Re: Debian audititing tool?

2000-12-22 Thread Ethan Benson
On Fri, Dec 22, 2000 at 05:54:55PM -0400, Peter Cordes wrote: > > That's why you run the checker from a known-good floppy or CD. The bogus > kernel can't protect itself if it isn't running :) don't be so sure, is the BIOS or firmware on your computer flashable? if so an attacker could replace

Re: Debian audititing tool?

2000-12-22 Thread Peter Cordes
On Sat, Dec 23, 2000 at 10:35:26AM +1300, Carey Evans wrote: > "Dan Hutchinson" <[EMAIL PROTECTED]> writes: > > > Sorry I miss read your response. > > Well you can get the source kernel and run it threw the fornesics program > > then compile it possible. > > Anyway it will help with open trojans a

Re: Debian audititing tool?

2000-12-22 Thread Carey Evans
"Dan Hutchinson" <[EMAIL PROTECTED]> writes: > Sorry I miss read your response. > Well you can get the source kernel and run it threw the fornesics program > then compile it possible. > Anyway it will help with open trojans and virus anyway. There's a couple of things that could go wrong here:

Re: Debian audititing tool?

2000-12-22 Thread Carey Evans
"Dan Hutchinson" <[EMAIL PROTECTED]> writes: > Sorry I miss read your response. > Well you can get the source kernel and run it threw the fornesics program > then compile it possible. > Anyway it will help with open trojans and virus anyway. There's a couple of things that could go wrong here:

Re: Debian audititing tool?

2000-12-22 Thread Peter Cordes
On Sat, Dec 23, 2000 at 10:35:26AM +1300, Carey Evans wrote: > "Dan Hutchinson" <[EMAIL PROTECTED]> writes: > > > Sorry I miss read your response. > > Well you can get the source kernel and run it threw the fornesics program > > then compile it possible. > > Anyway it will help with open trojans

Re: Debian audititing tool?

2000-12-22 Thread Rene Mayrhofer
Jacob Kuntz wrote: > > from the secret journal of Rene Mayrhofer ([EMAIL PROTECTED]): > > http://www.gibaltar.at/ > > is that address correct? i didn't think there was a .at tld, but there are > two 'r's in gibraltar. You are right. Sorry, It was a typo It should read http://www.gibraltar.at/ b

Re: Debian audititing tool?

2000-12-22 Thread Colin Phipps
On Thu, Dec 21, 2000 at 08:12:14PM +0100, Christian Kurz wrote: > On 00-12-21 Colin Phipps wrote: > > On Thu, Dec 21, 2000 at 04:09:07PM +0100, Christian Kurz wrote: > > > And who will create this key? Who will have the passphrase? Who will > > > sign the packages? > > > Someone on master.debian.o

Re: Debian audititing tool?

2000-12-22 Thread Christian Kurz
On 00-12-21 Peter Cordes wrote: > On Thu, Dec 21, 2000 at 03:37:56PM +0100, Christian Kurz wrote: > > On 00-12-21 Dan Hutchinson wrote: > > > Sorry it was fornesics, but the code is basically matching the machine > > > code, a unique pattern of 1's and 0's to the machine code of the kernal. > > >

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Guido Guenther
On Sat, Dec 23, 2000 at 12:03:38AM +1100, Mostyn Bramley-Moore wrote: > > ippl shows frequent access attempts to ports 563[456] tcp in our > > subnet originating from machines all over the world. netstat and > > lsof show no programs listening on these ports. A websearch didn't > > reveal any usef

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Jan Martin Mathiassen
On Fri, Dec 22, 2000 at 03:16:07PM +0100, Jan Martin Mathiassen wrote: > On Fri, Dec 22, 2000 at 01:30:50PM +0100, Guido Guenther wrote: > > Hi, > > ippl shows frequent access attempts to ports 563[456] tcp in our > > subnet originating from machines all over the world. netstat and > > lsof show no

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Jan Martin Mathiassen
On Fri, Dec 22, 2000 at 01:30:50PM +0100, Guido Guenther wrote: > Hi, > ippl shows frequent access attempts to ports 563[456] tcp in our > subnet originating from machines all over the world. netstat and > lsof show no programs listening on these ports. A websearch didn't > reveal any usefull info

Re: Debian audititing tool?

2000-12-22 Thread Rene Mayrhofer
Jacob Kuntz wrote: > > from the secret journal of Rene Mayrhofer ([EMAIL PROTECTED]): > > http://www.gibaltar.at/ > > is that address correct? i didn't think there was a .at tld, but there are > two 'r's in gibraltar. You are right. Sorry, It was a typo It should read http://www.gibraltar.at/

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Damian M Gryski
On Fri, 22 Dec 2000, Guido Guenther wrote: > Hi, > ippl shows frequent access attempts to ports 563[456] tcp in our > subnet originating from machines all over the world. netstat and > lsof show no programs listening on these ports. A websearch didn't > reveal any usefull information regarding the

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Mostyn Bramley-Moore
> ippl shows frequent access attempts to ports 563[456] tcp in our > subnet originating from machines all over the world. netstat and > lsof show no programs listening on these ports. A websearch didn't > reveal any usefull information regarding these port numbers. Any ideas? >From the FreeBSD /e

Re: Debian audititing tool?

2000-12-22 Thread Colin Phipps
On Thu, Dec 21, 2000 at 08:12:14PM +0100, Christian Kurz wrote: > On 00-12-21 Colin Phipps wrote: > > On Thu, Dec 21, 2000 at 04:09:07PM +0100, Christian Kurz wrote: > > > And who will create this key? Who will have the passphrase? Who will > > > sign the packages? > > > Someone on master.debian.

Re: Debian audititing tool?

2000-12-22 Thread Christian Kurz
On 00-12-21 Peter Cordes wrote: > On Thu, Dec 21, 2000 at 03:37:56PM +0100, Christian Kurz wrote: > > On 00-12-21 Dan Hutchinson wrote: > > > Sorry it was fornesics, but the code is basically matching the machine > > > code, a unique pattern of 1's and 0's to the machine code of the kernal. > > >

Ensuring authenticity of packages

2000-12-22 Thread Ryszard Lach
Hi! I'm wondering how to check authenticity of packages after downloading the code from the network. One method is downloading source packages, checking signatures and building binary packages. Is there any other possibility ? Maybe there is a kind of "HOW TO efficient organize secure package-arch

OT: frequent accesses to port 563[456]

2000-12-22 Thread Guido Guenther
Hi, ippl shows frequent access attempts to ports 563[456] tcp in our subnet originating from machines all over the world. netstat and lsof show no programs listening on these ports. A websearch didn't reveal any usefull information regarding these port numbers. Any ideas? -- Guido

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Guido Guenther
On Sat, Dec 23, 2000 at 12:03:38AM +1100, Mostyn Bramley-Moore wrote: > > ippl shows frequent access attempts to ports 563[456] tcp in our > > subnet originating from machines all over the world. netstat and > > lsof show no programs listening on these ports. A websearch didn't > > reveal any use

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Jan Martin Mathiassen
On Fri, Dec 22, 2000 at 03:16:07PM +0100, Jan Martin Mathiassen wrote: > On Fri, Dec 22, 2000 at 01:30:50PM +0100, Guido Guenther wrote: > > Hi, > > ippl shows frequent access attempts to ports 563[456] tcp in our > > subnet originating from machines all over the world. netstat and > > lsof show n

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Jan Martin Mathiassen
On Fri, Dec 22, 2000 at 01:30:50PM +0100, Guido Guenther wrote: > Hi, > ippl shows frequent access attempts to ports 563[456] tcp in our > subnet originating from machines all over the world. netstat and > lsof show no programs listening on these ports. A websearch didn't > reveal any usefull inf

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Damian M Gryski
On Fri, 22 Dec 2000, Guido Guenther wrote: > Hi, > ippl shows frequent access attempts to ports 563[456] tcp in our > subnet originating from machines all over the world. netstat and > lsof show no programs listening on these ports. A websearch didn't > reveal any usefull information regarding th

Re: OT: frequent accesses to port 563[456]

2000-12-22 Thread Mostyn Bramley-Moore
> ippl shows frequent access attempts to ports 563[456] tcp in our > subnet originating from machines all over the world. netstat and > lsof show no programs listening on these ports. A websearch didn't > reveal any usefull information regarding these port numbers. Any ideas? >From the FreeBSD /

Ensuring authenticity of packages

2000-12-22 Thread Ryszard Lach
Hi! I'm wondering how to check authenticity of packages after downloading the code from the network. One method is downloading source packages, checking signatures and building binary packages. Is there any other possibility ? Maybe there is a kind of "HOW TO efficient organize secure package-arc

OT: frequent accesses to port 563[456]

2000-12-22 Thread Guido Guenther
Hi, ippl shows frequent access attempts to ports 563[456] tcp in our subnet originating from machines all over the world. netstat and lsof show no programs listening on these ports. A websearch didn't reveal any usefull information regarding these port numbers. Any ideas? -- Guido -- To UNSU