Re: Security Approval Process

2003-03-28 Thread securityfocus
I agree with John about centralization of the function, because any change to the firewall(s) and other edge elements (external routers and switches as well as remote access or vpn solutions) of corporate security should be a defined (written) process of request and confirmation. Centralization

RE: XP admin shares

2002-12-10 Thread securityfocus
>From http://www.winguides.com/registry/display.php/4/ Create a new DWORD value of either 'AutoShareWks' for workstation or 'AutoShareServer' for server. Then set the value to equal '0' to disable automatic sharing. If the values already exist then modify them to change the value.

RE: How to authentificate an user via telephon?

2002-12-04 Thread securityfocus
One suggestion is: Verify his name matches his physical desk location identification in your records and call back the phone number you have on record to give them the new temp password. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 03, 2002

RE: PC Anyhwere and IP Forwarding

2002-06-11 Thread SecurityFocus
where some time causes other application level incompatibilities which introduces instability of the OS. Andrew MCSE (W2K & NT4) + CCNA > -Original Message- > From: Dan Harrington [mailto:[EMAIL PROTECTED]] > Posted At: Monday, June 10, 2002 9:00 AM > Posted To: Securit

Re: Where can I find a secure file replication program?

2002-05-23 Thread securityfocus . com
On Tue, May 21, 2002 at 11:42:43AM -0500, shawn merdinger wrote: > hmmma simple cron job ith ssh should be able to handle this...maybe > run it every cople of minutes. The only problem with running a job like that in cron is you don't know how long it will take , so either you set the jobs fa

Re: Tripwire Policies

2002-05-22 Thread securityfocus . com
On Fri, May 17, 2002 at 09:40:46PM -0400, leon wrote: > 2)Does anyone have any written policies they could share > (especially for the win2k platform)? I used the policy creater on the > tripwire site policy.tripwire.com and although it does provide something > to work off of it is based on a

Re: Webservers

2002-05-17 Thread securityfocus . com
On Wed, May 15, 2002 at 11:46:41AM -0500, Robert Buel wrote: > That would be true if both NOS's required equal intuition to > master...but they don't...I can stumble around in MS and see > configurational windows--and usually find what I'm looking for...but on > a 'NIX box, you have to specificall

Re: strong encryption - governments denying individuals the right to use

2002-04-29 Thread securityfocus . com
On Thu, Apr 25, 2002 at 12:08:54PM -0700, Jay D. Dyson wrote: > Those are the biggest reasons why you will be hard-pressed to find > any defense for your position. > > And if I may be so bold, I'd like to ask this: if you're taking a > position on this, but you can't personally justif

Re: dhcp (addon q)

2002-04-03 Thread securityfocus . com
On Sat, Mar 30, 2002 at 10:11:50AM -0600, Dennis Burns wrote: > Hey guys, quick add on question from the peanut galery. If im not just > running a single host on a cabel/dsl router is there a way to make dynamic > dns still work. Lets say there is a dedicated router (not an pc doing > routing fun

Re: Disk Wiping Utilities

2002-04-03 Thread securityfocus . com
On Fri, Mar 29, 2002 at 09:09:33PM -0800, Muhammad Faisal Rauf Danka wrote: > Use Linux utility "shred" . > and your problem is solved. From http://www.linuxsecurity.com/feature_stories/data-hiding-forensics.html: The important fact to note is that when empty space is wiped, slack space for all

Re: Disk Wiping Utilities

2002-04-01 Thread securityfocus . com
On Fri, Mar 29, 2002 at 02:06:44PM -0800, John S. Lyons wrote: > I've done dd if=/dev/zero of=/dev/hda in the past. What is the > advantage of using /dev/ramdom? There are ways to recover over-written data if you have physical access to the drive. Some involve removing the platters and checking

Re: Disk Wiping Utilities

2002-03-29 Thread securityfocus . com
On Thu, Mar 28, 2002 at 10:24:12PM -0800, Craig Skelton wrote: > If you are using a real operating system (*nix) then you can simply > dd if=/dev/random of=/dev/hda /dev/random is really slow to fill with entropy. urandom is more than good enough for this, and doesn't run out the way /dev/rand

Re: Disk Wiping Utilities

2002-03-28 Thread securityfocus . com
On Tue, Mar 26, 2002 at 10:14:28PM -, Dan Williamson wrote: > I am looking for a good utility to erase all hard drives > in a machine to a DOD standard. I would prefer a > FREE utility as this is a government agency and I try > to keep costs down. > > I have read that Norton Wipeinfo, BCWi

Re: dhcp

2002-03-28 Thread securityfocus . com
On Tue, Mar 26, 2002 at 08:46:08PM -0800, James Z wrote: > But wouldn't it be simple to have a script that checks for the ip address > every day, and if its changed, send an email to your regular users informing > them of the new address? That was me. I also mentioned a few other reasons, but j

Re: New Comcast software a security risk?

2002-03-25 Thread securityfocus . com
On Fri, Mar 22, 2002 at 02:42:47PM +, nobody somewhere wrote: > I was a former @home high speed internet customer before the transistion to > Comcast high speed internet. > > ONe strange thing i notice about the comcast DHCP ip setup they have a IP > lease set to 7 days after logging into t

Re: Nessus follow up question.

2002-03-25 Thread securityfocus . com
On Fri, Mar 22, 2002 at 09:53:13AM -0800, Bejon Parsinia wrote: > I do dedicate a great deal of memory to the guest OS and still run into > problems with performance. I'm not doing anything crazy like streaming > video or running any kind of multimedia. But, I have just found dual boot > to work

Re: PINs Password Management

2002-03-22 Thread securityfocus . com
On Wed, Mar 20, 2002 at 06:31:14PM -0500, Frederick Garbrecht wrote: > I use Vault to store network configuration information and PINs for password > management, but I keep the executables and databases on an IBM memory key > (which stays in my pocket). If I need a pw, I just uncap the key and st

Re: Nessus follow up question.

2002-03-22 Thread securityfocus . com
On Wed, Mar 20, 2002 at 09:48:56AM -0800, Bejon Parsinia wrote: > Here is what I would suggest. Definitely go with dual boot over a virtual > OS installation. Why? I've used VMWare and I've used Virtual PC, neither > of them allow any kind of real performance. Case in point, I have a P4 1.6 >

Re: Key Server...

2002-03-07 Thread securityfocus . com
On Wed, Mar 06, 2002 at 11:37:36AM -0500, [EMAIL PROTECTED] wrote: > I have set up a keyserver (on a trial basis) and asked my colleagues to > add their keys to it. > > When I try to send them a mail and import their keys, I am told that the > "Key is not certified by the keyserver. Am I sure I

Re: Key Server...

2002-03-05 Thread securityfocus . com
On Sat, Mar 02, 2002 at 04:15:14AM -0500, Sumit Dhar wrote: > The second part is, say I am running the key server. Now there is a user > X I want to certify. What I will need to do is most probably sign his > public key with my private key?? And then re-upload it to the keyservers, where all of

Re: Unclassified Disk "Sanitizers"

2002-03-03 Thread securityfocus . com
On Wed, Feb 27, 2002 at 08:18:28AM -0800, Jared C. Lovell wrote: > C'mon kids, why waste money just to destroy data? It's easier than all > that. Drop disk in question in a free unix box, then: > > dd if=/dev/urandom of=/dev/daWhateverdisk > > If you're really paranoid, put it in a while true

Re: Key Server...

2002-03-03 Thread securityfocus . com
On Wed, Feb 27, 2002 at 02:11:20PM -0500, Sumit Dhar wrote: > We are planning to set up our own keyserver so what we can > digitally sign and encrypt our mails. Ideally users would be using > either pgp or gnupg. > > 2. How compatible are gnupg and pgp? I can verify your signature on this mes