Re: Is ident secure?

2001-08-30 Thread Olaf Meeuwissen
Brandon High <[EMAIL PROTECTED]> writes: > On Thu, Aug 30, 2001 at 11:14:33PM -0300, Alisson Sellaro wrote: > > > > I was checking my firewall logs and have detected lots of TCP/113 dropped > > packets. Checking /etc/services I realized it was ident traffic. What do > > you think about such servi

Re: Is ident secure?

2001-08-30 Thread Brian P. Flaherty
I have had a lot of problems running non-Debian software when I disable ident. It seems like the licensing daemons expect to find the license over a network and so, even though the license file is probably sitting next to them in the directory, the daemon goes out the interface card, comes back in

Re: Is ident secure?

2001-08-30 Thread Vineet Kumar
* Alisson Sellaro ([EMAIL PROTECTED]) [010830 19:45]: > Hi again folks > > I was checking my firewall logs and have detected lots of TCP/113 > dropped packets. Checking /etc/services I realized it was ident > traffic. What do you think about such service? Should I let it blocked > or should I allo

Re: Is ident secure?

2001-08-30 Thread Martin F Krafft
On Thu, Aug 30, 2001 at 11:14:33PM -0300, Alisson Sellaro wrote: > I was checking my firewall logs and have detected lots of TCP/113 dropped > packets. Checking /etc/services I realized it was ident traffic. What do > you think about such service? Should I let it blocked or should I allow it > with

Re: Is ident secure?

2001-08-30 Thread Craig Dickson
Alisson Sellaro wrote: > I was checking my firewall logs and have detected lots of TCP/113 > dropped packets. Checking /etc/services I realized it was ident > traffic. What do you think about such service? Should I let it blocked > or should I allow it without further security exposure? Please wr

Re: Is ident secure?

2001-08-30 Thread Alisson Sellaro
On Thu, Aug 30, 2001 at 07:25:22PM -0700, Brandon High wrote: > The general rule applies: If you don't need it, block it. > > While there are no known security holes, there could always be some > unknown. Yeah, I know. I'm asking since it seems that lots of servers try to use the service (I hav

Re: Why do people do this? [Was fishingboat in root]

2001-08-30 Thread Jason Thomas
maybe ask the maintainer of the package to change it to something meaningful! On Thu, Aug 30, 2001 at 10:04:51PM -0400, Brian P. Flaherty wrote: > So, I found it in netwatch.c. Why do people create these files? I -- Jason Thomas Phone: +61 2 6257 7111 System Administ

Re: Is ident secure?

2001-08-30 Thread Brandon High
On Thu, Aug 30, 2001 at 11:14:33PM -0300, Alisson Sellaro wrote: > > I was checking my firewall logs and have detected lots of TCP/113 dropped > packets. Checking /etc/services I realized it was ident traffic. What do > you think about such service? Should I let it blocked or should I allow it > w

Is ident secure?

2001-08-30 Thread Alisson Sellaro
Hi again folks I was checking my firewall logs and have detected lots of TCP/113 dropped packets. Checking /etc/services I realized it was ident traffic. What do you think about such service? Should I let it blocked or should I allow it without further security exposure? Thank you in advance -

Why do people do this? [Was fishingboat in root]

2001-08-30 Thread Brian P. Flaherty
So, I found it in netwatch.c. Why do people create these files? I have enough to do already, without wasting time looking for the source of spurious files. static unsigned char fillmac[] = { 0, 0, 0, 0, 0, 0 }; static FILE *fish = NULL; static char fishname[] = "/root/.fishingboat"; static int

fishingboat in root?

2001-08-30 Thread Brian P. Flaherty
Hello, This seems rather strange. I found a file called .fishingboat in my /root directory. Is anyone familiar with this? I found one page on the web so far that someone mentioned the same thing, but didn't identify where it came from. I realize it may be a sign of an intrusion, but I also spe

Re: Is ident secure?

2001-08-30 Thread Olaf Meeuwissen
Brandon High <[EMAIL PROTECTED]> writes: > On Thu, Aug 30, 2001 at 11:14:33PM -0300, Alisson Sellaro wrote: > > > > I was checking my firewall logs and have detected lots of TCP/113 dropped > > packets. Checking /etc/services I realized it was ident traffic. What do > > you think about such serv

Re: Is ident secure?

2001-08-30 Thread Brian P. Flaherty
I have had a lot of problems running non-Debian software when I disable ident. It seems like the licensing daemons expect to find the license over a network and so, even though the license file is probably sitting next to them in the directory, the daemon goes out the interface card, comes back i

Re: Is ident secure?

2001-08-30 Thread Vineet Kumar
* Alisson Sellaro ([EMAIL PROTECTED]) [010830 19:45]: > Hi again folks > > I was checking my firewall logs and have detected lots of TCP/113 > dropped packets. Checking /etc/services I realized it was ident > traffic. What do you think about such service? Should I let it blocked > or should I all

Re: Is ident secure?

2001-08-30 Thread Martin F Krafft
On Thu, Aug 30, 2001 at 11:14:33PM -0300, Alisson Sellaro wrote: > I was checking my firewall logs and have detected lots of TCP/113 dropped > packets. Checking /etc/services I realized it was ident traffic. What do > you think about such service? Should I let it blocked or should I allow it > wit

Re: Is ident secure?

2001-08-30 Thread Craig Dickson
Alisson Sellaro wrote: > I was checking my firewall logs and have detected lots of TCP/113 > dropped packets. Checking /etc/services I realized it was ident > traffic. What do you think about such service? Should I let it blocked > or should I allow it without further security exposure? Please w

Re: Is ident secure?

2001-08-30 Thread Alisson Sellaro
On Thu, Aug 30, 2001 at 07:25:22PM -0700, Brandon High wrote: > The general rule applies: If you don't need it, block it. > > While there are no known security holes, there could always be some > unknown. Yeah, I know. I'm asking since it seems that lots of servers try to use the service (I ha

Re: Why do people do this? [Was fishingboat in root]

2001-08-30 Thread Jason Thomas
maybe ask the maintainer of the package to change it to something meaningful! On Thu, Aug 30, 2001 at 10:04:51PM -0400, Brian P. Flaherty wrote: > So, I found it in netwatch.c. Why do people create these files? I -- Jason Thomas Phone: +61 2 6257 7111 System Adminis

Re: Is ident secure?

2001-08-30 Thread Brandon High
On Thu, Aug 30, 2001 at 11:14:33PM -0300, Alisson Sellaro wrote: > > I was checking my firewall logs and have detected lots of TCP/113 dropped > packets. Checking /etc/services I realized it was ident traffic. What do > you think about such service? Should I let it blocked or should I allow it >

Is ident secure?

2001-08-30 Thread Alisson Sellaro
Hi again folks I was checking my firewall logs and have detected lots of TCP/113 dropped packets. Checking /etc/services I realized it was ident traffic. What do you think about such service? Should I let it blocked or should I allow it without further security exposure? Thank you in advance

Why do people do this? [Was fishingboat in root]

2001-08-30 Thread Brian P. Flaherty
So, I found it in netwatch.c. Why do people create these files? I have enough to do already, without wasting time looking for the source of spurious files. static unsigned char fillmac[] = { 0, 0, 0, 0, 0, 0 }; static FILE *fish = NULL; static char fishname[] = "/root/.fishingboat"; static in

fishingboat in root?

2001-08-30 Thread Brian P. Flaherty
Hello, This seems rather strange. I found a file called .fishingboat in my /root directory. Is anyone familiar with this? I found one page on the web so far that someone mentioned the same thing, but didn't identify where it came from. I realize it may be a sign of an intrusion, but I also sp

Re: tripwire init problem

2001-08-30 Thread Miek Gieben
[On 30 Aug, 2001, Jeff Coppock wrote in " tripwire init problem "] > I'm trying to get tripwire installed on a new server and running > into this issue: > > server_113:/usr/lib/tripwire# tripwire --init > Please enter your local passphrase: > Parsing policy file: /etc/tripwire/tw.pol > ### Error:

tripwire init problem

2001-08-30 Thread Jeff Coppock
I'm trying to get tripwire installed on a new server and running into this issue: server_113:/usr/lib/tripwire# tripwire --init Please enter your local passphrase: Parsing policy file: /etc/tripwire/tw.pol ### Error: Undefined variable used. ### HOSTNAME: Line number 96 ### Exiting... Version:

Re: tripwire init problem

2001-08-30 Thread Miek Gieben
[On 30 Aug, 2001, Jeff Coppock wrote in " tripwire init problem "] > I'm trying to get tripwire installed on a new server and running > into this issue: > > server_113:/usr/lib/tripwire# tripwire --init > Please enter your local passphrase: > Parsing policy file: /etc/tripwire/tw.pol > ### Error

tripwire init problem

2001-08-30 Thread Jeff Coppock
I'm trying to get tripwire installed on a new server and running into this issue: server_113:/usr/lib/tripwire# tripwire --init Please enter your local passphrase: Parsing policy file: /etc/tripwire/tw.pol ### Error: Undefined variable used. ### HOSTNAME: Line number 96 ### Exiting... Version:

Re: Can someone help a Newbie

2001-08-30 Thread Jeff Coppock
cdpye, 2001-Aug-30 15:19 +1000: > Hi, > > I have noticed recently that attempted connections to my box aren't being > logged in syslog. > I haven't changed anything since install & it appeared ok then, I have had > friends try connecting & while they get refused, I don't see a corresponding > line

Can someone help a Newbie

2001-08-30 Thread cdpye
Hi, I have noticed recently that attempted connections to my box aren't being logged in syslog. I haven't changed anything since install & it appeared ok then, I have had friends try connecting & while they get refused, I don't see a corresponding line for the refusal, I used to use RH & while thi