- WLUG - wlug.mailman3.com

Re: [Wlug] just a bit-o-fun

by doug waud

Hi > The source for this definitely wants to remain anonymous- > but... The source is Flanders and Swan, a pair of Brits who were on the entertainment circuit years ago. They specialized in animal songs (Hippopotamus: Mud, Mud, Glorious Mud! Nothing quite like it for cooling the blood, so come let us follow, down to the hollow and there let us wallow, in glorious mud! ) I have their old 33rpm around somewhere. If you still have a player :-) and want to hear the rest, let me know and I can dig around and bring it in to the next WLUG meeting. > I had to share it with you cause, now I'm a Gnu Too! A gnother gnu! (Spelling checker did not like that!) doug -- Douglas R Waud 17 Lantern Lane, Shrewsbury, MA, 01545-2006 http://www.ummed.edu/pub/d/drw/

April 8, 2001

just a bit-o-fun

by Terry Yelmene

A year ago last Thursday I was strolling in the zoo When I met a man Who thought he knew the lot. He was laying down the law About the habits of baboons And the number of quills a porcupine has got So I asked him "what's that creature there?" He answered, "Ooh, It's a h'elk" I might have gone on thinking that was true If the animal in question hadn't Put that chap to shame and said "I hain't a h'elk" I'm a Gnu I'm a Gnu I'm a Gnu How do you do? You really ought to k-now w-who's who I'm a Gnu Spelled G-N-U I'm g-not a camel or a kangaroo So let me introduce I'm g-neither man or moose Oh G-no, G-no, G-no I'm a Gnu I had taken furnished lodgings down at Rustington-on-Sea Whence I travelled on to Ashton-under-Lyme And the second night I stayed there I was wakened from a dream Which I'll tell you all about some other time. Among the hunting trophies on the wall above my head Stuffed and mounted was a face I thought I knew; A bison, no it's not a bison An okapi, I don't think it's an okapi Could it be a hartebeest? When I seemed to hear a voice I'm a Gnu I'm a Gnu A g-nother Gnu I wish I could g-nash my teeth at you I'm a Gnu How do you do? You really ought to k-now w-who's who I'm a Gnu Spelled G-N-U Call me bison or okapi and I'll sue G-nor am I in the least like that dreadful hartebeest Oh G-No G-No G-No I'm a Gnu! **************** The source for this definitely wants to remain anonymous- but... I had to share it with you cause, now I@m a Gnu Too! ...(just between us Gnus & Penguins)

April 8, 2001

Re: [Wlug] Firewalls

by Michael Long

Your suggestion of an appliance was a magnificent one. I bought a Linksys router and had it running in a very short period of time. Now for the $64 question...how do I monitor my network to minimize the chance of attack or at least know when my system has been compromised? -mike On Wednesday 04 April 2001 00:09, you wrote: > > After spending many hours this past week trying to understand ipchains > > and firewalling in general I have come to the conclusion that I am > > spending a lot of time trying to recreate something that probably already > > exists. Does anyone have any experience with either open source or > > commercial firewalling products that can be configured to work in a small > > office network and allow VPN connections to larger networks. I do not > > have a very big budget but would be willing to pay for the appropriate > > solution. > > > > Mike > > Might I suggest an appliance? D-Link, SMC, NetGear and LinkSys all > have them for just a hair over $100 provided you're sitting on a Cable > or DSL connection. My SMC is web managable and does a lovely job. > It also has a COM port so I can use it with dial-up networks if I > have to. IPCHAINS/IPTABLES is cool, but you need to patch for IPSEC > support in 2.2.x kernels. > > ccb > > > -- > Charles C. Bennett, Jr. VA LiNUX Systems > Systems Engineer, Northeast US 25 Burlington Mall Rd., Suite 300 > +1 617 543-6513 Burlington, MA 01803-4145 > ccb(a)valinux.com www.valinux.com > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

April 8, 2001

Re: [Wlug] [Fwd: LOCAL: Worcester (MA, USA) Linux Users' Group meeting]

by Tom Guilderson

Andy, Would you mind if I cross posted this on discuss(a)blu.org since Robert Zeigler should be a good speaker and maybe some people might be interested. See you at the meeting. -- Tom Guilderson Andy Stewart wrote: > > -------- Original Message -------- > Subject: LOCAL: Worcester (MA, USA) Linux Users' Group meeting > Date: Fri, 6 Apr 2001 20:27:40 GMT > From: Andy Stewart <andystewart(a)mediaone.net> > Organization: Worcester Linux Users' Group > Newsgroups: comp.os.linux.announce > Followup-To: comp.os.linux.misc > > -----BEGIN PGP SIGNED MESSAGE----- > > HI everyone, > > The next meeting of the Worcester (MA, USA) Linux Users' Group will take place > on Thursday, April 19th, at 7:00 PM. The meeting location is at WPI's Kinnicutt > Hall in Worcester, MA. Directions can be found on the WLUG website: > > http://www.wlug.org > > The speaker at this meeting will be Bob Ziegler. Bob is the author of "Linux > Firewalls", published by New Riders. Bob will address firewall related topics > including: > > o What is contained in the IP, TCP, and UDP packet headers > o A description of classic attacks > o Basic things to be filtered > > The goal will be that someone should leave the meeting with an understanding of > what a firewall can do and why you want one. More meeting information can be > found on the WLUG website. > > This promises to be a really informative meeting! As always, WLUG meetings are > open to the public. After the presentation, there will be an opportunity for > Q/A, and then a couple of Linux related items will be raffled. Small donations > of $2 - $5 are happily accepted (but not required) to help defray the cost of > the refreshments at the meeting. > > After the meeting, you are welcome to join us at the Boynton Restaurant for > pizza and beer. > > I'm looking forward to seeing alot of people at this meeting. > > See ya later, > > Andy > - -- > Andy Stewart, Founder -o) | "I was playing poker the other night ... > Worcester Linux Users' Group /\ | with Tarot cards. I got a full house and > Worcester, MA, USA _\_v | four people died." -- Steven Wright > http://www.wlug.org | > > - -- > This article has been digitally signed by the moderator, using PGP. > http://www.iki.fi/mjr/cola-public-key.asc has PGP key for validating signature. > Send submissions for comp.os.linux.announce to: linux-announce(a)news.ornl.gov > PLEASE remember a short description of the software and the LOCATION. > This group is archived at http://www.iki.fi/mjr/linux/cola.html > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.3ia > Charset: latin1 > > iQCVAgUBOs4mvFrUI/eHXJZ5AQEhyQQAvvbtDWXY5iW6/m4kDYPjk4VuHLY/l276 > JMz+9HA7MWTEwhK8i44lgN+Rt8+fV27TrAmOsT7kmrQGN+ckPMzzzjBraW9Xnp8p > BBKYDZOOg0YonWYdZPBailYRPUgPwTT6ujiay9dQ7uR65rCUvG3UWRKrRmZDYqPJ > X0NMd/kezk8= > =rJuG > -----END PGP SIGNATURE----- > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

April 8, 2001

[Fwd: LOCAL: Worcester (MA, USA) Linux Users' Group meeting]

by Andy Stewart

-------- Original Message -------- Subject: LOCAL: Worcester (MA, USA) Linux Users' Group meeting Date: Fri, 6 Apr 2001 20:27:40 GMT From: Andy Stewart <andystewart(a)mediaone.net> Organization: Worcester Linux Users' Group Newsgroups: comp.os.linux.announce Followup-To: comp.os.linux.misc -----BEGIN PGP SIGNED MESSAGE----- HI everyone, The next meeting of the Worcester (MA, USA) Linux Users' Group will take place on Thursday, April 19th, at 7:00 PM. The meeting location is at WPI's Kinnicutt Hall in Worcester, MA. Directions can be found on the WLUG website: http://www.wlug.org The speaker at this meeting will be Bob Ziegler. Bob is the author of "Linux Firewalls", published by New Riders. Bob will address firewall related topics including: o What is contained in the IP, TCP, and UDP packet headers o A description of classic attacks o Basic things to be filtered The goal will be that someone should leave the meeting with an understanding of what a firewall can do and why you want one. More meeting information can be found on the WLUG website. This promises to be a really informative meeting! As always, WLUG meetings are open to the public. After the presentation, there will be an opportunity for Q/A, and then a couple of Linux related items will be raffled. Small donations of $2 - $5 are happily accepted (but not required) to help defray the cost of the refreshments at the meeting. After the meeting, you are welcome to join us at the Boynton Restaurant for pizza and beer. I'm looking forward to seeing alot of people at this meeting. See ya later, Andy - -- Andy Stewart, Founder -o) | "I was playing poker the other night ... Worcester Linux Users' Group /\ | with Tarot cards. I got a full house and Worcester, MA, USA _\_v | four people died." -- Steven Wright http://www.wlug.org | - -- This article has been digitally signed by the moderator, using PGP. http://www.iki.fi/mjr/cola-public-key.asc has PGP key for validating signature. Send submissions for comp.os.linux.announce to: linux-announce(a)news.ornl.gov PLEASE remember a short description of the software and the LOCATION. This group is archived at http://www.iki.fi/mjr/linux/cola.html -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: latin1 iQCVAgUBOs4mvFrUI/eHXJZ5AQEhyQQAvvbtDWXY5iW6/m4kDYPjk4VuHLY/l276 JMz+9HA7MWTEwhK8i44lgN+Rt8+fV27TrAmOsT7kmrQGN+ckPMzzzjBraW9Xnp8p BBKYDZOOg0YonWYdZPBailYRPUgPwTT6ujiay9dQ7uR65rCUvG3UWRKrRmZDYqPJ X0NMd/kezk8= =rJuG -----END PGP SIGNATURE-----

April 6, 2001

Re: fwd: [Wlug] Filtering attachments via a Sendmail ruleset?

by Dave Coutu

Thanks alot for your input guys, very appreciated. We will be looking into your suggestions and seeing what works best for us! Dave ----- Original Message ----- From: "Theo Van Dinter" <felicity(a)kluge.net> To: <wlug(a)mail.wlug.org> Sent: Thursday, April 05, 2001 1:22 PM Subject: Re: fwd: [Wlug] Filtering attachments via a Sendmail ruleset? > On Thu, Apr 05, 2001 at 04:01:50PM -0400, Paul Lussier wrote: > > As long as you have procmail installed and sendmail is configured to > > use procmail, just drop this stuff in place and you'll instantly > > start filtering stuff based on content and/or extension. > > Just an FYI: This means that procmail will have to run and filter each > message *per recipient* which means it's going to cause lots of CPU > overhead, depending on what kinds of filtering you're doing. > > -- > Randomly Generated Tagline: > "I sometimes think that they hire guards based on the bone content in their > heads." - Londo on Babylon 5 > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

April 6, 2001

Re: [Wlug] Filtering attachments via a Sendmail ruleset?

by Orion

Dave Coutu said: > > Hey Guys, > > > > Really simple question here... A while back I had asked whether > sendmail could filter out mail based on a subject header , and > found out that it could. Now I have a situation here at work where > we want to filter out attachments, the obvious being .vbs, .exe, > basically anything that may contain a virus. We don't run > anti-virus software on the mail server that mail is being delivered > to, nor on the sendmail relays feeding into it, since they are > Solaris boxes and we currently don't have a unix version of Norton > lying about. But I believe that we can filter out attachments > through a sendmail ruleset, and I am wondering if this is the case. > If so, can someone tell me how/where to do it please? Would be > very appreciative for any help here! Thanks in advance! > > > > Dave Not sure if this helps, but a friend of mine was working on this email scanning stuff: http://pldaniels.com/ Check out Inflex and Ebola. XaMime is a commercial version of Inflex, I believe. It's also in rather early development, afaik. Any questions, he's usually on #linuxhelp on irc.slashnet.org as "inflex". -- Orion orion [at] tribble [dot] dyndns [dot] org Spund is cool. Great sounding word. Kind o' thing Meg'd say. -freakstone

April 5, 2001

Re: fwd: [Wlug] Filtering attachments via a Sendmail ruleset?

by Theo Van Dinter

On Thu, Apr 05, 2001 at 04:01:50PM -0400, Paul Lussier wrote: > As long as you have procmail installed and sendmail is configured to > use procmail, just drop this stuff in place and you'll instantly > start filtering stuff based on content and/or extension. Just an FYI: This means that procmail will have to run and filter each message *per recipient* which means it's going to cause lots of CPU overhead, depending on what kinds of filtering you're doing. -- Randomly Generated Tagline: "I sometimes think that they hire guards based on the bone content in their heads." - Londo on Babylon 5

April 5, 2001

Re: fwd: [Wlug] Filtering attachments via a Sendmail ruleset?

by Paul Lussier

In a message dated: Thu, 05 Apr 2001 15:48:11 EDT Jeffry Smith said: >OK, I know we do something to "defang" stuff, could I / you pass what it >is on to this list, to answer this question? > >jeff >------- Forwarded Message > >From: "Dave Coutu" <cout(a)alum.wpi.edu> >To: <wlug(a)mail.wlug.org> >Date: Thu, 5 Apr 2001 11:10:10 -0700 >Subject: [Wlug] Filtering attachments via a Sendmail ruleset? > >Hey Guys, > > Really simple question here... A while back I had asked whether = >sendmail could filter out mail based on a subject header , and found out = >that it could. Now I have a situation here at work where we want to = >filter out attachments, the obvious being .vbs, .exe, basically anything = >that may contain a virus. We don't run anti-virus software on the mail = >server that mail is being delivered to, nor on the sendmail relays = >feeding into it, since they are Solaris boxes and we currently don't = >have a unix version of Norton lying about. But I believe that we can = >filter out attachments through a sendmail ruleset, and I am wondering if = >this is the case. If so, can someone tell me how/where to do it please? = > Would be very appreciative for any help here! Thanks in advance! What we do here is use procmail on our local, internal mail server. There's a great filtering set of procmail rules for this located at: http://www.impsec.org/email-tools/procmail-security.html As long as you have procmail installed and sendmail is configured to use procmail, just drop this stuff in place and you'll instantly start filtering stuff based on content and/or extension. There's a lot of configuration and customization you can do with this thing, and we've found that it works fantastic. We've intercepted the "AnnaKournikova" virus many, many times since it's initial release, and I can't even count the number of other virii I've seen trapped since we installed this. HTH, Seeya, Paul -- Paul Lussier Chairman, Nashua Chapter, GNHLUG Senior Systems and Network Engineer Mission Critical Linux, Inc.

April 5, 2001

Re: [Wlug] Filtering attachments via a Sendmail ruleset?

by Theo Van Dinter

On Thu, Apr 05, 2001 at 11:10:10AM -0700, Dave Coutu wrote: > could. Now I have a situation here at work where we want to filter out att= > achments, the obvious being .vbs, .exe, basically anything that may contain= > a virus. We don't run anti-virus software on the mail server that mail is= > being delivered to, nor on the sendmail relays feeding into it, since the= > y are Solaris boxes and we currently don't have a unix version of Norton ly= > ing about. But I believe that we can filter out attachments through a send= > mail ruleset, and I am wondering if this is the case. If so, can someone t= > ell me how/where to do it please? Would be very appreciative for any help = > here! Thanks in advance! You can't filter the message content using a ruleset (which is where attachments are located), but you can use the new milter API to do filtering. It's available in 8.10.x and later, but you might as well use 8.11.3 if you're going to upgrade anytime soon. I'm currently setting up this exact type of filtering at my current client by using a tool called MIMEdefang (http://www.roaringpenguin.com/mimedefang/) The examples that come with it show you how to filter out attachments that you don't want, but the main bits are in Perl so you can configure to your heart's content. :) Basically a C program interfaces with sendmail. That C program (per message -- not per recipient/etc) then calls a perl script which reads your configuration and acts appropriately. Right now, I have it striping out vbs/exe/com/bat attachments (removed the attachment from the mail and adds a text/plain section explaining that the attachment was removed). It's not the easiest bit of software to get installed and running, but if you're comfortable with compiling/installing from source and at least semi-comfortable with sendmail configuration (the amount needed for milter isn't much), then you'll be golden. -- Randomly Generated Tagline: I expect people to expect Perl to do the right thing. -- Larry Wall in <199911192358.PAA24109(a)kiev.wall.org>

April 5, 2001