Re: Root exploit for FreeBSD

2009-12-12 Thread Rolf G Nielsen
Mario Lobo wrote: On Saturday 12 December 2009 21:23:00 Rolf Nielsen wrote: Where's that? The Nvidia site says nothing about it yet, and the makefile for x11/nvidia-driver still says ONLY_FOR_ARCHS=i386. I'm eagerly waiting for it, but I can't find anything other than a forum post (I don't have

Re: Root exploit for FreeBSD

2009-12-12 Thread Mario Lobo
On Saturday 12 December 2009 21:23:00 Rolf Nielsen wrote: > Where's that? The Nvidia site says nothing about it yet, and the > makefile for x11/nvidia-driver still says ONLY_FOR_ARCHS=i386. I'm > eagerly waiting for it, but I can't find anything other than a forum > post (I don't have the address h

Re: Root exploit for FreeBSD

2009-12-12 Thread George Liaskos
http://www.nvnews.net/vbulletin/showthread.php?t=142120 On Sun, Dec 13, 2009 at 2:23 AM, Rolf Nielsen wrote: > Sam Fourman Jr. wrote: >>> >>> Are you sure that OpenBSD has a better record? >> >> >> I found this for loose reference. >> http://en.wikipedia.org/wiki/OpenBSD#Security_and_code_auditin

Re: Root exploit for FreeBSD

2009-12-12 Thread Rolf Nielsen
Sam Fourman Jr. wrote: Are you sure that OpenBSD has a better record? I found this for loose reference. http://en.wikipedia.org/wiki/OpenBSD#Security_and_code_auditing I will say that even though on the surface OpenBSD appears to have a better track record security wise I tend to use FreeBSD

Re: Root exploit for FreeBSD

2009-12-12 Thread Sam Fourman Jr.
> > Are you sure that OpenBSD has a better record? I found this for loose reference. http://en.wikipedia.org/wiki/OpenBSD#Security_and_code_auditing I will say that even though on the surface OpenBSD appears to have a better track record security wise I tend to use FreeBSD for my desktop needs b

Re: Root exploit for FreeBSD

2009-12-12 Thread M. Warner Losh
In message: <20091210095122.a164bf95.wmo...@potentialtech.com> Bill Moran writes: : In response to Anton Shterenlikht : : : > >From my information security manager: : > : > FreeBSD isn't much used within the University (I understand) and has a : > (comparatively) poor securit

Re: Root exploit for FreeBSD

2009-12-12 Thread David Southwell
> 2009/12/11 Kevin Oberman : > >> Date: Fri, 11 Dec 2009 08:49:42 + > >> From: Matthew Seaman > >> Sender: owner-freebsd-curr...@freebsd.org > >> > >> Polytropon wrote: > >> > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." wrote: > >> >> I have tried looking around and OpenBSD appears

Re: Root exploit for FreeBSD

2009-12-12 Thread Charlie Kester
On Fri 11 Dec 2009 at 20:59:57 PST Robert Huff wrote: Ulf Zimmermann writes: Just go to Fry's Electronic. Most of their systems are still MS-Dos with Novell for network, running text based inventory/quote/sales app. Ca _lot_ of small businesses have something similar. And why no

Re: Root exploit for FreeBSD

2009-12-12 Thread Chris Rees
2009/12/11 Kevin Oberman : >> Date: Fri, 11 Dec 2009 08:49:42 + >> From: Matthew Seaman >> Sender: owner-freebsd-curr...@freebsd.org >> >> Polytropon wrote: >> > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." >> > wrote: >> >> I have tried looking around and OpenBSD appears to be the

Re: Root exploit for FreeBSD

2009-12-12 Thread Polytropon
On Fri, 11 Dec 2009 13:01:51 -0800, Kurt Buff wrote: > Well, yes, except this assumes one has access to the sysadmin... Physical access. It's hard to exploit a sysadmin by social engineering because he hardly has any friends. :-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0

Re: Root exploit for FreeBSD

2009-12-12 Thread Randy Bush
> but i look in syslogs of some FreeBSD internet server and there is a great > evidence that some "botnets" are (again) tryng simple combination of > uid/pwd. /usr/ports/security/sshguard-* randy ___ freebsd-questions@freebsd.org mailing list http:/

Re: Root exploit for FreeBSD

2009-12-11 Thread Robert Huff
Ulf Zimmermann writes: > Just go to Fry's Electronic. Most of their systems are still > MS-Dos with Novell for network, running text based > inventory/quote/sales app. Ca _lot_ of small businesses have something similar. Robert Huff

Re: Root exploit for FreeBSD

2009-12-11 Thread Ulf Zimmermann
On Fri, Dec 11, 2009 at 03:23:56PM -0800, Kevin Oberman wrote: > > Date: Fri, 11 Dec 2009 08:49:42 + > > From: Matthew Seaman > > Sender: owner-freebsd-curr...@freebsd.org > > > > Polytropon wrote: > > > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." > > > wrote: > > >> I have tried

Re: Root exploit for FreeBSD

2009-12-11 Thread Kevin Oberman
> Date: Fri, 11 Dec 2009 08:49:42 + > From: Matthew Seaman > Sender: owner-freebsd-curr...@freebsd.org > > Polytropon wrote: > > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." > > wrote: > >> I have tried looking around and OpenBSD appears to be the undisputed > >> #1 track record in

Re: Root exploit for FreeBSD

2009-12-11 Thread Kurt Buff
On Fri, Dec 11, 2009 at 11:53, J Sisson wrote: > 2009/12/11 Svein Skogen (Listmail Account) > >> The easiest way of brute-forcing access to a FreeBSD server includes >> locating the sysadmin and applying the common desk drawer. It's that >> simple. >> > > http://xkcd.com/538/ > > indeed. Well, y

Re: Root exploit for FreeBSD

2009-12-11 Thread J Sisson
2009/12/11 Svein Skogen (Listmail Account) > The easiest way of brute-forcing access to a FreeBSD server includes > locating the sysadmin and applying the common desk drawer. It's that > simple. > http://xkcd.com/538/ indeed. ___ freebsd-questions@fre

Re: Root exploit for FreeBSD

2009-12-11 Thread Weldon S Godfrey 3
If memory serves me right, sometime around 10:49am, Jerry McAllister told me: On Fri, Dec 11, 2009 at 08:49:42AM +, Matthew Seaman wrote: Polytropon wrote: On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." wrote: I have tried looking around and OpenBSD appears to be the undisputed

Re: Root exploit for FreeBSD

2009-12-11 Thread Svein Skogen (Listmail Account)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dag-Erling Smørgrav wrote: > "Svein Skogen" writes: >> The easiest way of brute-forcing access to a FreeBSD server includes >> locating the sysadmin and applying the common desk drawer. It's that >> simple. > > *laugh* > > I thought you were more of

Re: Root exploit for FreeBSD

2009-12-11 Thread Polytropon
On Fri, 11 Dec 2009 10:49:50 -0500, Jerry McAllister wrote: > On Fri, Dec 11, 2009 at 08:49:42AM +, Matthew Seaman wrote: > > > Polytropon wrote: > > > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." > > > > > > wrote: > > >> I have tried looking around and OpenBSD appears to be the

Re: Root exploit for FreeBSD

2009-12-11 Thread Jerry McAllister
On Fri, Dec 11, 2009 at 08:49:42AM +, Matthew Seaman wrote: > Polytropon wrote: > > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." > > wrote: > >> I have tried looking around and OpenBSD appears to be the undisputed > >> #1 track record in terms of security and FreeBSD is #2 (I didn't

Re: Root exploit for FreeBSD

2009-12-11 Thread Mark Shroyer
On Fri, Dec 11, 2009 at 08:49:42AM +, Matthew Seaman wrote: > I dunno. Haven't seen many MS-DOS exploits recently either... That's true, it would be difficult to find a local privilege escalation exploit in an operating system without the concept of limited user accounts :) -- Mark Shroyer

Re: Root exploit for FreeBSD

2009-12-11 Thread Stacey Son
On Dec 10, 2009, at 8:41 AM, Anton Shterenlikht wrote: >> From my information security manager: > > FreeBSD isn't much used within the University (I understand) and has a > (comparatively) poor security record. Most recently, for example: > > > http://www.h-online.com/securit

Re: Root exploit for FreeBSD

2009-12-11 Thread Dag-Erling Smørgrav
"Svein Skogen" writes: > The easiest way of brute-forcing access to a FreeBSD server includes > locating the sysadmin and applying the common desk drawer. It's that > simple. *laugh* I thought you were more of a baseball bat kind of guy :) DES -- Dag-Erling Smørgrav - d...@des.no _

Re: Root exploit for FreeBSD

2009-12-11 Thread Svein Skogen (Listmail Account)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dag-Erling Smørgrav wrote: > $witch writes: >> but i look in syslogs of some FreeBSD internet server and there is a >> great evidence that some "botnets" are (again) tryng simple >> combination of uid/pwd. >> >> starting from Dec 8 01:00:34 (CET) hu

Re: Root exploit for FreeBSD

2009-12-11 Thread Dag-Erling Smørgrav
$witch writes: > but i look in syslogs of some FreeBSD internet server and there is a > great evidence that some "botnets" are (again) tryng simple > combination of uid/pwd. > > starting from Dec 8 01:00:34 (CET) hundreds of zombies are looking > for a valid username. Starting from Dec 8? This

Re: Root exploit for FreeBSD

2009-12-11 Thread Robert Huff
Paul Schmehl writes: > >> And from I understand it's going to get worse. > >> Apparently the IT services are drawing up > >> plans to completely forbid use of "non-autorized" > >> OS. I imagine fbsd will not be authorized. > >> So I'm anticipating another battle already. > > > > Does this

Re: Root exploit for FreeBSD

2009-12-11 Thread Matthew Seaman
Polytropon wrote: > On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." > wrote: >> I have tried looking around and OpenBSD appears to be the undisputed >> #1 track record in terms of security and FreeBSD is #2 (I didn't count >> dragonflyBSD) > > VMS would be #0, then? :-) I dunno. Haven't

Re: Root exploit for FreeBSD

2009-12-11 Thread Polytropon
On Fri, 11 Dec 2009 12:29:44 +0100, $witch wrote: > starting from Dec 8 01:00:34 (CET) hundreds of zombies are looking for a > valid username. For example "Administrator"... :-) > i love the FreeBSD security while it is MOSTLY based on KNOWLEDGE of users > than on a PERFECT code. Securit

Re: Root exploit for FreeBSD

2009-12-11 Thread Nick Barnes
At 2009-12-11 11:29:44+, $witch writes: > but i look in syslogs of some FreeBSD internet server and there is a great > evidence that some "botnets" are (again) tryng simple combination of > uid/pwd. # always, everywhere: PasswordAuthentication No Nick B __

Re: Root exploit for FreeBSD

2009-12-11 Thread $witch
On Thu, 10 Dec 2009 15:41:41 +0100, Anton Shterenlikht wrote: From my information security manager: FreeBSD isn't much used within the University (I understand) and has a (comparatively) poor security record. .. Hi, almost all of you remark how FreeBSD is more-secur

Re: Root exploit for FreeBSD

2009-12-11 Thread Anton Shterenlikht
On Thu, Dec 10, 2009 at 10:34:34PM -0600, Paul Schmehl wrote: > > I'm starting to wonder if the security manager really said what Anton > claims he said, or Anton is filtering his perceptions through the anger he > feels at being restricted in his ability to operate freely. If the latter > is

Re: Root exploit for FreeBSD

2009-12-11 Thread Polytropon
On Fri, 11 Dec 2009 01:42:36 -0600, "Sam Fourman Jr." wrote: > I have tried looking around and OpenBSD appears to be the undisputed > #1 track record in terms of security and FreeBSD is #2 (I didn't count > dragonflyBSD) VMS would be #0, then? :-) -- Polytropon Magdeburg, Germany Happy Free

Re: Root exploit for FreeBSD

2009-12-10 Thread Daniel Braniss
> >From my information security manager: > > FreeBSD isn't much used within the University (I understand) I sometimes wonder the validity of such statements, since we use it on 99% of our servers, the work-stations run Linux. Then again, we are concidered a more theoretical than practical s

Re: Root exploit for FreeBSD

2009-12-10 Thread Sam Fourman Jr.
On Thu, Dec 10, 2009 at 8:51 AM, Bill Moran wrote: > In response to Anton Shterenlikht : > >> >From my information security manager: >> >>       FreeBSD isn't much used within the University (I understand) and has a >>       (comparatively) poor security record. Most recently, for example: >> >>  

Re: Root exploit for FreeBSD

2009-12-10 Thread Ivo Karabojkov
I think democracy is a choice of freedom. Freedom what to use, AND, in such cases - freedom where to work! If you are marketing specialist probably you should NOT touch much of your computer's control gear. If you are an IT specialist or support such treatment is similar to treat you as a cattle.

Re: Root exploit for FreeBSD

2009-12-10 Thread Randy Bush
> FreeBSD isn't much used within the University (I understand) and has a > (comparatively) poor security record. unlike linux or windoze, rofl randy ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questi

Re: Root exploit for FreeBSD

2009-12-10 Thread Paul Schmehl
--On December 10, 2009 2:11:31 PM -0600 Kevin Wilcox wrote: 2009/12/10 Anton Shterenlikht : I was just stressed after being forced by him to explain why I wanted firewall exceptions for two ports to my FreeBSD portscluster nodes. I explained the reasons and that was settled. Anton, I don'

Re: Root exploit for FreeBSD

2009-12-10 Thread Steve Bertrand
Jerry wrote: > Out of pure morbid curiosity, would you please answer this question for > me. > > You work for a corporation that specifically requires the use of > a specific OS, the OS itself is not material to this question. It also > forbids the use of any unauthorized OS or equipment on the c

Re: Root exploit for FreeBSD

2009-12-10 Thread Olivier Nicole
> > FreeBSD isn't much used within the University (I understand) and has a > > (comparatively) poor security record. Most recently, for example: > > > > > > http://www.h-online.com/security/news/item/Root-exploit-for-FreeBSD-873352.html > > Are you trying to make your infosec guy loo

Re: Root exploit for FreeBSD

2009-12-10 Thread David Southwell
> On Thu, 10 Dec 2009 20:21:26 +0100 > > Julian H. Stacey replied: > >> Fortuantely, I had no problem setting up a "black" FreeBSD box to > >> preserve my sanity. > > > >A tip for those threatened with no BSD box at work: > >FreeBSD runs fine _inside_ a box that looks like a multi sheet scanner.

Re: Root exploit for FreeBSD

2009-12-10 Thread Kevin Wilcox
2009/12/10 Anton Shterenlikht : > I was just stressed after being forced by him > to explain why I wanted firewall exceptions > for two ports to my FreeBSD portscluster nodes. > I explained the reasons and that was settled. Anton, I don't know about the UK, Great Britain or England, but in US Uni

Re: Root exploit for FreeBSD

2009-12-10 Thread Jerry
On Thu, 10 Dec 2009 20:21:26 +0100 Julian H. Stacey replied: >> Fortuantely, I had no problem setting up a "black" FreeBSD box to >> preserve my sanity. > >A tip for those threatened with no BSD box at work: >FreeBSD runs fine _inside_ a box that looks like a multi sheet scanner. >OK, slow, but i

Re: Root exploit for FreeBSD

2009-12-10 Thread Julian H. Stacey
> Fortuantely, I had no problem setting up a "black" FreeBSD box to > preserve my sanity. A tip for those threatened with no BSD box at work: FreeBSD runs fine _inside_ a box that looks like a multi sheet scanner. OK, slow, but invisible to managers who require MS only. These scanners often lie a

Re: Root exploit for FreeBSD

2009-12-10 Thread J Sisson
On Thu, Dec 10, 2009 at 10:21 AM, Anton Shterenlikht wrote: > Perhaps I should start putting together > some statistics to make my case more forcefully. > I fought the same battle at the Univ. I attended (as a student). They were an M$ shop as well and had issues with me running OpenBSD. I stuc

Re: Root exploit for FreeBSD

2009-12-10 Thread Gary Jennejohn
On Thu, 10 Dec 2009 16:21:50 + Anton Shterenlikht wrote: > I had to fight a long battle, well.. I had > some support from other academics, to have > a linux class in my Faculty. Here the > opposition wasn't so much security, as > "why would any undegraduate need linux", > as if MS solutions a

Re: Root exploit for FreeBSD

2009-12-10 Thread Svein Skogen (Listmail Account)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chargen wrote: > On Thu, Dec 10, 2009 at 5:21 PM, Anton Shterenlikht > wrote: >> On Thu, Dec 10, 2009 at 09:51:22AM -0500, Bill Moran wrote: >>> In response to Anton Shterenlikht : > >> I had to fight a long battle, well.. I had >> some support from

Re: Root exploit for FreeBSD

2009-12-10 Thread Jason
http://security.freebsd.org/advisories/FreeBSD-SA-09:16.rtld.asc On Thu, Dec 10, 2009 at 11:05:16AM -0600, Paul Schmehl thus spake: --On Thursday, December 10, 2009 08:41:41 -0600 Anton Shterenlikht wrote: From my information security manager: FreeBSD isn't much used within the Un

Re: Root exploit for FreeBSD

2009-12-10 Thread Paul Schmehl
--On Thursday, December 10, 2009 08:41:41 -0600 Anton Shterenlikht wrote: From my information security manager: FreeBSD isn't much used within the University (I understand) and has a (comparatively) poor security record. Most recently, for example: http://www.h-online.com

Re: Root exploit for FreeBSD

2009-12-10 Thread Chargen
On Thu, Dec 10, 2009 at 5:21 PM, Anton Shterenlikht wrote: > On Thu, Dec 10, 2009 at 09:51:22AM -0500, Bill Moran wrote: >> In response to Anton Shterenlikht : > I had to fight a long battle, well.. I had > some support from other academics, to have > a linux class in my Faculty. Here the > oppos

Re: Root exploit for FreeBSD

2009-12-10 Thread Anton Shterenlikht
On Thu, Dec 10, 2009 at 09:51:22AM -0500, Bill Moran wrote: > In response to Anton Shterenlikht : > > > >From my information security manager: > > > > FreeBSD isn't much used within the University (I understand) and has a > > (comparatively) poor security record. Most recently, for exampl

Re: Root exploit for FreeBSD

2009-12-10 Thread Julian Elischer
Anton Shterenlikht wrote: From my information security manager: FreeBSD isn't much used within the University (I understand) and has a (comparatively) poor security record. Most recently, for example: http://www.h-online.com/security/news/item/Root-exploit-for-FreeBSD-

Re: Root exploit for FreeBSD

2009-12-10 Thread joe
Fire the noob you have working for you and hire someone with a clue. Anton Shterenlikht wrote: From my information security manager: FreeBSD isn't much used within the University (I understand) and has a (comparatively) poor security record. Most recently, for example:

Re: Root exploit for FreeBSD

2009-12-10 Thread Andreas Rudisch
On Thu, 10 Dec 2009 14:41:41 + Anton Shterenlikht wrote: > FreeBSD isn't much used within the University (I understand) and has a > (comparatively) poor security record. In comparison to what it is supposed to have a poor security record? > Most recently, for example: > http://www.h-online.

Re: Root exploit for FreeBSD

2009-12-10 Thread Kevin Wilcox
2009/12/10 Anton Shterenlikht : > >From my information security manager: > >        FreeBSD isn't much used within the University (I understand) and has a >        (comparatively) poor security record. Most recently, for example: > >         > http://www.h-online.com/security/news/item/Root-exploi

Re: Root exploit for FreeBSD

2009-12-10 Thread Dag-Erling Smørgrav
Anton Shterenlikht writes: > From my information security manager: > > FreeBSD isn't much used within the University (I understand) and has a > (comparatively) poor security record. Most recently, for > example: "comparatively", compared to what? Windows? Linux? We beat them

Re: Root exploit for FreeBSD

2009-12-10 Thread Steve Bertrand
Bill Moran wrote: > In response to Anton Shterenlikht : > >> >From my information security manager: >> >> FreeBSD isn't much used within the University (I understand) and has a >> (comparatively) poor security record. Most recently, for example: >> >> >> http://www.h-online.com/sec

Re: Root exploit for FreeBSD

2009-12-10 Thread Mike Tancsa
At 09:41 AM 12/10/2009, Anton Shterenlikht wrote: >From my information security manager: FreeBSD isn't much used within the University (I understand) and has a (comparatively) poor security record. Most recently, for example: http://www.h-online.com/security/news/item/Root-ex

Re: Root exploit for FreeBSD

2009-12-10 Thread Michael Butler
Anton Shterenlikht wrote: >>From my information security manager: > > FreeBSD isn't much used within the University (I understand) and has a > (comparatively) poor security record. Most recently, for example: > > > http://www.h-online.com/security/news/item/Root-exploit-for-Fre

Re: Root exploit for FreeBSD

2009-12-10 Thread Bill Moran
In response to Anton Shterenlikht : > >From my information security manager: > > FreeBSD isn't much used within the University (I understand) and has a > (comparatively) poor security record. Most recently, for example: > > > http://www.h-online.com/security/news/item/Root-exp