Re: Secure/hardened/minimal Debian (or "Why is the base system the way it is?")

2002-05-19 Thread Nicole Zimmerman
I suppose since my install is so small this would be possible (just create a bootable floppy that runs a script which uses dd to dump to the disk). The problem I have now is that Ghost 2002 does not image ext3 correctly (so after imaging, I have to convert the filesystems to ext3 again). Suppose

Re: Secure/hardened/minimal Debian (or "Why is the base system the way it is?")

2002-05-19 Thread Nicole Zimmerman
I did this for my company, or something similar. We ship a security information management solution, deliverables are a network appliance (the "manager" node) and the client software. Anyway, we use debian as our network appliance OS and I have "hardened" it and provided a very restricted shell fo

Re: Secure/hardened/minimal Debian (or "Why is the base system theway it is?")

2002-05-19 Thread Nicole Zimmerman
I suppose since my install is so small this would be possible (just create a bootable floppy that runs a script which uses dd to dump to the disk). The problem I have now is that Ghost 2002 does not image ext3 correctly (so after imaging, I have to convert the filesystems to ext3 again). Suppos

Re: Secure/hardened/minimal Debian (or "Why is the base system theway it is?")

2002-05-19 Thread Nicole Zimmerman
I did this for my company, or something similar. We ship a security information management solution, deliverables are a network appliance (the "manager" node) and the client software. Anyway, we use debian as our network appliance OS and I have "hardened" it and provided a very restricted shell f

Re: force to use SSH2

2002-05-13 Thread Nicole Zimmerman
In your sshd_config you can use the Protocol directive. Protocol Specifies the protocol versions sshd should support. The possible values are ``1'' and ``2''. Multiple versions must be comma-separated. The default is ``2,1''. -nicole At 18:05 on May 13, Eduardo Gargiulo combined all the r

Re: force to use SSH2

2002-05-13 Thread Nicole Zimmerman
In your sshd_config you can use the Protocol directive. Protocol Specifies the protocol versions sshd should support. The possible values are ``1'' and ``2''. Multiple versions must be comma-separated. The default is ``2,1''. -nicole At 18:05 on May 13, Eduardo Gargiulo combined all the

Re: possible hole in mozilla et al

2002-05-08 Thread Nicole Zimmerman
This bug has been fixed in Mozilla upstream and will be included in the 1.0 release. You can dig in Bugtraq for more info. -nicole At 15:26 on May 8, Robert Millan combined all the right letters to say: > > Hi, > > Just noticed this advisory, stating a remote vulnerability > in mozilla: > >

Re: connection refuse by tcp_wrapper

2002-04-24 Thread Nicole Zimmerman
It doesn't look like a tcp wrappers problem to me. It looks like an SSH problem. You might try restarting the SSH server, or maybe using only SSHv1 (to see if it is working at all/accepting connections) with the argument -1, or checking your /var/log/auth.log to see if there are any SSH connection

Re: connection refuse by tcp_wrapper

2002-04-24 Thread Nicole Zimmerman
It doesn't look like a tcp wrappers problem to me. It looks like an SSH problem. You might try restarting the SSH server, or maybe using only SSHv1 (to see if it is working at all/accepting connections) with the argument -1, or checking your /var/log/auth.log to see if there are any SSH connectio

Re: Need some advice on configuring SAMBA shares

2002-01-13 Thread Nicole Zimmerman
force user = guest force group = user in your samba config for that share will force anything done to that share to be done under that combination. This isn't exactly what you asked, but it is useful. All this and more in `man smb.conf` :o) -nicole At 03:53 on Jan 13, Stefan Srdic combined all

Re: Need some advice on configuring SAMBA shares

2002-01-13 Thread Nicole Zimmerman
force user = guest force group = user in your samba config for that share will force anything done to that share to be done under that combination. This isn't exactly what you asked, but it is useful. All this and more in `man smb.conf` :o) -nicole At 03:53 on Jan 13, Stefan Srdic combined al

Re: the right way to access CDROM as non-root

2002-01-01 Thread Nicole Zimmerman
You should have a "device" /dev/cdrom that is a symbolic link to your real CDROM device (/dev/hdc?). This link should be owned by root:cdrom. You can then add users to the cdrom group and they can then mount the CDROM. Same for the floppy drive (with the "floppy" group, but you don't have to symli

Re: the right way to access CDROM as non-root

2002-01-01 Thread Nicole Zimmerman
You should have a "device" /dev/cdrom that is a symbolic link to your real CDROM device (/dev/hdc?). This link should be owned by root:cdrom. You can then add users to the cdrom group and they can then mount the CDROM. Same for the floppy drive (with the "floppy" group, but you don't have to syml

Re: What is the status with wu-ftpd updated potato packages?

2001-11-29 Thread Nicole Zimmerman
Read this: http://lists.debian.org/debian-changes/2001/debian-changes-200111/msg00085.html > What is the status with the wu-ftpd updated potato packages?

Re: What is the status with wu-ftpd updated potato packages?

2001-11-29 Thread Nicole Zimmerman
Read this: http://lists.debian.org/debian-changes/2001/debian-changes-200111/msg00085.html > What is the status with the wu-ftpd updated potato packages? -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Some samba problems.

2001-11-17 Thread Nicole Zimmerman
You can specify in your smb.conf a "hosts allow = " and "hosts deny = ". This, with security = user (and only adding the valid users to your smbpasswd file or using "valid users = ") and removing guest access from your shares, should give you the level of security you want. `man smb.conf` -nicol

Re: Some samba problems.

2001-11-17 Thread Nicole Zimmerman
You can specify in your smb.conf a "hosts allow = " and "hosts deny = ". This, with security = user (and only adding the valid users to your smbpasswd file or using "valid users = ") and removing guest access from your shares, should give you the level of security you want. `man smb.conf` -nico

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-24 Thread Nicole Zimmerman
I would suggest adding the testing source to your /etc/apt/sources.list and grabbing kernel-source-2.2.19 (version 2.2.19.1-1 has the security patches in question). Edit /etc/apt/sources.list Add deb http://http.us.debian.org/debian/ testing main Save the file. apt-get update apt-get install kern

Re: Potato 2.2r3 and Kernel 2.2.19 Questions

2001-10-23 Thread Nicole Zimmerman
I would suggest adding the testing source to your /etc/apt/sources.list and grabbing kernel-source-2.2.19 (version 2.2.19.1-1 has the security patches in question). Edit /etc/apt/sources.list Add deb http://http.us.debian.org/debian/ testing main Save the file. apt-get update apt-get install ker

Re: Security on debian

2001-09-30 Thread Nicole Zimmerman
We just went through this on this list, actually. If you are getting this error, go into your browser settings and make sure you have the [en] language in your accepted languages list. -nicole At 13:19 on Sep 30, Scott Henson combined all the right letters to say: > looking on the debian site

Re: Security on debian

2001-09-30 Thread Nicole Zimmerman
We just went through this on this list, actually. If you are getting this error, go into your browser settings and make sure you have the [en] language in your accepted languages list. -nicole At 13:19 on Sep 30, Scott Henson combined all the right letters to say: > looking on the debian site

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-24 Thread Nicole Zimmerman
At 00:26 on Sep 24, Will Aoki combined all the right letters to say: > > Mozilla's default language setting is only US English (en-us). My > guess is that people getting 403s are running their browsers with > out of the box language settings or have changed language settings > but haven't listed

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-24 Thread Nicole Zimmerman
Actually it works in Netscape 4.77 but not Mozilla. So it doesn't look like it's a server-side problem. That was my first guess, too. The Forbidden error also does not have any mention of apache or any web server for that matter. The plot thickens :o) -nicole At 15:54 on Sep 24, Andrew Sione Taum

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-23 Thread Nicole Zimmerman
At 00:26 on Sep 24, Will Aoki combined all the right letters to say: > > Mozilla's default language setting is only US English (en-us). My > guess is that people getting 403s are running their browsers with > out of the box language settings or have changed language settings > but haven't listed

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-23 Thread Nicole Zimmerman
Actually it works in Netscape 4.77 but not Mozilla. So it doesn't look like it's a server-side problem. That was my first guess, too. The Forbidden error also does not have any mention of apache or any web server for that matter. The plot thickens :o) -nicole At 15:54 on Sep 24, Andrew Sione Tau

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-23 Thread Nicole Zimmerman
?ndez-Sanguino Pe?a said: > On Sun, Sep 23, 2001 at 06:31:24PM -0700, Nicole Zimmerman wrote: > > > > Forbidden > > You don't have permission to access /doc/manuals/securing-debian-howto/ on > > this server. > > > > ?? > > Works fine for

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-23 Thread Nicole Zimmerman
Forbidden You don't have permission to access /doc/manuals/securing-debian-howto/ on this server. ?? At 03:27 on Sep 24, Javier Fern?ndez-Sanguino Pe?a combined all the right...: > I am not sure everybody is aware of the "Securing Debian Manual" > which can be found at > http://www.debian

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-23 Thread Nicole Zimmerman
avier Fernández-Sanguino Peña said: > On Sun, Sep 23, 2001 at 06:31:24PM -0700, Nicole Zimmerman wrote: > > > > Forbidden > > You don't have permission to access /doc/manuals/securing-debian-howto/ on > > this server. > > > > ?? > > Works fine for

Re: Need Help with the Debian Securing Manual (contributions accepted)

2001-09-23 Thread Nicole Zimmerman
Forbidden You don't have permission to access /doc/manuals/securing-debian-howto/ on this server. ?? At 03:27 on Sep 24, Javier Fernández-Sanguino Peña combined all the right...: > I am not sure everybody is aware of the "Securing Debian Manual" > which can be found at > http://www.debia

Re: red worm amusement

2001-07-21 Thread Nicole Zimmerman
> > last i used OpenBSD (2.6) it started portmap and identd by default at > > the very least, maybe fingerd too i don't remember for sure. > > > The difference is, those were not exploitable. And they are on debian? Turning off services makes an excuse for the real problem -- software needs to

Re: red worm amusement

2001-07-21 Thread Nicole Zimmerman
> > last i used OpenBSD (2.6) it started portmap and identd by default at > > the very least, maybe fingerd too i don't remember for sure. > > > The difference is, those were not exploitable. And they are on debian? Turning off services makes an excuse for the real problem -- software needs to

SSH security vulnerability (fwd)

2001-02-09 Thread Nicole Zimmerman
I have not verified this problem, but the advisory looks quite decent. -- Forwarded message -- Date: Fri, 9 Feb 2001 13:07:08 -0800 (PST) From: David A. Gatwood <[EMAIL PROTECTED]> To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: SSH security vulnerability I don't usually announ

SSH security vulnerability (fwd)

2001-02-09 Thread Nicole Zimmerman
I have not verified this problem, but the advisory looks quite decent. -- Forwarded message -- Date: Fri, 9 Feb 2001 13:07:08 -0800 (PST) From: David A. Gatwood <[EMAIL PROTECTED]> To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: SSH security vulnerability I don't usually annou