🚀 go-pugleaf

Paul Richards wrote:

> I've recently got my Linux (Debian) box set up back to how it was before
> I broke it.  (Well M$ FDISK decided to make a FAT32 partition overlap my
> EXT2 which was nice when I tried to format the FAT32..)  What should I
> do to make the system more secure?  I no longer have dual boot, only
> Linux because I was pissed off with what M$ FDISK done.
>
> I'm only on a dialup box and I have no local network.  Any tips/ideas?
>
> I need to have http and anonymous ftp connections allowed and I also
> need to be able to telnet in.

two obvious things,

* don't run any services you don't need (check inetd.conf for a start). Do
  netstat -an | grep LISTEN to see what else you have running.
* don't use telnet, install ssh instead and use that if you're even remotely
  bothered about security.

-- 
Ben Smithurst            | PGP: 0x99392F7D
ben@scientia.demon.co.uk |   key available from keyservers and
                         |   ben+pgp@scientia.demon.co.uk

Paul Richards <pauldoo@dunvegan1.demon.co.uk> doodled in uk.comp.os.linux:

> I've recently got my Linux (Debian) box set up back to how it was before
> I broke it.  (Well M$ FDISK decided to make a FAT32 partition overlap my
> EXT2 which was nice when I tried to format the FAT32..)  What should I
> do to make the system more secure?  I no longer have dual boot, only
> Linux because I was pissed off with what M$ FDISK done.

Too right! Nuke that evil m$loth scum :)

> I'm only on a dialup box and I have no local network.  Any tips/ideas?
> 
> I need to have http and anonymous ftp connections allowed and I also
> need to be able to telnet in.

Okiedokies... as someone's already said, don't run any services you don't
really need - start by disabling things in /etc/inetd.conf, and check with
netstat -ant | grep LISTEN to see what other standalone daemons you've got
running. (You can use  fuser -n tcp port#   to see what process is using a
particular port if it's not running out of inetd.)

What I'd also recommend is getting a firewall that blocks all new incoming tcp
connections between 1-1024, apart from 22 and 80. (I find ftp expendable,
especially if you've got a way of accessing ~ftp over http or ssh, but YMMV as
always.)

Play with ipchains a bit - in particular you want -y to stop all new incoming
tcp connections whilst permitting packets to come back to a low source port,
and -l to log failures.
(When designing a firewall for dialup purposes, don't use specific IP#s
especially if you have dynamic IP, but deal in terms of -i ppp0, of course.
You might want to use ipchains-save and ipchains-restore to preserve the
firewall and restore it on dialup automatically.)

What you might also like to consider is running fakebo - this is a standalone
daemon that listens for incoming Back Orifice scans and optionally sends crap
back - in the space of two weekends I caught as many scans over even a dynamic
dialup IP range...

~Tim
--
| Geek Code: GCS dpu s-:+ a-- C++++ UBLUAVHSC++++ P+++ L++ E--- W+++(--) N++ 
| w--- O- M-- V-- PS PGP++ t--- X+(-) b D+ G e++(*) h++(*) r--- y-	     
| Flags	: 	fpu vme de pse tsc msr mce cx8 sep mtrr pge mmx 3dnow
| The sun is melting over the hills,         | http://www.glutinous.custard.org
| All our roads are waiting / To be revealed | piglet@glutinous.custard.org

Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:

> I've recently got my Linux (Debian) box set up back to how it was before
> I broke it.  (Well M$ FDISK decided to make a FAT32 partition overlap my
> EXT2 which was nice when I tried to format the FAT32..)  What should I
> do to make the system more secure?  I no longer have dual boot, only
> Linux because I was pissed off with what M$ FDISK done.

My advice is probably going to sound patronising, but it's not supposed to
be: basically, get to know your system, and understand how things work.
When you say you want your system "secure", presumably you mean w.r.t. people
getting in over the internet, rather than security on the console.
Look at everything that's listening for connections / packets (netstat -t -u
-l works for me), decide if you need it running or not. For those that you
do need running, read the docs, look at any configuration options, etc.

> I'm only on a dialup box and I have no local network.  Any tips/ideas?

> I need to have http and anonymous ftp connections allowed and I also
> need to be able to telnet in.

Logging everything would be a good start so you can see what's going on.
If possible, use ssh rather than telnet so your passwords don't go in the
clear over the internet. If you can, restrict which hosts are allowed access
to the various services as tightly as possible.

-- 
"If you wish to insult me my consulting rates are available by return of
email." -- Alan Cox

Steve Dodd wrote:
> 
> Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:
> 
> > I've recently got my Linux (Debian) box set up back to how it was before
> > I broke it.  (Well M$ FDISK decided to make a FAT32 partition overlap my
> > EXT2 which was nice when I tried to format the FAT32..)  What should I
> > do to make the system more secure?  I no longer have dual boot, only
> > Linux because I was pissed off with what M$ FDISK done.
> 
> My advice is probably going to sound patronising, but it's not supposed to
> be: basically, get to know your system, and understand how things work.
> When you say you want your system "secure", presumably you mean w.r.t. people
> getting in over the internet, rather than security on the console.
> Look at everything that's listening for connections / packets (netstat -t -u
> -l works for me), decide if you need it running or not. For those that you
> do need running, read the docs, look at any configuration options, etc.

OK here goes:
tcp        0      0 *:4666                  *:*                    
LISTEN      
tcp        0      0 *:1239                  *:*                    
LISTEN      
tcp        0      0 *:1177                  *:*                    
LISTEN      
tcp        0      0 *:1176                  *:*                    
LISTEN      
tcp        0      0 *:1175                  *:*                    
LISTEN      
tcp        0      0 *:1174                  *:*                    
LISTEN      
tcp        0      0 *:1173                  *:*                    
LISTEN      
tcp        0      0 *:1172                  *:*                    
LISTEN      
tcp        0      0 *:1171                  *:*                    
LISTEN      
tcp        0      0 *:1164                  *:*                    
LISTEN      
tcp        0      0 *:6000                  *:*                    
LISTEN      
tcp        0      0 *:4383                  *:*                    
LISTEN      
No idea what those were

tcp        0      0 *:nntp                  *:*                    
LISTEN      
My NTP server???

tcp        0      0 *:ftp                   *:*                    
LISTEN      
I need this

tcp        0      0 *:www                   *:*                    
LISTEN      
And this

tcp        0      0 *:5865                  *:*                    
LISTEN      
tcp        0      0 *:55556                 *:*                    
LISTEN      
tcp        0      0 *:5556                  *:*                    
LISTEN      
tcp        0      0 *:omniorb               *:*                    
LISTEN      
tcp        0      0 *:9111                  *:*                    
LISTEN      
tcp        0      0 *:803                   *:*                    
LISTEN      
No idea

tcp        0      0 *:printer               *:*                    
LISTEN      
Do I need this?  lpr does the printing AFAIK

tcp        0      0 *:socks                 *:*                    
LISTEN      
No idea

tcp        0      0 *:auth                  *:*                    
LISTEN      
Am I a PAP server or something stupid?

tcp        0      0 *:vboxd                 *:*                    
LISTEN      
tcp        0      0 *:saft                  *:*                    
LISTEN      
No idea

tcp        0      0 *:finger                *:*                    
LISTEN      
I know this one, but DoS attacks can come from this right?

tcp        0      0 *:smtp                  *:*                    
LISTEN      
tcp        0      0 *:pop3                  *:*                    
LISTEN      
I need those two, but perhaps I could place IP restrictions...  ?

tcp        0      0 *:telnet                *:*                    
LISTEN      
Need this

tcp        0      0 *:time                  *:*                    
LISTEN      
Or is this my NTP server???

tcp        0      0 *:daytime               *:*                    
LISTEN      
tcp        0      0 *:discard               *:*                    
LISTEN      
tcp        0      0 *:sunrpc                *:*                    
LISTEN      
No idea what those were



OK chaps, enlighten me.
-- 
Paul Richards (Pauldoo) - http://www.pauldoo.co.uk

I've not ran any Microsoft code for 1351078 seconds.
    How about you?

Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:
> OK here goes:
> tcp        0      0 *:4666                  *:*                     LISTEN
> tcp        0      0 *:1239                  *:*                     LISTEN
> tcp        0      0 *:1177                  *:*                     LISTEN
> tcp        0      0 *:1176                  *:*                     LISTEN
> tcp        0      0 *:1175                  *:*                     LISTEN
> tcp        0      0 *:1174                  *:*                     LISTEN
> tcp        0      0 *:1173                  *:*                     LISTEN
> tcp        0      0 *:1172                  *:*                     LISTEN
> tcp        0      0 *:1171                  *:*                     LISTEN
> tcp        0      0 *:1164                  *:*                     LISTEN
> tcp        0      0 *:6000                  *:*                     LISTEN

6000 is X, IIRC. X does its own access control .

> tcp        0      0 *:4383                  *:*                     LISTEN
> No idea what those were

Me neither :-(

> tcp        0      0 *:nntp                  *:*                     LISTEN
> My NTP server???

NNTP -- you seem to running a news server. INN or Cnews probably, or maybe
leafnode (does anyone know if the latter has an NNTP interface?). You ought
to make sure that no unauthorised bods can post through it; you probably
don't want anyone reading from it either over a dial-up link, however public
spirited you are. I regularly see people probing my news server, presumably
look for an open one to spam Usenet through.

> tcp        0      0 *:ftp                   *:*                    LISTEN
> I need this

Fair enough :-) Just make sure there aren't any known exploits in the ftpd
you're running. If you've got anonymous ftp enabled, make sure there's nothing
in ~ftp you don't want people to see.

> tcp        0      0 *:www                   *:*                    LISTEN
> And this

AFAIK, the biggest security problems with web servers are any CGI scripts that
might be available, so check those out.

> tcp        0      0 *:5865                  *:*                     LISTEN
> tcp        0      0 *:55556                 *:*                     LISTEN
> tcp        0      0 *:5556                  *:*                     LISTEN
> tcp        0      0 *:omniorb               *:*                     LISTEN
> tcp        0      0 *:9111                  *:*                     LISTEN
> tcp        0      0 *:803                   *:*                     LISTEN
> No idea

omniorb is presumably an CORBA ORB. I think Gnome may use it. I /assume/
it has sane access control, but I don't use it and know nothing about it.
This is the sort of thing for which you could safely reject connections
coming over your PPP interface. As others have suggested, it's probably
best to set up your firewalling rules (ipmasqadm/ipfwadm/ipchains) to disallow
all incoming connects except the ones you know you want open (ftp, www).

> tcp        0      0 *:printer               *:*                    LISTEN
> Do I need this?  lpr does the printing AFAIK

Only if you want to print remotely - I don't know much about this, I'm
afriad.

> tcp        0      0 *:socks                 *:*                    LISTEN
> No idea

A SOCKS proxy. It's worth figuring out what package this is, and making sure
it will reject connections from the internet. Actually, you don't need it
all if you haven't got a LAN. The risk is people could use it to connect to
arbitrary machines on the internet and perform mischief, and it would look
like it was coming from you.

> tcp        0      0 *:auth                  *:*                    LISTEN
> Am I a PAP server or something stupid?

Nope, PAP is auth protocol involved in PPP. This is identd, and /fairly/
harmless; people can connect to it and give it a a port number, and it returns
the user name of the person who owns the corresponding socket. It's only use
is AFAICT for remote sys admins to log; if they spot any abuse coming from
a multiuser system they can forward the info to the other system's admin
to aid LARTing. You could kill it if you want to, or use an identd which
returns random info, or similar. I believe some IRC networks insist on being
about to identd you before letting you on.

> tcp        0      0 *:vboxd                 *:*                    LISTEN
> tcp        0      0 *:saft                  *:*                    LISTEN
> No idea

Me neither. See if there's anything useful mentioned in /etc/services for
these.

> tcp        0      0 *:finger                *:*                    LISTEN
> I know this one, but DoS attacks can come from this right?

Erm, pass. If it's a bog standard finger daemon it should be OK; you might
want to look at the information it provides and see if you really want to
make it available.

> tcp        0      0 *:smtp                  *:*                    LISTEN
> tcp        0      0 *:pop3                  *:*                    LISTEN
> I need those two, but perhaps I could place IP restrictions...  ?

You can probably restrict access to the SMTP server to Demon's mail subnet
(which I can't remember off hand, it must be documented somewhere) and any
where you might want to send mail from (probably just your local address).
For the pop3 server, anywhere you want to pick mail up from (again,
probably just your local address).

> tcp        0      0 *:telnet                *:*                    LISTEN
> Need this

Better to use ssh if you can; unless you're using something fancy like IPsec,
your passwords as well as your session data will go across the internet in
the clear with regular telnet.

> tcp        0      0 *:time                  *:*                    LISTEN
> Or is this my NTP server???

No, this is just a very simple time protocol - splits out 4 bytes giving
the seconds since the epoch. I can't see any harm in that, but then, no
obvious uses spring to mind either.

> tcp        0      0 *:daytime               *:*                    LISTEN
> tcp        0      0 *:discard               *:*                    LISTEN

daytime just spits out the current date and time in human readable format.
discard justs read characters and throws them away, mainly used for debugging
networks. Again, no harm but no use either; though in theory I think there's
an RFC that makes the discard service mandatory, I don't believe many people
honour that bit of it any more.

> tcp        0      0 *:sunrpc                *:*                    LISTEN
> No idea what those were

That's for all the rpc-based services, you need to use rpcinfo(8) to find
out what services are running.

> OK chaps, enlighten me.

There's an awful lot of stuff running there -- what distro are you using?
I'm wondering if inetd(8) is listening to many ports for which the associated
programs aren't installed. It would certainly be worth reading about inetd
and inetd.conf, and then having a rummage around in the latter file. Also
read about tcpd and hosts_access for setting IP restrictions on services.

Also, I didn't see any *udp* listeners in there, which seems odd. netstat
-ul will show those.

-- 
"If you wish to insult me my consulting rates are available by return of
email." -- Alan Cox

In demon.tech.unix Steve Dodd <dirk@loth.demon.co.uk> wrote:
> Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:
>> tcp        0      0 *:4383                  *:*                     LISTEN
>> No idea what those were
> Me neither :-(

You can use "lsof" to see which processes have opened these ports.

> As others have suggested, it's probably best to set up your
> firewalling rules (ipmasqadm/ipfwadm/ipchains) to disallow all
> incoming connects except the ones you know you want open (ftp, www).

One caveat - if you do this then all ftp must be "passive" rather than
the older "active" mode which tries to open connections on different
ports.   (I believe there may be workarounds available for this with
newer kernels.)

>> tcp        0      0 *:vboxd                 *:*                    LISTEN
>> tcp        0      0 *:saft                  *:*                    LISTEN

Also note that for (usually) non-privileged ports the service running
will not always match the entry in /etc/services - again: lsof.

>> tcp        0      0 *:finger                *:*                    LISTEN
>> I know this one, but DoS attacks can come from this right?

> Erm, pass. If it's a bog standard finger daemon it should be OK; you might
> want to look at the information it provides and see if you really want to
> make it available.

Running an external finger daemon is next to useless for dial-ups and
you should switch it off unless you have some unusual requirement for
it to be there.

If you have an account on a remote machine (ie a shell account) try
using a port scanning tool[1] such as nmap to scan the ports of your
demon connected box remotely.  The *only* services that should be
available are those you expect to be open. Ideally, for most dial-up
users this should be none. (ports for smtp, ntp, nntp, etc should have
access restricted via packet filtering to the required ranges.)

[1] Ensure you have permission from yourself before attempting to scan
    your own machine.
-- 
Lee Maguire <{$news-reply$}@wetware.demon.co.uk>

Lee Maguire <see-sig@nospam.demon.co.uk> wrote:

> You can use "lsof" to see which processes have opened these ports.

True; unfortunately my machine has been so badly b0rken for so long I forgot
that it would probably work for most people (odd kernel versions, odd util
versions, horrible mess, don't ask <g>)

[..]
> Running an external finger daemon is next to useless for dial-ups and
> you should switch it off unless you have some unusual requirement for
> it to be there.
[..]

Well, that goes for everything. But I got the impression that the original
poster was likely to online a lot (from the fact that he wanted http, ftp and
pop3 ports open, and he's not on a LAN), in which case finger is useful for
people who might want to know if you're logged in, and active.

-- 
"If you wish to insult me my consulting rates are available by return of
email." -- Alan Cox

In demon.tech.unix, Steve Dodd  wrote:

>> tcp        0      0 *:printer               *:*                    LISTEN
>> Do I need this?  lpr does the printing AFAIK
> Only if you want to print remotely - I don't know much about this, I'm
> afriad.

I'm fairly sure you need lpd even if you only print locally.

-- 
Rachael                             Currently seeking email routes to
                                    Fidonet Zones 4, 5 and 6.

Steve Dodd wrote:
[snip usefull information]

> There's an awful lot of stuff running there -- what distro are you using?

Debian potato.

> I'm wondering if inetd(8) is listening to many ports for which the associated
> programs aren't installed. It would certainly be worth reading about inetd
> and inetd.conf, and then having a rummage around in the latter file. Also
> read about tcpd and hosts_access for setting IP restrictions on services.
> 
> Also, I didn't see any *udp* listeners in there, which seems odd. netstat
> -ul will show those.

Since I still don't know what all those services are I'll leave them all
as is and just set up a firewall.

-- 
Paul Richards (Pauldoo) - http://www.pauldoo.co.uk

I've not ran any Microsoft code for 1381257 seconds.
    How about you?

* Steve Dodd wrote:

> 6000 is X, IIRC. X does its own access control .

Better make sure it's turned on though...

> NNTP -- you seem to running a news server. INN or Cnews probably, or maybe
> leafnode (does anyone know if the latter has an NNTP interface?). Y

Yes it does.  With no access control *at all* -- They assume you use
tcpwrappers.

--tim

In demon.tech.unix Steve Dodd <dirk@loth.demon.co.uk> wrote:
> Well, that goes for everything. But I got the impression that the
> original poster was likely to online a lot (from the fact that he
> wanted http, ftp and pop3 ports open, and he's not on a LAN), in which
> case finger is useful for people who might want to know if you're
> logged in, and active.

Well, if an http is running then it's a good indication that the machine
is online - and (since this is a dial-up demon account) if the user is
idle for extended periods - WHO'S PAYING THE BILL?

Unless they're one of those lucky bastards in Hull or something...

-- 
Lee Maguire <{$news-reply$}@wetware.demon.co.uk>

In demon.tech.unix, Lee Maguire  wrote:

> Well, if an http is running then it's a good indication that the machine
> is online - and (since this is a dial-up demon account) if the user is

Not at all. One OS I had the displeasure of using used an httpd as part
of its help system; you might also run one to serve pages to a local
network or for personal use.

-- 
Rachael                             Currently seeking email routes to
                                    Fidonet Zones 4, 5 and 6.

On 13 Dec 1999 12:49:32 -0000, Rachael Munns muttered:
>In demon.tech.unix, Lee Maguire  wrote:
>
>> Well, if an http is running then it's a good indication that the machine
>> is online - and (since this is a dial-up demon account) if the user is
>
>Not at all. One OS I had the displeasure of using used an httpd as part
>of its help system; you might also run one to serve pages to a local
>network or for personal use.
>

I came across an NT (spit!) machine recently set up the same. Someone had
also installed the personal Windows95 webserver on the same machine -
although it never attempted to run until I installed something unrelated, at
which point the help system was unable to bind to the port. What a mess!

-- 
Paul Grayson, Ripon, North Yorkshire, UK.

I'm looking for Unix/Linux work in my area - email for details.
Bill Gates - didn't he play for Middlesbrough?

Rachael Munns wrote:
> 
> In demon.tech.unix, Lee Maguire  wrote:
> 
> > Well, if an http is running then it's a good indication that the machine
> > is online - and (since this is a dial-up demon account) if the user is
> 
> Not at all. One OS I had the displeasure of using used an httpd as part
> of its help system; you might also run one to serve pages to a local
> network or for personal use.

Or just to brag about to my windows chums???  :)
-- 
Paul Richards (Pauldoo) - http://www.pauldoo.co.uk

I've not ran any Microsoft code for 1450677 seconds.
    How about you?

Paul Richards wrote:
> 
> Steve Dodd wrote:
> [snip usefull information]
> 
> > There's an awful lot of stuff running there -- what distro are you using?
> 
> Debian potato.
> 
> > I'm wondering if inetd(8) is listening to many ports for which the associated
> > programs aren't installed. It would certainly be worth reading about inetd
> > and inetd.conf, and then having a rummage around in the latter file. Also
> > read about tcpd and hosts_access for setting IP restrictions on services.
> >
> > Also, I didn't see any *udp* listeners in there, which seems odd. netstat
> > -ul will show those.
> 
> Since I still don't know what all those services are I'll leave them all
> as is and just set up a firewall.

OK, I've got the firewall thing enabled in the kernel ("Network
firewalls" and "IP: Firewalling") and I installed fwctl.  I can run
fwctl but it just gives me the flags.

I guess I'll need to actually read some docs or something totally
irrational like that...

Some odd things I noted before I rebooted:
 XF86_SVGA was taking 190Mb of memory???
 Now it's only at 30Mb.

Anyway, that was pointless for you guys to know.


/me is off to put Quake II back into cache where it'll stay for a couple
of weeks.
-- 
Paul Richards (Pauldoo) - http://www.pauldoo.co.uk

I've not ran any Microsoft code for 1450737 seconds.
    How about you?

Lee Maguire <see-sig@nospam.demon.co.uk> writes:

> One caveat - if you do this then all ftp must be "passive" rather than
> the older "active" mode which tries to open connections on different
> ports.   (I believe there may be workarounds available for this with
> newer kernels.)

I don't find that a problem apart from with BTClick's ftp home page
server which doesn't seem to understand passive, or unix file permissions
for that matter.

 - Richard.

-- 
   _/_/_/  _/_/_/  _/_/_/ Richard Corfield <Richard@Littondale.freeserve.co.uk>
  _/  _/    _/    _/      Web Page, CV:   http://www.littondale.freeserve.co.uk
 _/_/      _/    _/       Dance (Ballroom, RnR), Hiking, SJA, Linux, ... [ENfP]
_/  _/  _/_/    _/_/_/    PGP2.6 Key ID:0x0FB084B1   GPG/PGP5 Key ID:0xFA139DA7

>>>>> "Rachael" == Rachael Munns <vashti@drmach.dream.org.uk> wrote:

Rachael> In demon.tech.unix, Lee Maguire  wrote:
>> Well, if an http is running then it's a good indication that the
>> machine is online - and (since this is a dial-up demon account) if
>> the user is

Rachael> Not at all. One OS I had the displeasure of using used an
Rachael> httpd as part of its help system;

Irix does this (and using/admining that is an extreme displeasure).
Interestingly it also appears to need a listening process to manage to
show icons in its icon tray.  

Stefan 

Paul Richards <pauldoo@dunvegan1.demon.co.uk> doodled in uk.comp.os.linux:

> > Since I still don't know what all those services are I'll leave them all
> > as is and just set up a firewall.

Bah. Find them and work out whether you want them or not! :]
	su root -c 'fuser -n tcp 23'
that's enough of a hint :)

Right, on with the thingy...

> OK, I've got the firewall thing enabled in the kernel ("Network firewalls"
> and "IP: Firewalling") and I installed fwctl.  I can run fwctl but it just
> gives me the flags.  I guess I'll need to actually read some docs or
> something totally irrational like that...

Yeah. But while you're at it, apt-get install gfcc, and play with that
instead. It's a pretty decent interface to ipchains, and will export shell
scripts for you to debug^Wuse, so you can get the hang of it all sooner or
later.
(Make sure you have a clear picture of what interface in your machine is doing
what, and what the input/forwarding/output chains *do*, as from e.g. the
Masquerading HOWTO. Then consider running gfcc :)

> Some odd things I noted before I rebooted: XF86_SVGA was taking 190Mb of
> memory???  Now it's only at 30Mb.

I've been having that with Potato at work of late - it went up to >300M (on a
box with 256M RAM and 128M swap) and I had to kill my favourite wmaker only
this morning. Grrr!

> Anyway, that was pointless for you guys to know.

Not at all. I hope they've updated the X server package since then, else I'll
kick up A Stink again :]

~Tim
--
| Geek Code: GCS dpu s-:+ a-- C++++ UBLUAVHSC++++ P+++ L++ E--- W+++(--) N++ 
| w--- O- M-- V-- PS PGP++ t--- X+(-) b D+ G e++(*) h++(*) r--- y-	     
| Flags	: 	fpu vme de pse tsc msr mce cx8 sep mtrr pge mmx 3dnow
| The sun is melting over the hills,         | http://www.glutinous.custard.org
| All our roads are waiting / To be revealed | piglet@glutinous.custard.org

Tim Haynes wrote:
[snip stuff I'll reply to later]

> > Some odd things I noted before I rebooted: XF86_SVGA was taking 190Mb of
> > memory???  Now it's only at 30Mb.
> 
> I've been having that with Potato at work of late - it went up to >300M (on a
> box with 256M RAM and 128M swap) and I had to kill my favourite wmaker only
> this morning. Grrr!

Playing about a bit I've noticed it only goes up when I use GLX, you
don't use that do you?
-- 
Paul Richards (Pauldoo) - http://www.pauldoo.co.uk

I've not ran any Microsoft code for 1474078 seconds.
    How about you?

On 12 Dec 1999, Steve Dodd wrote:

> Paul Richards <pauldoo@dunvegan1.demon.co.uk> wrote:
>> tcp        0      0 *:nntp                  *:*                     LISTEN
>> My NTP server???
> 
> NNTP -- you seem to running a news server. INN or Cnews probably, or maybe
> leafnode (does anyone know if the latter has an NNTP interface?). You ought
> to make sure that no unauthorised bods can post through it; you probably
> don't want anyone reading from it either over a dial-up link, however public
> spirited you are. I regularly see people probing my news server, presumably
> look for an open one to spam Usenet through.

I used to restrict access to leafnode with tcpwrappers... but I somehow still
managed to get into an open NNTP server list (probably because the connection
is first accepted before being told where to go by tcpwrappers). I now use
ipchains so only my localnet can see it, everyone else gets Connection
Refused.

>> tcp        0      0 *:ftp                   *:*                    LISTEN
>> I need this
> 
> Fair enough :-) Just make sure there aren't any known exploits in the ftpd
> you're running. If you've got anonymous ftp enabled, make sure there's nothing
> in ~ftp you don't want people to see.

Ditto. I just use it when sharing files with friends... and it gets removed
straight afterwards.

>> tcp        0      0 *:www                   *:*                    LISTEN
>> And this
> 
> AFAIK, the biggest security problems with web servers are any CGI scripts that
> might be available, so check those out.

This is where I've taken an odd approach. The front page as accessed by my
real hostname is the standard Eridani Linux / Apache age saying I got it
right. I do use my web server for developing stuff, and that material is only
accessible when it's referred to using my localnet hostname and IP address.

And, no, I have no CGI scripts available on my 'real hostname' front.

>> tcp        0      0 *:printer               *:*                    LISTEN
>> Do I need this?  lpr does the printing AFAIK
> 
> Only if you want to print remotely - I don't know much about this, I'm
> afriad.

I think it's also needed for local printing. Probably something else I ought
to firewall. *HINT* My printer is only switched on when needed, before anyone
gets any funny ideas ;)

>> tcp        0      0 *:finger                *:*                    LISTEN
>> I know this one, but DoS attacks can come from this right?
> 
> Erm, pass. If it's a bog standard finger daemon it should be OK; you might
> want to look at the information it provides and see if you really want to
> make it available.

That's one I keep disabled. I don't want people knowing which user ids are
real or when I last read my email...

>> tcp        0      0 *:smtp                  *:*                    LISTEN
>> tcp        0      0 *:pop3                  *:*                    LISTEN
>> I need those two, but perhaps I could place IP restrictions...  ?
> 
> You can probably restrict access to the SMTP server to Demon's mail subnet
> (which I can't remember off hand, it must be documented somewhere) and any
> where you might want to send mail from (probably just your local address).
> For the pop3 server, anywhere you want to pick mail up from (again,
> probably just your local address).

194.217.242.*

...and I don't run a pop3 server.

> > tcp        0      0 *:telnet                *:*                    LISTEN
> > Need this
> 
> Better to use ssh if you can; unless you're using something fancy like IPsec,
> your passwords as well as your session data will go across the internet in
> the clear with regular telnet.

I'm running both, with access restriction so telnet access only works for
those who can't for whatever reason use SSH.

I'm running Eridani Linux 6.1A, based somewhat on Red Hat Linux 6.1.

-- Michael "Soruk" McConnell		     [Eridani Linux 6.1A available]
Eridani Linux  --  The Most Up-to-Date Red Hat-based Linux CDROMs Available
Email: linux@eridani.co.uk  http://www.eridani.co.uk   Fax: +44-8701-600807
    "No. 'Eureka' is Greek for 'This bath is too hot.'" - Dr Who.

Stefan Davids <smd@hopf.demon.co.uk> wrote:

> Irix does this (and using/admining that is an extreme displeasure).
> Interestingly it also appears to need a listening process to manage to
> show icons in its icon tray.  

The latter /might/ be justifiable, I suppose. X is supposed to be network
transparent. Though I'm too tired to get my head around the IPC issues
involved in an icon tray. Brain hurts.

-- 
"If you wish to insult me my consulting rates are available by return of
email." -- Alan Cox

Michael McConnell <soruk@eridani.demon.co.uk> writes:

> I think it's also needed for local printing. Probably something else I ought
> to firewall. *HINT* My printer is only switched on when needed, before anyone
> gets any funny ideas ;)

It's probably much simpler to firewall everything and then enable any
services you do want.  Helps avoid missing things out, and seems to
result in much shorter rulesets.

-- 
Mark Brown  mailto:broonie@tardis.ed.ac.uk   (Trying to avoid grumpiness)
            http://www.tardis.ed.ac.uk/~broonie/
EUFS        http://www.eusa.ed.ac.uk/societies/filmsoc/

Tim Haynes <piglet@glutinous.custard.org> wrote:
> Paul Richards <pauldoo@dunvegan1.demon.co.uk> doodled in uk.comp.os.linux:

> (Make sure you have a clear picture of what interface in your machine is doing
> what, and what the input/forwarding/output chains *do*, as from e.g. the
> Masquerading HOWTO. Then consider running gfcc :)

But do make sure you stay away from the ipchains HOWTO. It
has to be the most impenetrable one in the whole bunch.

The Masquerading HOWTO is much more easy to grasp, even
if I still haven't quite gotten to grips with it 
myself yet. :-(

-- 
peter@petermc.demon.co.uk

Please insert the word NOSPAM into the above address to ensure
that your unsolicited e-mail doesn't actually reach me.

>>>>> "Steve" == Steve Dodd <dirk@loth.demon.co.uk> wrote:

Steve> Stefan Davids <smd@hopf.demon.co.uk> wrote:
>> Irix does this (and using/admining that is an extreme displeasure).
>> Interestingly it also appears to need a listening process to manage to
>> show icons in its icon tray.  

Steve> The latter /might/ be justifiable, I suppose. X is supposed to
Steve> be network transparent. Though I'm too tired to get my head
Steve> around the IPC issues involved in an icon tray. Brain hurts.

Ah well it actually uses it as a sort of clearing house for filesystem
changes.  So the kernel informs this application when something
changes, then the application informs whatever other applications
might be interested which can then update themselves as appropriate.

And of course it has to be a listening process so that it works across
networks and can monitor NFS filesytems by talking to similar
processes on the various host computers.  I'm torn between thinking
this is a clever idea and an utterly deranged one.  I suppose it might
be a cleverly deranged one.

Network transparent icon trays - what fun!

Anyway to drag this back on topic for ucol, has anyone tried SGI Linux
on an Indy?  

Stefan 

On 14 Dec 1999 00:28:53 GMT, peter@petermc.demon.co.uk
<peter@petermc.demon.co.uk> wrote:

> > (Make sure you have a clear picture of what interface in your machine is
> > doing what, and what the input/forwarding/output chains *do*, as from e.g.
> > the Masquerading HOWTO. Then consider running gfcc :)
> 
> But do make sure you stay away from the ipchains HOWTO. It has to be the
> most impenetrable one in the whole bunch.

Fair enough. I was considering recommending such a beastie, but couldn't be
bothered digging it up :)

	Chain.
	Rule.
	Interface.
	Protocol.
	accept|deny|reject.
in roughly that order.

> The Masquerading HOWTO is much more easy to grasp, even if I still haven't
> quite gotten to grips with it myself yet. :-(

It's really really easy, once you realise that there are only two lines in it
that are relevant and only one of those is required to make it work (the other
is 'deny forwarding by default'). It might be helpful to think of it in terms
like "pick up packets from 'ere and magically fling 'em ower yonder", too :)

(Be grateful I don't write HOWTOs, at least not just yet ;)

~Tim
--
| Geek Code: GCS dpu s-:+ a-- C++++ UBLUAVHSC++++ P+++ L++ E--- W+++(--) N++
| w--- O- M-- V-- PS PGP++ t--- X+(-) b D+ G e++(*) h++(*) r--- y-
| The sun is melting over the hills,         | http://www.glutinous.custard.org
| All our roads are waiting / To be revealed | piglet@glutinous.custard.org  

In demon.tech.unix Rachael Munns <vashti@drmach.dream.org.uk> wrote:
> In demon.tech.unix, Lee Maguire  wrote:
>> Well, if an http is running then it's a good indication that the machine
>> is online - and (since this is a dial-up demon account) if the user is

> Not at all. One OS I had the displeasure of using used an httpd as part
> of its help system; you might also run one to serve pages to a local
> network or for personal use.

But (and this was my point) for someone wanting to check from an
external box if the machine was online then being able to access
it's webserver is as good an indication as a sucessful finger query.

I've always got an httpd available - albeit through inetd and behind a
firewall...

-- 
Lee Maguire <{$news-reply$}@wetware.demon.co.uk>

Lee Maguire <see-sig@nospam.demon.co.uk> wrote:

> But (and this was my point) for someone wanting to check from an
> external box if the machine was online then being able to access
> it's webserver is as good an indication as a sucessful finger query.

It wouldn't necessarily tell you that *I* was logged in, though. My machine
dials out at some stupid time of the morning (ok, 7.30am <g>) under it's
own steam. You'll rarely find me at the keyboard at that time..

-- 
"Hey, do you want Linux development to be an exciting and enjoyable
experience with lots of mental challenges...
...or do you want things to just WORK all the time?
Some people are never satisfied"      -- Linus Torvalds

In the sacred domain of uk.comp.os.linux, Steve Dodd <dirk@loth.demon.co.uk> babbled thusly:
> Lee Maguire <see-sig@nospam.demon.co.uk> wrote:

>> But (and this was my point) for someone wanting to check from an
>> external box if the machine was online then being able to access
>> it's webserver is as good an indication as a sucessful finger query.

> It wouldn't necessarily tell you that *I* was logged in, though. My machine
> dials out at some stupid time of the morning (ok, 7.30am <g>) under it's
> own steam. You'll rarely find me at the keyboard at that time..

Hasn't cheap rate ended by then? Why not set it off at 4am?
:)

-- 
-----------------------------------------------------------------------------
| spike1@mail.freenet.co.uk |   Windows95 (noun): 32 bit extensions and a   |
|                           |graphical shell for a 16 bit patch to an 8 bit |
|   Andrew Halliwell BSc    |operating system originally  coded for a 4 bit |
|            in             |microprocessor, written by a 2 bit company,that|
|     Computer Science      |       can't stand 1 bit of competition.       |
-----------------------------------------------------------------------------
|GCv3.12 GCS>$ d-(dpu) s+/- a C++ US++ P L/L+ E-- W+ N++ o+ K PS+  w-- M+/++|
|PS+++ PE- Y t+ 5++ X+/X++ R+ tv+ b+ DI+ D+ G e++ h/h+ !r!|  Space for hire |
-----------------------------------------------------------------------------

Spike wrote:

> In the sacred domain of uk.comp.os.linux, Steve Dodd <dirk@loth.demon.co.uk> babbled thusly:
>> It wouldn't necessarily tell you that *I* was logged in, though. My machine
>> dials out at some stupid time of the morning (ok, 7.30am <g>) under it's
>> own steam. You'll rarely find me at the keyboard at that time..
>
> Hasn't cheap rate ended by then? Why not set it off at 4am?

Cheap rate ends at 8am, AFAIK. (Mine connects at 7.45, so I hope I'm
right.)

-- 
Ben Smithurst            | PGP: 0x99392F7D
ben@scientia.demon.co.uk |   key available from keyservers and
                         |   ben+pgp@scientia.demon.co.uk

In demon.tech.unix Lee Maguire <see-sig@nospam.demon.co.uk> wrote:
> In demon.tech.unix Rachael Munns <vashti@drmach.dream.org.uk> wrote:
>> In demon.tech.unix, Lee Maguire  wrote:
>>> Well, if an http is running then it's a good indication that the machine
>>> is online - and (since this is a dial-up demon account) if the user is
> 
>> Not at all. One OS I had the displeasure of using used an httpd as part
>> of its help system; you might also run one to serve pages to a local
>> network or for personal use.
> 
> But (and this was my point) for someone wanting to check from an
> external box if the machine was online then being able to access
> it's webserver is as good an indication as a sucessful finger query.
> 
> I've always got an httpd available - albeit through inetd and behind a
> firewall...

Of course one of the best ways of telling when a Demon+[Linux|*BSD] user
goes online would be to send mail to random addresses at their node, and 
wait for the bounces to come back.

The occasional random UCE blizzard that has hit here has had me checking
my security and network connections _very_ carefully. 

-- 
Thomas Sandford | $Thomas/98b$@prds-grn.demon.co.uk
Paradise Green Technical Services: S'ware/Hw design and Theatre Tech. Services
Email to this address from commercial mailing lists constitutes unauthorised
computer access, and appropriate action will be taken against offenders.

Rachael Munns <vashti@drmach.dream.org.uk> wrote:
> In demon.tech.unix, Steve Dodd  wrote:

>>> tcp        0      0 *:printer               *:*                    LISTEN
>>> Do I need this?  lpr does the printing AFAIK
>> Only if you want to print remotely - I don't know much about this, I'm
>> afriad.

> I'm fairly sure you need lpd even if you only print locally.

Possibly depends exactly which lpd package you are using, also if
it provides access control on the tcp port.

Spike <spike1@news.freenet.co.uk> wrote:
>In the sacred domain of uk.comp.os.linux, Steve Dodd <dirk@loth.demon.co.uk> babbled thusly:
>> Lee Maguire <see-sig@nospam.demon.co.uk> wrote:

>>> But (and this was my point) for someone wanting to check from an
>>> external box if the machine was online then being able to access
>>> it's webserver is as good an indication as a sucessful finger query.

>> It wouldn't necessarily tell you that *I* was logged in, though. My machine
>> dials out at some stupid time of the morning (ok, 7.30am <g>) under it's
>> own steam. You'll rarely find me at the keyboard at that time..

The BT website says 8AM is the cutoff.
When I setup mine, it goes off at 7:30, and a forced disconnect at 8AM,
if it's still online.

-- 
http://inquisitor.i.am/    |  mailto:inquisitor@i.am |             Ian Stirling.
---------------------------+-------------------------+--------------------------
If God hadn't intended us to eat animals, 
He wouldn't have made them out of MEAT!                           - John Cleese

Steve Dodd <dirk@loth.demon.co.uk> writes:

> > tcp        0      0 *:nntp                  *:*                     LISTEN
> > My NTP server???
> 
> NNTP -- you seem to running a news server. INN or Cnews probably, or maybe
> leafnode (does anyone know if the latter has an NNTP interface?). You ought
> to make sure that no unauthorised bods can post through it; you probably
> don't want anyone reading from it either over a dial-up link, however public
> spirited you are. I regularly see people probing my news server, presumably
> look for an open one to spam Usenet through.

There is a teergrubing news server around, which sits there pretending
to be a news server and absorbing and throwing away everything posted to
it. At least one ISP used it to get a bunch of notorious spammers whose
contracts with the ISP stopped them from being dumped to throw their
news into a black hole for months on end.

> > tcp        0      0 *:omniorb               *:*                     LISTEN
> 
> omniorb is presumably an CORBA ORB. I think Gnome may use it.

It is an ORB, but GNOME uses ORBit, not omniORB.

>                                             This is identd, and /fairly/
> harmless; people can connect to it and give it a a port number, and it returns
> the user name of the person who owns the corresponding socket. It's only use
> is AFAICT for remote sys admins to log; if they spot any abuse coming from
> a multiuser system they can forward the info to the other system's admin
> to aid LARTing. You could kill it if you want to, or use an identd which
> returns random info, or similar. I believe some IRC networks insist on being
> about to identd you before letting you on.

Numerous FTP servers also require that.

I've got a masquerading identd that runs on a masquerading host and
forwards identd connections to the host they're coming from on the far
side of that host.

-- 
`So now the tape drive is sitting out in the yard, and I have to replace the
 tape drive and the window I threw it through.' --- Paul Tomblin on tape
drives that crash and mangle your partition table

Nix <$}xinix{$@esperi.demon.co.uk> wrote:
> Steve Dodd <dirk@loth.demon.co.uk> writes:

>> > tcp        0      0 *:nntp                  *:*                     LISTEN
>> > My NTP server???
>> 
>> look for an open one to spam Usenet through.

> There is a teergrubing news server around, which sits there pretending

teergrubing?

-- 
peter@petermc.demon.co.uk

Please insert the word NOSPAM into the above address to ensure
that your unsolicited e-mail doesn't actually reach me.

<peter@petermc.demon.co.uk> wrote:

> Nix <$}xinix{$@esperi.demon.co.uk> wrote:
> > Steve Dodd <dirk@loth.demon.co.uk> writes:
> 
> >> > tcp        0      0 *:nntp          *:*                     LISTEN
> >> > My NTP server???
> >> 
> >> look for an open one to spam Usenet through.
> 
> > There is a teergrubing news server around, which sits there pretending
> 
> teergrubing?

In the context of mail:
<http://www.iks-jena.de/mitarb/lutz/usenet/teergrube.en.html>

HTH, Alan
-- 
99 Ducati 748BP, 95 Ducati 600SS, 85 Guzzi V65TT, 74 MV Agusta 350
"Ride to Work, Work to Ride"         SI # 7.067           DoD#1930