re-actively on ones people

Re: [expert] Hack attack analysis [OT]

2002-11-30 Thread James Sparenberg
On Sat, 2002-11-30 at 17:13, Carroll Grigsby wrote: On Saturday 30 November 2002 07:17 pm, James Sparenberg wrote: On Sat, 2002-11-30 at 15:48, Carroll Grigsby wrote: On Saturday 30 November 2002 03:27 pm, James Sparenberg wrote: I'll second chrootkit. I actually use it pro-actively on

Re: [expert] Hack attack analysis [OT]

2002-11-30 Thread nDiScReEt
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Saturday 30 November 2002 7:13 pm, Carroll Grigsby wrote: On Saturday 30 November 2002 07:17 pm, James Sparenberg wrote: On Sat, 2002-11-30 at 15:48, Carroll Grigsby wrote: On Saturday 30 November 2002 03:27 pm, James Sparenberg wrote:

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Gary
On Sat, 30 Nov 2002 11:13:19 -0700, you wrote: Here catch: http://www.student.hk-r.se/~pt98jan/colortail.html I tried to install colortail and found it required regex. Found gnu regex-0.12.tar.gz, but it wont compile, it says it carnt find ecircle. Any ideas for a fix or is there a Mdk regex

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Lorne
On Saturday 30 November 2002 06:49 pm, Gary wrote: On Sat, 30 Nov 2002 11:13:19 -0700, you wrote: Here catch: http://www.student.hk-r.se/~pt98jan/colortail.html I tried to install colortail and found it required regex. Found gnu regex-0.12.tar.gz, but it wont compile, it says it carnt find

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Ray Warren
On Sun, Dec 01, 2002 at 12:49:46PM +1100, Gary wrote: On Sat, 30 Nov 2002 11:13:19 -0700, you wrote: Here catch: http://www.student.hk-r.se/~pt98jan/colortail.html I tried to install colortail and found it required regex. Found gnu regex-0.12.tar.gz, but it wont compile, it says it

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Lorne
I am kind of confused. I just rebuilt my mandrake security firewall. Snort didn't install correctly. It did on the second attempt. Now the system has been up for 4 hours approximately and it looks like perhaps I'm already in trouble!?!?!?! /snort/portscan.log:Nov 30 17:15:03 xxx.3.247.xxx:1024

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread mike
Sometimes I get reports from Snort of port scans coming from my own machine.I wonder what's up? Mike On Saturday 30 November 2002 10:26 pm, you wrote: I am kind of confused. I just rebuilt my mandrake security firewall. Snort didn't install correctly. It did on the second attempt. Now the

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Daniel Woods
On Sat, 30 Nov 2002, Lorne wrote: I am kind of confused. I just rebuilt my mandrake security firewall. Snort didn't install correctly. It did on the second attempt. Now the system has been up for 4 hours approximately and it looks like perhaps I'm already in trouble!?!?!?!

Re: [expert] hack attack analysis second attempt

2002-11-30 Thread Jack Coates
On Sat, 2002-11-30 at 19:26, Lorne wrote: I am kind of confused. I just rebuilt my mandrake security firewall. Snort didn't install correctly. It did on the second attempt. Now the system has been up for 4 hours approximately and it looks like perhaps I'm already in trouble!?!?!?!

[expert] Hack attack analysis

2002-11-29 Thread Lorne
Well guys... it has been 5 years since somone got in. They finally did it. I've been using the floppy disk coyote linux for years now. They aren't keeping up it seems and the last update I got was in January. The first clue was zone alarm on my boys box popped up some denials. Regrettably, I

[expert] hack attack analysis second attempt

2002-11-29 Thread Lorne
second send Sorry, I used an old subject and I'm guessing no one saw it earlier. I'd like to try again. Since I wrote this earlier today, I gave up on openbsd without the cdrom. I decided to look at Mandrake security. Has anyone played with it and how secure is it really? It is a snap to

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread Vox
This time Lorne [EMAIL PROTECTED] becomes daring and writes: second send Sorry, I used an old subject and I'm guessing no one saw it earlier. I'd like to try again. Since I wrote this earlier today, I gave up on openbsd without the cdrom. I decided to look at Mandrake security. Has

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread Vox
This time Lorne [EMAIL PROTECTED] becomes daring and writes: second send Sorry, I used an old subject and I'm guessing no one saw it earlier. I'd like to try again. Since I wrote this earlier today, I gave up on openbsd without the cdrom. I decided to look at Mandrake security. Has

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread Lorne
Thanks. That is an excellent idea! Now I have to try to remember how to keep the tail of a log constantly writing to the monitor. I KNOW I can do it, just so long since I have, I forget the syntax. :) On Friday 29 November 2002 11:41 pm, Vox wrote: This time Lorne [EMAIL PROTECTED] becomes

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread Vox
This time Vox [EMAIL PROTECTED] becomes daring and writes: I hate sympa...silly thing insists on breaking signatures...somebody should put it out of our misery. Vox -- Think of the Linux community as a niche economy isolated by its beliefs. Kind of like the Amish,

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread James Sparenberg
On Fri, 2002-11-29 at 22:53, Lorne wrote: Thanks. That is an excellent idea! Now I have to try to remember how to keep the tail of a log constantly writing to the monitor. I KNOW I can do it, just so long since I have, I forget the syntax. :) tail -f name_of.log James On Friday 29

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread James Sparenberg
On Fri, 2002-11-29 at 22:50, Vox wrote: This time Lorne [EMAIL PROTECTED] becomes daring and writes: second send Sorry, I used an old subject and I'm guessing no one saw it earlier. I'd like to try again. Since I wrote this earlier today, I gave up on openbsd without the cdrom. I

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread Vox
This time Lorne [EMAIL PROTECTED] becomes daring and writes: Thanks. That is an excellent idea! Now I have to try to remember how to keep the tail of a log constantly writing to the monitor. I KNOW I can do it, just so long since I have, I forget the syntax. :) tail -f /var/log/messages

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread Vox
This time James Sparenberg [EMAIL PROTECTED] becomes daring and writes: On Fri, 2002-11-29 at 22:50, Vox wrote: This time Lorne [EMAIL PROTECTED] becomes daring and writes: second send Sorry, I used an old subject and I'm guessing no one saw it earlier. I'd like to try again.

Re: [expert] hack attack analysis second attempt

2002-11-29 Thread James Sparenberg
On Fri, 2002-11-29 at 23:06, Vox wrote: This time James Sparenberg [EMAIL PROTECTED] becomes daring and writes: On Fri, 2002-11-29 at 22:50, Vox wrote: This time Lorne [EMAIL PROTECTED] becomes daring and writes: second send Sorry, I used an old subject and I'm guessing no