October 2001 - WLUG - wlug.mailman3.com

Re: [Wlug] Vunerable Machine

by Brian J. Conway

> Anyone have a favorite graphical threaded email reader that supports multiple > POPs and/or IMAP? About 6 months ago I stumbled across an awesome GTK+ mail/news reader very similar in look to Netscape Messenger (and far superior to XFMail) called Sylpheed (http://sylpheed.good-day.net/) It'll handle as many accounts as you want, supports threading and image view through gdk-pixbuf, is extremely fast (and decently configurable), and I've never had it crash on me. Some distributions are starting to pick it up now, and it's included in Mandrake 8.1, though I usually compile myself from source. I'd suggest giving it a look if it's an X app you're looking for. Brian J. Conway dogbert(a)clue4all.net "LINUX is obsolete" - Andrew S. Tanenbaum, creator of Minix - Jan 29, 1992

Oct. 5, 2001

Email reader...

by Stephen C. Daukas

Well, as it turns out, the version of KMail that comes with RH 7.1 is threaded, and very different from the version included with RH 6.2. So far, a pretty good mailer... Still interested in your recommendations! -- Stephen C. Daukas stephen(a)daukas.com (508) 845-9809 - Home (508) 845-5015 - Fax (508) 612-2149 - Mobile

Oct. 5, 2001

Re: [Wlug] Vunerable Machine

by ccb＠acm.org

If this is a RedHat machine, run rpm -V. Some h4x0rs know how to hack the databases, but it may still catch some nasty stuff. ccb

Oct. 5, 2001

email (was Vunerable Machine)

by Bill Mills-Curran

On Fri, 5 Oct 2001, Stephen C. Daukas wrote: <snip> > Anyone have a favorite graphical threaded email reader that supports multiple > POPs and/or IMAP? > <snip> I'm partial to fetchmail for delivering email from multiple sources to my machine. You can take your pick of the actual reader. I prefer pine, because, although it's not fancy, it does a lot of things right. Bill

Oct. 5, 2001

RE: [Wlug] Vunerable Machine

by Stephen C. Daukas

OK - another is a series of product recomendation questions... Anyone have a favorite graphical threaded email reader that supports multiple POPs and/or IMAP? This, of course, excludes Netscape (can't have multiple POPs nor a mix of POP and IMAP accounts). I'm currently using the KDE mail app that comes with RedHat 6.2 (will be upgrading to RH 7.1 in about 10 minutes), but it isn't exactly stellar... You can't do much of anything while it cheks for new mail, and it isn't threaded. Regards, Steve ______________________________ Stephen C. Daukas stephen(a)daukas.com (508) 845-9809 - Home (508) 845-5015 - Fax (508) 612-2149 - Mobile

Oct. 5, 2001

RE: [Wlug] Vunerable Machine

by Long, Mike

If you can determine that the machine has not been hacked then you could bring up the security holes you found to the big-wigs in the following way. The decision to use Linux was a very good one. Machine X was configured in a way that left it vulnerable to being compromised. However, because it is a Linux box and not a windows box it has not been compromised so far. The techniques for compromising a Linux server are more complex than those used to compromise a windows server. Since the tools for securing a Linux server are much more robust than those used to secure a windows server it will be virtually impossible to compromise the companies network through this server once it has been properly configured. A little spin can go a long way. :) Mike -----Original Message----- From: Marc Hughes [mailto:hughesm@tomsnyder.com] Sent: Friday, October 05, 2001 1:53 PM To: wlug(a)mail.wlug.org Subject: RE: [Wlug] Vunerable Machine On Fri, 2001-10-05 at 13:40, Keller, Tim wrote: > step 1: Change the root password Done > step 2: Remove all those "holy" services Done > step 3: Install SSH Still have to do ... getting weird library conflicts > step 4: Firewall the machine so that it only accepts SMTP traffic from the > outside world and SSH traffic from a couple of specific addresses TODO > step 5: Use a tool like tripwire to make a snapshot, wait a week, rerun it > again and see if anything changes. > Good, but still, how do I tell if it's already been rooted by 3l33t h4x0rs? And I guess an even bigger concern is the office politics things. How do I bring this to the big-wigs in a "good" light? _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Oct. 5, 2001

Re: [Wlug] Vunerable Machine

by Josh Huber

Marc Hughes <hughesm(a)tomsnyder.com> writes: > To top it all off... this box is an old powerPC... Well, if it was an x86 box, it probably would have already been hacked. 99% of the tools out there are for exploiting buffer overflows on x86 machines. ttyl, -- Josh Huber

Oct. 5, 2001

RE: [Wlug] Vunerable Machine

by Marc Hughes

On Fri, 2001-10-05 at 13:40, Keller, Tim wrote: > step 1: Change the root password Done > step 2: Remove all those "holy" services Done > step 3: Install SSH Still have to do ... getting weird library conflicts > step 4: Firewall the machine so that it only accepts SMTP traffic from the > outside world and SSH traffic from a couple of specific addresses TODO > step 5: Use a tool like tripwire to make a snapshot, wait a week, rerun it > again and see if anything changes. > Good, but still, how do I tell if it's already been rooted by 3l33t h4x0rs? And I guess an even bigger concern is the office politics things. How do I bring this to the big-wigs in a "good" light?

Oct. 5, 2001

RE: [Wlug] Vunerable Machine

by Keller, Tim

step 1: Change the root password step 2: Remove all those "holy" services step 3: Install SSH step 4: Firewall the machine so that it only accepts SMTP traffic from the outside world and SSH traffic from a couple of specific addresses step 5: Use a tool like tripwire to make a snapshot, wait a week, rerun it again and see if anything changes. just some ideas... Tim. -----Original Message----- From: Marc Hughes [mailto:hughesm@tomsnyder.com] Sent: Friday, October 05, 2001 1:08 PM To: wlug(a)wlug.org Subject: [Wlug] Vunerable Machine Picture This: You're sitting at your desk on a warm friday morning. You get a call from the webmaster about a linux box, so you head over to help him out. The webmaster is a bright guy, but a microsoft guy. Very little linux experience at all, in fact the box was set up for him by someone no longer in the company. After figuring out what this box does (acts as a sendmail SMTP & pop3 server for bulk newletters... [not spam] ) you realize it has easily guessable passwords, is outside the firewall, and is running at least one vunerable service (an old POP2 daemon) and some questionable services (sun RPC and appletalk). To top it all off... this box is an old powerPC... My question: What should I do to make sure it hasn't been already cracked? Other Problems: I don't have to time to do a reinstall and set it up correctly anytime soon (maybe in a week I could). It needs to continue working like it has for at least another week (we just sent out a newsletter, and it processes remove requests that trickle in) To free up disk space, the logs were regularly deleted... no current logs exist. It's not my box, so I need to be sensitive of the office politics so no one says something like, "Well, since we can't secure linux, NO MORE LINUX" -Marc _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

Oct. 5, 2001

Vunerable Machine

by Marc Hughes

Picture This: You're sitting at your desk on a warm friday morning. You get a call from the webmaster about a linux box, so you head over to help him out. The webmaster is a bright guy, but a microsoft guy. Very little linux experience at all, in fact the box was set up for him by someone no longer in the company. After figuring out what this box does (acts as a sendmail SMTP & pop3 server for bulk newletters... [not spam] ) you realize it has easily guessable passwords, is outside the firewall, and is running at least one vunerable service (an old POP2 daemon) and some questionable services (sun RPC and appletalk). To top it all off... this box is an old powerPC... My question: What should I do to make sure it hasn't been already cracked? Other Problems: I don't have to time to do a reinstall and set it up correctly anytime soon (maybe in a week I could). It needs to continue working like it has for at least another week (we just sent out a newsletter, and it processes remove requests that trickle in) To free up disk space, the logs were regularly deleted... no current logs exist. It's not my box, so I need to be sensitive of the office politics so no one says something like, "Well, since we can't secure linux, NO MORE LINUX" -Marc

Oct. 5, 2001